NIS2 for SMBs: A Technical Requirements Checklist

NIS2 is the EU's updated network and information security directive, and its reach extends well beyond large enterprises — many mid-sized companies, and suppliers to regulated companies, fall in scope directly or through their customers' supply-chain requirements.

One thing up front: this article covers the technical cybersecurity side. Determining whether and how NIS2 legally applies to your company is a question for your legal counsel — not for a security provider, and not for a blog post.

The technical capabilities NIS2 expects

In plain language, the directive expects organizations to have working answers to these:

Can you detect an attack? Continuous monitoring of systems and endpoints, with the ability to identify malicious activity — not once a year during an audit, but as it happens.

Can you respond to an incident? Defined incident handling: containing a compromised system, investigating what happened, and recovering — with the speed to meet tight reporting expectations.

Can you recover? Backup and disaster recovery that's actually tested, including for cloud data such as Microsoft 365.

Is access controlled? Identity protection, least-privilege access, and security management of the platforms your business runs on.

Are your people part of the defense? Security awareness training, since human error remains a primary entry point.

Is your supply chain considered? Increasingly, your customers will ask you for evidence of these controls — NIS2 flows down through contracts.

How managed services map to this

For most SMBs, building these capabilities in-house — a 24/7 monitoring function, incident response expertise, tested recovery — isn't realistic. Mapping CyberOM services to the checklist:

• Detection & response: SOC & Response ($9.20/endpoint/month) or SOC & Extended Response ($15.00/endpoint/month) on your existing EDR, or Full Cyber Stack ($35.00/endpoint/month) with EDR included.
• Recovery: Backup & Disaster Recovery ($5.80/endpoint/month) and Microsoft 365 Backup ($3.90/seat/month).
• Platform security: M365 Security Management ($3.50/M365 seat/month), email protection ($4.50/user/month), DMARC ($495.00/domain/month).
• People: Security Awareness Training ($3.12/user/month).
• Strategy and documentation: vCISO ($300 per client/month, 12-month minimum) for policies, risk assessment, and audit preparation.

Coverage for the technical requirements of NIS2 — alongside GDPR, HIPAA, PCI-DSS, ISO 27001, SOC 2, and DORA — is included with our packages at no extra cost.

FAQ

Does buying a package make my company NIS2 compliant?

A package covers the technical security controls. Full compliance also involves legal and organizational measures that are outside a security provider's scope — speak to your counsel about applicability.

We're not in the EU — does NIS2 matter to us?

Possibly, if you sell into EU companies that pass requirements down their supply chain.

Where do I start?

Submit a request describing your environment; our team responds within 24 hours with a concrete mapping.

See packages and pricing →