The NIS2 directive (Network and Information Security 2) has been transposed into French law since 2024. It massively broadens the scope of organizations subject to cybersecurity obligations — far beyond just critical large enterprises. Many SMBs and public bodies are affected without realizing it.
Criterion 1 — Your organization's size
NIS2 applies as soon as you exceed the SMB thresholds (50 employees or €10M annual revenue / balance sheet). Below that, you are not formally subject, but we strongly recommend voluntary compliance — cyber insurance requirements are converging on the same baseline.
Criterion 2 — Your industry
NIS2 distinguishes two categories: 'essential entities' (energy, transport, banking, health, water, digital infrastructure, space, public administration) and 'important entities' (postal services, waste management, critical manufacturing, agri-food, manufacturing, research, cloud providers, etc.).
Criterion 3 — Your concrete obligations
In-scope organizations must put in place documented cyber governance, a risk analysis, minimum technical measures (MFA, logging, immutable backup, training), an incident response plan, and report any significant cyber incident to ANSSI within 24 hours.
Criterion 4 — Sanctions
Sanctions go up to €10 million or 2% of global revenue for essential entities, €7 million or 1.4% for important entities. Personal liability of executives can be triggered.
Criterion 5 — Implementation timeline
Entity registration started in 2025. ANSSI controls are gradually intensifying. Anticipating now avoids urgency and sanctions.
Criterion 6 — Your subcontractors
NIS2 introduces extended supply-chain responsibility: you must ensure that your critical subcontractors (IT services, hosting, SaaS vendor) themselves apply a minimum security baseline. An audit of your supplier contracts is essential.
Criterion 7 — Your current posture
If you haven't run a recent cyber audit, if your Active Directory hasn't been hardened, if your backups aren't tested quarterly, if you haven't trained your teams on phishing — you are vulnerable, whatever your NIS2 status.
Where to start?
- NIS2 positioning audit (1 day) to clarify your exposure
- Current cyber posture mapping vs ANSSI requirements
- Costed and prioritized remediation plan over 6 to 18 months
- ISMS documentation setup
- Executive and employee training
- Incident response plan preparation