NIS2 for SMEs: what your customer will soon ask of you

Your customer sends a questionnaire on information security. Or a request for quotation suddenly contains a paragraph about NIS2. You run an SME with thirty employees that does its work well, and you wonder whether that law also applies to you.

The short answer: the law usually asks nothing of you, but your customer does ask something about you. In this piece you read why, what customers will ask and what you can arrange this week. If you fall under the law yourself, read NIS2 for directors. This piece is about the supplier in the chain.

What the law asks of a supplier

The National Cyber Security Centre (NCSC) puts it like this: the Cybersecurity Act imposes no obligations on suppliers of organisations that fall under the law (NCSC, 8 July 2025). Suppliers are not themselves supervised and do not have to account to a supervisory authority (same source).

It is about your customer. NIS2 names the security of the supply chain as a measure, including the relationship with direct suppliers (Directive (EU) 2022/2555, Article 21(2)(d)). An organisation under the law can therefore set requirements for you. If it is inspected, it can ask you for evidence that the measures have been taken, so that it can show that to its supervisory authority (NCSC, same source).

Two misconceptions

You often hear two:

• That NIS2 applies to you just as it does to your customer. A flash poll by the Digital Trust Center in September 2024 showed that six out of ten suppliers who know NIS2 think so (NCSC, 8 July 2025).
• That you need a certificate. A quality mark or certificate is not a requirement for suppliers (NCSC, 8 July 2025). It can make the conversation with your customer easier, but it does not guarantee that the risk in the chain is covered, and every customer can ask for other measures (NCSC, accessed 5 October 2026).

Do you fall under the law yourself after all?

That is possible. A company with 10 to 50 employees is usually small under the European definition: fewer than 50 employees and an annual turnover or balance sheet total of at most 10 million euros (European Commission). The law applies to organisations in the sectors of annex 1 and 2, such as energy, digital infrastructure and research, and as a rule only from medium-sized (NCSC, accessed 5 October 2026). Employees are counted in FTE, and partner and linked enterprises, such as a parent company or subsidiaries, count towards employees, annual turnover and balance sheet total (same source).

Regardless of size, the law applies, among others, to providers of public electronic communications, trust service providers, top-level domain name registries, DNS service providers and domain name registration service providers (NCSC, information brochure Cybersecurity Act, February 2026), and to a company that the government designates because it is the only one in the Netherlands to provide a service that is needed to keep critical societal or economic activities running (Directive (EU) 2022/2555, Article 2). Not all obligations of the law apply to domain name registration service providers (NCSC, information brochure Cybersecurity Act, February 2026). If you provide such a service, first read the two sources above to see whether you fall under it.

What your customer will ask

Which questions you get is up to your customer. The five basic principles of digital resilience of the NCSC, intended for all organisations, serve as a guide (NCSC, accessed 5 October 2026). Expect questions like these:

• Risks: which systems and data of the customer do you touch, and what can go wrong there through you?
• Behaviour: do your employees know what to do with a phishing email?
• Systems: are updates and security on your computers, apps and devices in order?
• Access: who can access the customer's data, and does everyone use a second sign-in step?
• Incidents: what do you do when things go wrong, and how quickly does the customer hear about it from you?

That last point weighs heavily. An organisation under the law reports a significant incident in three steps: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month (NCSC, accessed 5 October 2026). So your customer wants to know quickly what is happening at your end.

What you can do tomorrow

A short checklist, in this order:

1. Write down which customers fall or may fall under the law, and which of their systems and data you use or can view.
2. Turn on a second sign-in step on every account with access to customer data and remove accounts of colleagues who have left.
3. Agree on a deadline for updates, write it down and restore a backup to see how long that takes.
4. Write an incident route on one A4 page: who calls the customer, within how many hours and on which number.
5. Do the NCSC Basic Cyber Resilience Scan (Basisscan Cyberweerbaarheid) to see whether you have the basics in order, and keep the result in one folder with the rest.

That way you have your answers and your evidence at hand for the next questionnaire.

Where Noveu fits

On the compliance page you can read which technical measures Noveu applies. How Noveu works for SMEs, you can read on the page for SMEs.