The NIS2 directive (Network and Information Security 2) has been transposed into French law since 2024. It massively broadens the scope of organizations subject to cybersecurity obligations, far beyond just critical large enterprises. Many SMBs and public bodies are affected without realizing it.
Criterion 1 — Your organization's size
NIS2 applies as soon as you exceed the SMB thresholds (50 employees or €10M annual revenue / balance sheet). Below that, you are not formally subject, but we strongly recommend voluntary compliance, cyber insurance requirements are converging on the same baseline.
Criterion 2 — Your industry
NIS2 distinguishes two categories: 'essential entities' (energy, transport, banking, health, water, digital infrastructure, space, public administration) and 'important entities' (postal services, waste management, critical manufacturing, agri-food, manufacturing, research, cloud providers, etc.).
Criterion 3 — Your concrete obligations
In-scope organizations must put in place documented cyber governance, a risk analysis, minimum technical measures (MFA, logging, immutable backup, training), an incident response plan, and report any significant cyber incident to ANSSI within 24 hours.
Criterion 4 — Sanctions
Sanctions go up to €10 million or 2% of global revenue for essential entities, €7 million or 1.4% for important entities. Personal liability of executives can be triggered.
Criterion 5 — Implementation timeline
Entity registration started in 2025. ANSSI controls are gradually intensifying. Anticipating now avoids urgency and sanctions.
Criterion 6 — Your subcontractors
NIS2 introduces extended supply-chain responsibility: you must ensure that your critical subcontractors (IT services, hosting, SaaS vendor) themselves apply a minimum security baseline. An audit of your supplier contracts is essential.
Criterion 7 — Your current posture
If you haven't run a recent cyber audit, if your Active Directory hasn't been hardened, if your backups aren't tested quarterly, if you haven't trained your teams on phishing, you are vulnerable, whatever your NIS2 status.
Where to start?
- NIS2 positioning audit (1 day) to clarify your exposure
- Current cyber posture mapping vs ANSSI requirements
- Costed and prioritized remediation plan over 6 to 18 months
- ISMS documentation setup
- Executive and employee training
- Incident response plan preparation