Skip to content

NIS2 for SMBs

Practical guidance for NIS2 governance, supply-chain assurance, and incident readiness, aligned with how regulators and customers ask questions. Use the takeaways and FAQ below as a checklist; then deep-link into your registers and change records.

Book an informal conversation

ISO Ready helps you align policy, risk, and evidence, without endless document churn.

Check your NIS2 gaps

What this page covers

Practical guidance for NIS2 governance, supply-chain assurance, and incident readiness, aligned with how regulators and customers ask questions. Use the takeaways and FAQ below as a checklist; then deep-link into your registers and change records.

Practical next steps

Assign owners, set review dates, and collect artefacts that match production reality. Use internal audits to rehearse the story before the external certification audit.

Common pitfalls

Avoid scope drift, ownerless actions, and documentation that does not match live configuration. Prefer short maintained records over one-off project dumps.

Dutch version: read the Dutch page (same topic, different URL).

Primary sources for this topic

Key takeaways

  • Link controls to risk treatment and your Statement of Applicability, avoid policy-only boxes.
  • Assign owners, review cadence, and measurable acceptance criteria for every material action.
  • Use sampling and KPIs to show controls work in operations, not only that they were planned.
  • Align incidents and vendor changes with privacy/legal where personal data or chain risk is involved.

Frequently asked questions

Does serving a regulated customer automatically put an SME in NIS2 scope?
A customer relationship alone does not establish the supplier’s own registration duty. Assess the supplier’s sector, service type, size and any specific designation under the applicable rules. Separately review security commitments passed through customer contracts. Keeping these two assessments distinct prevents a contractual request from being mistaken for a complete legal scope decision or an exemption.

Need help with the next step?

Explore support for your next step at ISO Ready. ISO Ready and this knowledge base are operated by Oosterwal Consultancy.

Explore your next step at ISO Ready

isocertificering.org is operated by Oosterwal Consultancy (oosterwal.com). ISO Ready (iso-ready.nl) has the same owner. Links to ISO Ready refer to our own commercial offering. About us (Dutch)

AI reading guide (llms.txt)