In your first 90 days under NIS2, confirm whether the directive covers you, assign accountable owners, map your current practice to the ten Article 21 measures, close the biggest gaps, and rehearse incident reporting. Remember that national law in each EU country adds the details, so check your member state.
Does NIS2 apply to a startup?
Often not, but check. Article 2 applies the directive to public or private entities of a type listed in Annex I or II that are at least medium-sized, which the text ties to the EU definition of a medium-sized enterprise, and that provide services or carry out activities in the Union. Some entities are in scope whatever their size, including DNS service providers, top-level domain registries, trust service providers, and providers of public electronic communications networks. Others are in scope where they are the sole provider of an essential service in a member state, or where a disruption could have a significant impact on public safety or create systemic risk.
If you sell to in-scope customers but are not in scope yourself, you will still meet NIS2 through contracts, because Article 21 makes supply chain security part of what those customers must manage.
Days 1 to 30: scope and ownership
- Decide, with legal advice, whether you are an essential or important entity, and in which member states. Write the reasoning down.
- Name an executive owner and a day to day lead.
- Build a simple inventory of systems, data and suppliers that support your service.
- Find your national authority and its rules. NIS2 is a directive, so each country transposes it in its own law.
Days 31 to 60: map the Article 21 measures
Article 21(2) says measures must cover at least these topics: risk analysis and security policies, incident handling, business continuity including backup and disaster recovery, supply chain security, security in acquisition, development and maintenance including vulnerability handling, assessing whether your measures work, basic cyber hygiene and training, cryptography, human resources security with access control and asset management, and multi-factor authentication where appropriate.
Score yourself on each one as none, partial or done, and attach the evidence you have. The text asks for measures that are appropriate and proportionate, taking into account your exposure, size and the likelihood and severity of incidents. A ten person company is not expected to look like a bank, but it is expected to have thought it through and recorded the answer.
Two items deserve early attention for software teams. Supply chain security means looking at the vulnerabilities and secure development practices of your direct suppliers. And security in development and maintenance includes vulnerability handling, which in practice means knowing what is in your software. A software bill of materials and continuous dependency scanning give you that. Safeguard can generate SBOMs and scan dependencies, but the policy and decisions are yours.
Days 61 to 90: fix and rehearse
Pick the three highest-risk gaps and close them. Multi-factor authentication on admin and remote access is usually quick. Then rehearse reporting. The directive's recitals describe the clock for a significant incident: an early warning without undue delay and within 24 hours of becoming aware, an incident notification within 72 hours, and a final report no later than one month after the notification. Run a tabletop exercise that tests whether you can decide what counts as significant, and who files, within that time.
What to do
- Get a written scoping decision for each member state you operate in.
- Assign an executive owner and a working lead.
- Create a one page inventory of systems, data and critical suppliers.
- Map your practice to each of the Article 21(2) topics and record evidence.
- Close the three biggest gaps, starting with multi-factor authentication.
- Write an incident reporting runbook with the 24 hour, 72 hour and one month steps.
- Run a tabletop exercise and fix what it exposes.
- Add NIS2 questions to your supplier review.
Quick check
Does NIS2 certify companies?
No. NIS2 is a legal directive with risk management and reporting duties, enforced by national authorities. There is no single NIS2 certificate. Standards such as ISO 27001 can support your evidence but do not replace your legal analysis.
What is the incident reporting timeline?
For a significant incident, an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report within one month of the notification, as described in the directive.
Sources
Last reviewed: 18 October 2026.
