How do you tackle NIS2 as an SME, without turning it into a year-long project?
The shortest route is not to write a big plan, but to start with what's already there. Most SMEs already have a password policy, a backup schedule, a list of who has access to which systems and a contact person for IT. That's not a complete cybersecurity policy, but it is the starting point of a file: document for each measure what its status is, who is responsible for it and what evidence shows that it's actually happening.
Building a file this way is not a project lasting months. It's a list you open today and that grows as you work: one measure is already there, another comes this month. There's no point at which it's 'done', and that's not the intention either. The duty of care that follows from the NIS2 Directive and the national laws based on it is not a one-off exercise but an ongoing practice. A living register fits that better than a thick document that disappears into a folder after delivery.
Start with what's already there, not with a blank page
Many companies think they're starting from scratch as soon as the word NIS2 comes up. That's rarely the case. An installation company usually already has agreements about who has access to customers' systems, an HR department has a process for revoking access when someone leaves, and almost every company has some form of backup, even if it's not on paper as a 'backup policy'. So the first step is not to write, but to take inventory: what are we already doing, where is that documented, and who can prove it.
Only then comes the question of which parts are still missing. That not only saves time, it also prevents you from doing duplicate work or setting up policies for something that's already well organised in practice, just not yet made visible. If you first want to know whether your organisation is actually covered by this, or is affected through a customer, you can see roughly where you stand with a few questions, without having to buy anything.
One measure, one status, one owner, one piece of evidence
The core of a workable file is simple: four fixed fields per measure. The status indicates whether something is in place, partially in place or still needs to happen. The owner is the person responsible for it, not necessarily the director themselves. The evidence is what shows that the measure exists: a schedule, an export from a system, a signed document. Without those four fields, a file remains a collection of good intentions; with those fields it becomes something you can also use to answer a customer's security questionnaire, because you don't have to improvise but can fall back on what's already documented.
This structure also works well because you don't have to tackle everything at once. You can start with the measures you already have the most for, which are quick to get in order, and tackle the rest in stages. An overview of which measures the duty of care exactly expects, and what falls under it, can be found under worked-out topics per situation.
Why this goes faster than it sounds
The impression that NIS2 is a year-long project often arises because people think in terms of a complete policy document that has to be ready all at once. A living register works the other way around: it starts small and incomplete, and is automatically updated with each change in your organisation, because you're already working on that change anyway. A new supplier, a different access system, a new employee with administrative rights — each moment is a natural opportunity to update the file, instead of redoing everything once a year.
What the file does and doesn't deliver
From a maintained dossier, you obtain the documents you need: the policies themselves, answers to questionnaires from your customers, and prepared texts for registration or notification to the supervisory authority. You must submit that notification or registration yourself via your supervisory authority's portal; a dossier prepares it, but does not take over the submission. A dossier is also not a replacement for an audit, a penetration test, or certification — that remains work for specialized parties, just as incident response does when something actually goes wrong.
If you want to know exactly how such a dossier is created and which sources are used, you can read that on the page about where the information in the platform comes from. For your organisation's specific situation, including the associated legal implications, a lawyer or the competent supervisory authority remains your best point of contact.
Do you want to see where your organisation currently stands? Take the free NIS2 check or browse through the topics that most closely match your situation.