NIS2 for Businesses: Is Your Company in Scope and What to Do

What is NIS2

The directive was adopted at the end of 2022, and member states had to transpose it into national law by 17 October 2024. In Bulgaria the requirements are introduced through amendments to the Cybersecurity Act.

The goal is that companies and institutions the economy depends on keep running when a cyberattack happens. That is why NIS2 looks beyond technology: does the organisation manage risk, does it know what to do in an incident, and does it control its suppliers?

NIS2 is not a certificate. There is no document you obtain once and for all. Compliance is shown through working measures, documentation and readiness to demonstrate them during an inspection. Standards such as ISO 27001 help build an orderly security system, but they do not replace the legal requirements.

Is your company in scope? Three questions

1. Which sector do you work in?

The directive lists two groups of sectors:

• Sectors of high criticality: energy, transport, banking, financial market infrastructure, health, drinking water and waste water, digital infrastructure, business-to-business ICT service management (managed service providers and managed security service providers), public administration and space.
• Other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing (for example medical devices, electronics, machinery and vehicles), digital providers (online marketplaces, search engines, social networks) and research.

2. How large is your company?

As a rule, medium and large enterprises are in scope: companies with 50 or more employees, or with annual turnover and balance sheet above EUR 10 million. For some activities size does not matter, for example providers of public electronic communications networks, DNS services and trust services, and the sole provider of a critical service in the country.

3. What is your role in the supply chain?

This is the question small companies most often miss. If you supply services, software or support to a company in scope, that company must manage the risk from its suppliers. In practice you will receive a security questionnaire or contract clauses, even if you are not legally obliged yourself.

If the answer to the first two questions is yes, your company is most likely in scope as an essential or important entity. Essential entities (usually large companies in the high-criticality sectors) are supervised proactively, important entities after a report or an incident. The required measures are the same.

NIS2 and small and mid-sized businesses

Small companies (under 50 employees and under EUR 10 million turnover) are, as a rule, not directly obliged. But many small and mid-sized companies supply banks, hospitals, energy companies, logistics and manufacturing firms. When such a customer starts applying NIS2, it will ask its suppliers for evidence: how data is protected, who has access, whether there are backups and how incidents are handled.

It makes sense to see NIS2 as a market requirement, not just a law. The company that can answer a large customer's security questionnaire with confidence wins the contract.

What NIS2 requires in practice

Article 21 of the directive lists at least ten groups of measures. In everyday terms:

• Risk analysis and information system security policies.
• An incident response process: who notices, who decides, who reports.
• Business continuity: backups, disaster recovery and crisis planning.
• Supply chain security: requirements for suppliers and assessment of their risk.
• Security in acquiring, developing and maintaining systems, including vulnerability handling and updates.
• Checking whether the measures actually work, for example through an IT audit of the company infrastructure.
• Basic cyber hygiene and staff training.
• Encryption rules.
• Personnel security, access control and an inventory of assets: devices, accounts and systems.
• Multi-factor authentication and secured communication channels, including for emergencies.

Incident reporting. For a significant incident the company must send an early warning to the competent authority within 24 hours, an incident notification within 72 hours and a final report within one month. Without a process prepared in advance, these deadlines are very hard to meet. That is why proactive monitoring of IT systems, which catches problems early, and ransomware protection matter.

Management accountability and penalties

NIS2 puts security directly on the managing director's desk. Management must approve the measures, oversee their implementation and take part in training. Members of management can be held personally liable for breaches.

Fines are significant: for essential entities up to at least EUR 10 million or 2% of worldwide annual turnover, and for important entities up to at least EUR 7 million or 1.4% of turnover, whichever is higher. The exact amounts and procedures are set by national law.

NIS2 and your suppliers

Supplier risk is one of the key points of NIS2. Many incidents start not inside the company but with its IT provider, accounting software or cloud service. That is why the directive requires companies to know which suppliers have access to their systems, what measures they apply and what the contracts say about security and incidents.

If your computer and server support is outsourced, check: does your provider have contractual response times, how does it manage access to your systems, which remote access tool does it use, and will it notify you immediately in case of an incident? If you are still choosing a partner, see how to choose an external IT partner and how to outsource IT support correctly.

How to get started: 6 practical steps

1. Check your scope with the three questions above and write down the conclusion.
2. Make an inventory: employees, devices, accounts, servers, cloud services and suppliers with access.
3. Assess the risk: which systems stop the business if they fail, and what happens to the data.
4. Close the biggest technical gaps: multi-factor authentication, tested backups, endpoint protection and timely updates.
5. Describe the incident process: who reports, when and how, including to the authority within 24 hours.
6. Appoint a responsible person in management and plan staff training.

You do not have to do everything at once. What matters is starting with the right scope and documenting what you do.

Technical NIS2 compliance for managed support clients

Many of the technical NIS2 requirements are everyday IT work. For its clients on subscription support, Helpdesk Bulgaria prepares the IT environment and brings it into technical compliance with NIS2: we implement the measures, maintain them and document them so you can show them during an inspection. The subscription includes:

• 24/7 monitoring of servers and workstations.
• Antivirus licences and endpoint protection, plus EDR and SIEM for threat detection and analysis on the Professional plan.
• Backup policies and disaster recovery.
• Access and account management, including multi-factor authentication.
• Timely updates and vulnerability remediation.
• A business-grade remote access tool and trackable support tickets.

Technical preparation and technical NIS2 consulting are included in the Professional plan. On the Standard plan, they are charged separately.

Organisational measures - policies, training, management accountability and reporting to the authority - remain the company's responsibility. With a solid technical foundation, however, they become much easier. See what each plan includes on the computer support page.

See the plans | Request a quote

Frequently asked questions

Does NIS2 apply to small companies?

As a rule no, if the company has fewer than 50 employees and under EUR 10 million turnover and balance sheet, except for some specific activities. Small companies often receive requirements indirectly, as suppliers to companies in scope.

Is there a NIS2 certificate?

No. NIS2 is a legal obligation, not a certificate. Compliance is shown through working measures and documentation. Standards such as ISO 27001 help but do not replace the legal requirements.

What are the incident reporting deadlines?

An early warning within 24 hours, a notification within 72 hours and a final report within one month of a significant incident.

What are the penalties?

Up to at least EUR 10 million or 2% of worldwide turnover for essential entities and up to at least EUR 7 million or 1.4% for important entities. Management can be held personally liable.

Where do I start?

With a scope check and an inventory of systems and suppliers. Then close the biggest technical gaps: multi-factor authentication, backups and device protection.

Can Helpdesk Bulgaria bring our company into NIS2 compliance?

For our managed support clients, we bring the IT environment into technical compliance with NIS2: endpoint protection, EDR and SIEM, monitoring, backups, access control and updates, implemented and documented. This is included in the Professional plan; on the Standard plan, technical consulting and EDR and SIEM licences are charged separately. Organisational measures and reporting to the authority remain the responsibility of the company's management.

This article is for information only and is not legal advice. For your specific case, check the current text of the national cybersecurity law.