How do you tackle NIS2 as an SME, without turning it into a year-long project?
The shortest route is not to write a big plan, but to start with what's already there. Most SMEs already have a password policy, a backup schedule, a list of who has access to which systems and an IT contact person. That's not a complete cybersecurity policy, but it is the starting point of a file: for each measure, document what the status is, who is responsible for it and what evidence shows that it actually happens.
Building a file this way is not a project of months. It's a list you open today and that grows as you work: one measure is already there, another comes in this month. There is no moment when it is "done", and that is not the intention either. The obligation to take appropriate measures that follows from the NIS2 Directive and national laws on it is not a one-off exercise but an ongoing practice. A living register fits better with that than a thick document that disappears into a folder after delivery.
Start with what's already there, not with a blank page
Many companies think they are starting from scratch as soon as the word NIS2 is mentioned. This is rarely the case. An installation company usually already has agreements about who has access to customer systems, an HR department has a process for revoking access when someone leaves, and almost every company has some form of backup, even if it's not documented as a "backup policy". So the first step is not to write, but to take inventory: what are we already doing, where is it documented, and who can demonstrate it.
Only after that comes the question of which parts are still missing. That not only saves time, it also prevents you from doing double work or creating policies for something that is already well-organized in practice, just not yet made visible. If you want to first find out whether your organization is actually subject to this, or is affected through a customer, that can be seen with a few questions about where you roughly stand, without you having to buy anything for it.
One measure, one status, one owner, one piece of evidence
The core of a workable file is simple: four fixed fields per measure. The status indicates whether something is arranged, partially arranged or still needs to happen. The owner is the person responsible for it, not necessarily the director. The evidence is what shows that the measure exists: a schedule, an export from a system, a signed document. Without those four fields, a file remains a collection of good intentions; with those fields it becomes something you can also use to answer a security questionnaire from a customer, because you don't have to improvise but can fall back on what is already documented.
This structure also works well because you don't have to tackle everything at once. You can start with the measures for which you already have the most, which can be sorted quickly, and tackle the rest in phases. An overview of exactly which measures the obligation to take appropriate measures expects, and what falls under it, can be found under the detailed topics per situation.
Why this takes less time than it sounds
The impression that NIS2 is a year-long project often arises because people think in terms of a complete policy document that has to be ready all at once. A living register works the other way around: it starts small and incomplete, and is automatically updated with every change in your organization, because you are already working on that change anyway. A new supplier, a different access system, a new employee with administrative rights — every moment is a natural opportunity to update the file, rather than redoing everything once a year.
What the file does and doesn't provide
Fra en vedligeholdt dokumentsamling følger de dokumenter, du har brug for: selve politikken, svarene på spørgeskemaer fra dine kunder, og forberedt tekst til registrering eller indberetning til tilsynsmyndigheden. Du skal selv indberette eller registrere dette via tilsynsmyndighedens portal; en dokumentsamling forbereder det, men overtager ikke indsendelsen. Dokumentsamlingen er heller ikke en erstatning for en revision, en penetrationtest eller certificering — det bliver fortsat arbejde for specialiserede parter, ligesom incidentrespons når der faktisk går noget galt.
Den der gerne vil vide præcis, hvordan sådan en dokumentsamling opstår, og hvilke kilder der bruges, læser det på siden om hvor informationen i platformen kommer fra. For situationen i din egen organisation, med de tilhørende juridiske konsekvenser, forbliver en advokat eller den relevante tilsynsmyndighed det rigtige sted at henvendelse sig.
Vil du se, hvor din organisation står lige nu, foretag da den gratis NIS2-kontrol eller gennemse de emner, der ligger tættest på din situation.