NIS2 (Law 5160/2024): what it means for an SME

The NIS2 directive is the new European framework for cybersecurity. In Greece it was transposed by Law 5160/2024. Many owners of small and medium businesses ask whether it applies to them and what they need to do. The short answer: perhaps not directly, but almost certainly indirectly.

This article gives a general overview. It is not legal advice. To find out whether your business falls under the law and exactly which obligations you have, check with your legal adviser.

What NIS2 is

NIS2 replaces the earlier NIS directive and greatly widens the range of organisations it covers. The aim is a common, higher level of security across the European Union. Organisations in scope must take risk management measures and report significant incidents to the competent authorities.

One important point is management accountability. Cybersecurity is no longer seen as a matter for the technical team alone. Management approves the measures, oversees how they are applied and is accountable for them.

Who it applies to

The directive divides organisations into "essential" and "important" entities. Whether it applies to you depends mainly on two things: your sector and the size of your business. Broadly, it covers:

• Organisations in sectors of high criticality, such as energy, transport, banking, health, water, digital infrastructure, ICT service management and public administration.
• Organisations in other critical sectors, such as postal services, waste management, chemicals, food production and distribution, manufacturing and digital providers.
• As a rule, only medium and large businesses in these sectors.
• Certain organisations regardless of size, such as DNS service providers or providers of public communications networks.

Micro and small businesses in most sectors usually do not fall directly in scope. However, the rules have exceptions and details, so the final assessment needs a legal review.

Why it matters to you even if you are not in scope

NIS2 requires the entities it covers to look after the security of their supply chain as well. This means their suppliers, even very small companies, will be asked about their security measures.

If you work with a hospital, an energy company, a logistics firm or a large manufacturer, expect questionnaires, contract clauses and requests for evidence. A business that already has the basics in order answers easily and keeps the customer.

Prepare a two-page document that describes your security measures: backups, MFA, updates, access, incident plan. You will need it for your first customer questionnaire.

The basic measures every SME should have

NIS2 describes a set of risk management measures. Most of them are good practice for any business, whether or not the law requires them of you.

1. Risk analysis: which systems and data you have, how critical they are and what happens if they are lost.
2. Multi-factor authentication (MFA) on email, the cloud and remote access.
3. Backups following the 3-2-1 rule, with regular restore tests.
4. Regular updates to computers, servers, routers, firewalls and applications.
5. Access rights limited to what each person needs, and accounts removed promptly when someone leaves.
6. An inventory of equipment and software, so you know what you need to protect.
7. Encryption on laptops and secure VPN connections.
8. Staff training on phishing and payment fraud.
9. A written plan for handling incidents and keeping the business running.

A realistic plan in three steps

You do not need to do everything at once. For a small or medium business, a staged plan is more achievable and delivers results from the first month.

1. First month: MFA everywhere, a check that backups work, and default passwords changed on routers and devices.
2. Following months: equipment inventory, updates, network segmentation with VLANs, staff training.
3. Over the year: written policies, an incident plan, supplier checks and regular review of the measures.

Incident reporting

Entities in scope of NIS2 must report significant incidents within short, set time frames, starting with an early warning within 24 hours. To do that, you first need to be able to tell that something has happened. Without logs and someone who looks at them, an incident can go unnoticed for weeks.

Even if you have no legal obligation, it is worth knowing whom you inform and how. If personal data is leaked, the separate GDPR obligations towards the Data Protection Authority apply.

Turn on alerts for suspicious sign-ins in Microsoft 365 or Google Workspace. It is one of the simplest and cheapest early detection measures.

Do not wait for the first questionnaire or the first incident to get started. Most of these measures do not need expensive equipment. They mainly need the right settings, a little documentation and someone who keeps an eye on them regularly.

Where to start

First, check with your legal adviser whether your business falls under Law 5160/2024. In parallel, carry out a technical assessment of where you stand today: network, devices, accounts, backups. This produces a prioritised list that fits your size and budget.

CyberSpace Dynamics handles the technical side: assessment, firewall and VLANs, MFA, backups, updates, documentation and staff training. We work alongside your legal adviser, so the measures also cover the requirements that apply to you.