Three answers to “does NIS2 apply to us?”
When the directive (EU 2022/2555) was transposed in Italy as D.Lgs. 138/2024 (in force since 16 October 2024, with the ACN as competent authority), most small and medium companies performed one quick check: we are not energy, banking, or health; we have fewer than 50 people; NIS2 is not our problem. Then they filed it away.
The honest answers are three, and only one of them is “no”:
Yes, you are in scope. If you operate in one of the listed sectors at medium size (50 or more employees, or more than 10 million euros in turnover), you are an essential (Annex I) or important (Annex II) entity. And some categories are in scope regardless of size: DNS service providers, trust service providers, and (the one almost nobody expects) ICT service management providers, which includes MSPs and MSSPs. If your company sells managed IT or security services to other businesses, NIS2 is directly about you.
Not yet. If you genuinely fall outside the sectors and thresholds, the directive does not currently bind you directly. Register this conclusion somewhere: it is a documented decision, not an oversight, and it needs revisiting every time you grow or add a service line.
Through somebody else. This is the majority case, and the one companies miss. Your customers who are in scope are required by Article 21 to secure their supply chain: vendor security assessments, incident-notification clauses, audit rights, and contract renewals that now include cybersecurity questionnaires. Their cyber insurance renewals ask the same. NIS2 does not need to apply to you directly to change what your customers demand from you.
The part with teeth: Article 20
The controls in Article 21 (risk analysis, incident handling, business continuity, supply chain security, MFA, encryption, hygiene) are what most summaries focus on. They are the work. But the clause that changed the conversation in every boardroom is Article 20:
Management bodies must approve the cybersecurity risk-management measures, oversee their implementation, and can be held liable for failures. Management must also receive training sufficient to understand the risks. Member states can impose temporary bans on managerial functions for essential entities in case of serious non-compliance. In Italy, the implementing decree ties violations to managerial, disciplinary and administrative liability, and the fines go up to 10 million euros or 2% of global turnover for essential entities, 7 million or 1.4% for important ones.
Delegating the work internally is explicitly allowed: the Italian regulator confirms it in its own FAQ. What cannot be delegated is the accountability. The signature at the end of the risk-assessment document belongs to the board, and so does the consequence of getting it wrong.
The clock you cannot negotiate with
When a significant incident happens, the timeline is fixed: early warning to the authority within 24 hours of becoming aware, full notification within 72 hours, a final report within one month. In Italy, that means the ACN and CSIRT Italia.
Read that clock operationally, because it defines what your security setup must be able to do: detect that something significant is happening, escalate to a human empowered to decide, and produce a structured notification at night, on a Sunday, within one day. If your current arrangement is “the external IT provider emails us when something seems wrong,” you cannot meet this timeline. That is not a criticism; it is a gap to fix before an incident finds it.
Outsourcing: the correct model, done correctly
For a company of 50 to 200 people, keeping a full security function in-house makes little sense. Outsourcing is the right call: nobody hires a permanent team of penetration testers, a 24/7 SOC, and a compliance specialist for one site. Article 20 expects management to use external providers where appropriate. The directive only insists that using them does not reduce your accountability.
What you can hand over:
- Continuous monitoring and detection (MDR/SOC)
- Periodic vulnerability assessment and penetration testing
- Hardening work: configuration, patching programmes, architecture fixes
- Incident-response retainer: containment and forensics when something breaks
- Compliance evidence collection mapped to the frameworks you sell against or get audited on
What stays with you, no matter who you hire:
- Knowing what you own: the asset and system inventory. Nobody can inventory your estate for you; the information only exists in your heads and contracts
- Risk acceptance. When the provider says “this exposure costs X to fix,” someone in your company decides to accept, mitigate, or transfer. That decision is yours
- The reporting duty. The legal obligation to notify the authority is yours, not the provider’s
- Oversight of the outsourcing itself, which under Article 21 is literally one of the required measures
The contract is where this lives or dies
The gap between “we outsourced security” and “we can actually meet the NIS2 clock” is written entirely in the provider contract. Five clauses that decide it:
1 · Breach notification in hours, not days. Your provider must commit to telling you about a suspected significant incident within a few hours, single digits. If their SLA says 48 or 72 hours, the regulatory clock is already past its first deadline before you even hear about it.
2 · Evidence, not assurances. Reports, logs and findings in a form you can hand to an auditor, a customer, or the authority without asking the provider to produce documents during an incident.
3 · A responsibility split you can draw on one page. Provider detects, contains and remediates. You accept risk, make decisions, and file. Ambiguity in this split is discovered mid-incident, at the worst possible moment.
4 · Retest included. A fix that was never verified is a claim, not a result. The retest belongs in scope.
5 · Documentation transfer. Everything the provider builds (runbooks, configurations, architecture decisions) is yours to keep and hand to the next provider. No lock-in, because switching providers mid-contract should not mean starting over.
Your provider is probably in scope too
Here is the twist that closes the loop: MSPs and MSSPs, the companies small and medium businesses typically outsource IT and security to, are themselves essential entities under NIS2, in the ICT service management category. They carry their own obligations: registration, risk measures, the same 24-hour clock.
Use that. Ask your provider for their NIS2 posture: are they registered with the ACN, what security measures do they operate, how do they handle incidents internally, can they show you evidence. A provider that carries NIS2 obligations seriously is a better partner for you. A provider that cannot produce an answer is not just a weak link: they are part of your attack surface, and now also part of your compliance story.
Thirty days, one page
For a company of 50 to 200 people that wants to move from “we think we are fine” to a defensible position, four weeks is enough:
Week 1, Scope. Map your activities against the sectors and thresholds. Write the conclusion down, whichever way it goes. An undocumented “not in scope” is indistinguishable from an unchecked box when a customer or an auditor asks.
Week 2, Inventory. Systems, data, dependencies, and every provider who touches your infrastructure. Flag which customers are in scope and what their contracts already require of you.
Week 3, Gap assessment. Measure your current state against the Article 21 measure areas: risk analysis, incident handling, business continuity, backup, supply chain security, secure acquisition, effectiveness assessment, hygiene, cryptography, access and asset management, MFA. Most companies find the gaps are concentrated in three or four of these.
Week 4, Plan and signature. Remediation plan with owners and dates, and the Article 20 conversation: management training, formal approval of the risk measures, and a named person for the reporting decision.
The uncomfortable summary
NIS2’s real innovation is not the list of controls: good SMEs were already doing most of them. The innovation is Article 20: security accountability moved from the IT department to the boardroom, with personal consequences attached.
Outsourcing execution remains the correct model for almost every small and medium company. Nobody should build a full security team for one production system. But the boundary is now drawn in law: the contract determines who does the work; the directive determines who answers for it. Get the first half right with a good provider, and get the second half right by never pretending the handover moved the accountability.
We run fixed-scope security reviews for exactly this situation: findings ranked by real exploitability, the fixes implemented, and technical evidence you can hand to auditors and customers, mapped to the NIS2, SOC 2 and ISO 27001 control areas your contracts reference. Two weeks, fixed price, retest included.
For the technical side of the controls, read our guide on SOC 2 and ISO compliance without an enterprise budget.