NIS2 & SME Guidelines: How Do They Apply And Thresholds

The NIS2 Directive ("NIS2"), building on the foundations of the original NIS Directive introduced in 2016, is aimed at enhancing and further harmonising the EU's cybersecurity framework. NIS2 expands the scope of covered entities and industries, to ensure better protection for critical infrastructure across the EU (see our video series for more general discussion on NIS2).

This article examines the criteria and thresholds applied under NIS2 for determining which entities are in scope and the extent of their obligations, with a particular focus on micro, small, and medium-sized enterprises (SMEs). We aim to highlight that an entity's turnover / balance sheet and the number of people they employ are not the sole determining factors in this regard, as many entities which meet these thresholds may still fall within the scope of NIS2, or face additional obligations, where they have access to significant additional resources.