{"id":13130,"date":"2026-05-29T12:11:14","date_gmt":"2026-05-29T10:11:14","guid":{"rendered":"https:\/\/staging.netxconsult.de\/?p=13130"},"modified":"2026-06-15T18:14:38","modified_gmt":"2026-06-15T16:14:38","slug":"nis2-checklist-sme","status":"publish","type":"post","link":"https:\/\/netxconsult.de\/en\/blog\/nis2-checklist-sme\/","title":{"rendered":"NIS2 Checklist for SMEs: 10 Measures You Must Implement Now"},"content":{"rendered":"

What should you know about NIS2? Does it affect your company?<\/b>
\nNIS2 is the EU directive on network and information security, which has been transposed into German national law since December 2025 through the NIS2 Implementation Act (NIS2UmsuCG). It obliges companies with 50 or more employees in 18 regulated sectors to implement specific IT security measures \u2013 including personal liability of management in case of violations.<\/p>\n

Many SMEs still underestimate the scope of the directive. Many companies are asking themselves: are we even affected by NIS2? In this article, you will find a practical NIS2 checklist that allows you to assess within minutes whether your company is affected and which measures you should implement right away. We would be happy to support you on your journey towards NIS2 compliance.<\/p>\n<\/div><\/div><\/div><\/div><\/div>

Am I affected by NIS2 as an SME?<\/h2><\/div>

Before you go through the list, we recommend that you first determine whether your organization is subject to NIS2. NIS2 generally<\/strong><\/em> applies to organizations that meet all three of the following criteria. However, caution is advised: even if your organization does not directly<\/strong><\/em> meet the criteria below, it may still be subject to NIS2 indirectly<\/em><\/strong> through its supply chain<\/strong><\/em>.<\/p>\n<\/div><\/div><\/div>

\n
\n\n\n\n\n\n\n\n
Criterion<\/th>\nThreshold<\/th>\n<\/tr>\n<\/thead>\n
Employees<\/td>\n50 or more<\/td>\n<\/tr>\n
Annual turnover or balance sheet<\/td>\n\u20ac10 million or more<\/td>\n<\/tr>\n
Sector<\/td>\nOne of 18 regulated sectors \u2013 see full list below<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
<\/div>

 <\/p>\n

 <\/p>\n<\/div>

Which 18 sectors are affected by NIS2?<\/h3><\/div>

NIS2 differentiates between two groups: 11 sectors of high criticality (Annex 1) and 7 additional critical sectors (Annex 2).<\/p>\n<\/div>

Annex 1 \u2014 Sectors of High Criticality<\/h4><\/div>\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
#<\/th>\nSector<\/th>\nExamples<\/th>\n<\/tr>\n<\/thead>\n
1<\/td>\nEnergy<\/td>\nElectricity, district heating, natural gas, oil, hydrogen<\/td>\n<\/tr>\n
2<\/td>\nTransport<\/td>\nAviation, rail, maritime, road transport<\/td>\n<\/tr>\n
3<\/td>\nBanking<\/td>\nCredit institutions<\/td>\n<\/tr>\n
4<\/td>\nFinancial market infrastructure<\/td>\nTrading venues, central counterparties<\/td>\n<\/tr>\n
5<\/td>\nHealthcare<\/td>\nHospitals, laboratories, pharmaceuticals<\/td>\n<\/tr>\n
6<\/td>\nDrinking water<\/td>\nWater suppliers<\/td>\n<\/tr>\n
7<\/td>\nWastewater<\/td>\nWastewater treatment<\/td>\n<\/tr>\n
8<\/td>\nDigital infrastructure<\/td>\nCloud providers, data centres, DNS<\/td>\n<\/tr>\n
9<\/td>\nICT services (B2B)<\/td>\nManaged service providers, IT service providers<\/td>\n<\/tr>\n
10<\/td>\nPublic administration<\/td>\nGovernment authorities at federal and state level<\/td>\n<\/tr>\n
11<\/td>\nSpace<\/td>\nSatellite operators, space infrastructure<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

Annex 2 \u2014 Additional Critical Sectors<\/h4><\/div>\n
\n\n\n\n\n\n\n\n\n\n\n\n
#<\/th>\nSector<\/th>\nExamples<\/th>\n<\/tr>\n<\/thead>\n
12<\/td>\nPostal and courier services<\/td>\nParcel delivery, mail services<\/td>\n<\/tr>\n
13<\/td>\nWaste management<\/td>\nDisposal companies, recycling<\/td>\n<\/tr>\n
14<\/td>\nChemicals<\/td>\nChemical industry, hazardous materials<\/td>\n<\/tr>\n
15<\/td>\nFood<\/td>\nProduction, processing, wholesale<\/td>\n<\/tr>\n
16<\/td>\nManufacturing<\/td>\nMechanical engineering, medical technology, automotive<\/td>\n<\/tr>\n
17<\/td>\nDigital services<\/td>\nOnline marketplaces, search engines, social networks<\/td>\n<\/tr>\n
18<\/td>\nResearch<\/td>\nResearch institutions, universities<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

Source: NIS2UmsuCG, Anlage 1 und 2 – BSI NIS-2 regulierte Unternehmen<\/a> (in force since 6 December 2025)<\/em><\/p>\n<\/div>

\n

Important<\/b>: An estimated 80% of affected companies are still unaware that they fall under NIS2. By the BSI registration deadline on 6 March 2026, only 38.5% of affected companies had registered. Companies that have not yet acted are already in violation of applicable law.<\/p>\n

Not sure whether your sector is affected? The German Federal Office for Information Security (BSI) offers a free assessment tool <\/a>\u2013 get clarity within 5 minutes.<\/strong><\/p>\n<\/blockquote>\n<\/div><\/div><\/div><\/div><\/div>

Indirect impact: When NIS2 affects you via the supply chain<\/h2><\/div>

 <\/p>\n<\/div><\/div><\/div><\/div><\/div>

Even if your business does not belong to one of the 18 sectors or does not meet the thresholds, you may still be indirectly affected by NIS2.<\/p>\n

As supply chains become increasingly digitalised, cyber risks grow significantly. The German BSI Act<\/b> requires companies that fall under NIS2 to ensure the security of their entire supply chain<\/a>.<\/p>\n

In practical terms, this means: <\/b>if your customer is subject to NIS2, they are legally obliged to pass on security requirements to you as a supplier or service provider.<\/p>\n<\/div><\/div><\/div>

\"NIS2:<\/span><\/div><\/div><\/div><\/div><\/div>

What NIS2 requires from affected companies regarding their supply chain<\/h3><\/div>