NIS2 for SMEs in 2026: what changes for regulated companies and their suppliers

NIS2 for SMEs matters in two ways: some small and medium-sized businesses fall directly under Legislative Decree 138/2024, which transposed the EU directive into Italian law, while many more are affected as suppliers to regulated companies, which must secure their supply chain. Either way, 2026 calls for concrete security measures and the ability to prove them.

Since the rules came into force, many business owners have asked the same question: does this apply to us? This guide covers who is in scope, what the law requires, why it reaches companies that are not directly regulated and where it makes sense to start.

Who has to comply with NIS2?

NIS2 applies to organisations operating in the sectors listed in the decree that exceed certain size thresholds, plus some categories that are covered regardless of size. The decree splits them into two groups: essential entities and important entities, with similar obligations but different levels of supervision and penalties.

Which sectors are covered

The highly critical sectors include energy, transport, banking and financial market infrastructure, healthcare, drinking water and waste water, digital infrastructure, managed ICT services for other businesses, public administration and space. Other critical sectors include postal and courier services, waste management, chemicals, food production and distribution, certain kinds of manufacturing, digital service providers and research.

Company size matters

As a rule, medium-sized and large companies in these sectors are covered, while micro and small businesses are excluded except in specific cases. Working out whether your company is in scope means looking at the activities it actually carries out, headcount, turnover and group membership. It is worth checking carefully, starting from the guidance published by Italy's National Cybersecurity Agency (ACN).

What changes with NIS2 in 2026?

For many companies, 2026 is when NIS2 moves from registration to day-to-day practice. Organisations in scope register on the ACN platform and, once notified of their inclusion in the list of NIS entities, have nine months to set up incident reporting and eighteen months to adopt the baseline security measures. For those notified during 2025, these deadlines fall due this year.

In practice, knowing you are in scope is no longer enough: you need working procedures, measures in place and documentation ready.

What obligations does Decree 138/2024 introduce?

Legislative Decree 138/2024 introduces three sets of obligations: risk management, incident reporting and accountability at board level.

Risk management

Regulated companies must adopt technical and organisational measures that are proportionate to the risks. These include:

• risk analysis and information system security policies;
• incident handling and business continuity, including backup and recovery;
• supply chain security;
• access control and multi-factor authentication;
• vulnerability and patch management;
• encryption where appropriate;
• staff training and basic cyber hygiene.

Reporting significant incidents

When a significant incident occurs, the sequence is set by law: an early warning to CSIRT Italia within 24 hours of becoming aware of it, a notification within 72 hours with an initial assessment of severity and impact, and a final report within one month. These are tight deadlines that can only be met if the procedure has been prepared in advance.

Accountability at the top

Management bodies approve the security measures, oversee their implementation, take part in specific training and are answerable for them. The penalties are significant and partly calculated on turnover. Even so, treating NIS2 as a question of fines would miss the point: much of what it describes is simply what a well-run company should already be doing to protect itself.

Why does NIS2 affect suppliers too?

NIS2 affects suppliers because supply chain security is one of the obligations placed on regulated companies. A NIS entity must assess the risks that come from those who access its systems, handle its data or provide critical components and services.

This translates into requests that many SMEs are already receiving: security questionnaires, contract clauses on incident notification, specific questions about backup, authentication and patching, and sometimes full audits. A workshop making parts for an energy company, a firm handling data for a healthcare provider, a software house supplying a management system: none of them is necessarily a NIS entity, but all of them may be asked to prove that they work securely.

Those who can answer clearly will have a real advantage with their customers. Those who cannot risk being classed as a high-risk supplier, with obvious consequences when contracts come up for renewal.

How to answer a security questionnaire

A security questionnaire goes well when the answers describe what the company actually does and are backed by evidence. The questions nearly always cover the same ground:

• who can access systems and with what kind of authentication;
• how and how often updates are installed;
• where backups are kept, whether they are separated from the network and whether restores are tested;
• how an incident is handled and reported, and how quickly;
• what training staff receive.

Answering “yes” to everything without being able to prove it is the quickest way to lose credibility. An honest picture, with a clear plan to fill the gaps, works far better.

NIS2 for SMEs: where should you start?

The starting point is the same whether you are in scope or responding to customers: understand where you stand, secure the fundamentals and document what you do. These are the steps, in the order in which it makes sense to tackle them.

1. Check where you stand. Sector, activity, size and group membership decide whether you are in scope. If you supply regulated companies, list which ones and what you provide.
2. Take stock. Systems, data, critical services, who has access and which suppliers are involved. Without that map, every later measure is guesswork.
3. Assess risks and weaknesses. A vulnerability assessment gives an objective view of the weak points in both internet-facing and internal systems.
4. Secure the fundamentals. Multi-factor authentication on email and remote access, regular updates, admin accounts separate from everyday ones, and tested backup and disaster recovery.
5. Plan for incidents. Who decides, who communicates, who calls whom. With 24- and 72-hour deadlines, the procedure must be written and rehearsed beforehand.
6. Keep records. Policies, procedures and logs are the evidence of what you do, and what customers and authorities will ask to see.

How can you comply without wasted effort?

NIS2 compliance pays off best when it is built around how the company really works, not around an off-the-shelf document pack. Measures have to reflect actual risks, and a questionnaire completed without a coherent organisation behind it will not survive the first check.

A tailored approach starts from real systems and processes, sets priorities and sequences the work in a sustainable way. It produces measures that stay useful and are far easier to keep up to date, and it is also the most efficient way to spend: things done properly once do not need redoing every time a customer sends a new questionnaire. Our NIS2 and GDPR compliance service follows this approach, supporting the business from the initial assessment through to documentation.

For the technical side and incident management, VAY works with Cybernix, its dedicated cybersecurity division.

If you would like to understand how NIS2 affects your company, directly or through your customers, get in touch: we can start together with an initial review of where you stand.

Frequently asked questions

Do small businesses have to comply with NIS2?

As a rule, NIS2 applies to medium-sized and large companies in the sectors listed by the decree, although some categories are covered regardless of size. A small business may still receive security requirements from regulated customers, because they have to manage risks in their supply chain.

How quickly must an incident be reported under NIS2?

Italy's Legislative Decree 138/2024 requires an early warning to CSIRT Italia within 24 hours of becoming aware of a significant incident, followed by a notification within 72 hours with an initial assessment. A final report is due within one month of the notification.

Who enforces NIS2 in Italy?

The competent national authority is the National Cybersecurity Agency (ACN). Entities in scope register on its platform and, from the moment they are notified of their inclusion in the list of NIS entities, have nine months to set up incident reporting and eighteen months to adopt the baseline security measures.

What can a NIS2-regulated customer ask of its suppliers?

The most common requests are security questionnaires, contract clauses on incident notification, and evidence of backups, multi-factor authentication and patching. Where the relationship is more sensitive, the customer may also ask for checks or audits.

Are company directors personally accountable under NIS2?

Yes. Management bodies must approve the risk management measures, oversee their implementation and take part in security training. They are answerable if the rules are breached.