EU Cybersecurity Act Compliance for SMEs: What You Actually Need to Do

Understanding the EU Cybersecurity Act's Scope

The EU Cybersecurity Act established ENISA's permanent mandate and created a cybersecurity certification framework for ICT products, services, and processes. For SMEs and freelancers, the most relevant developments are the sector-specific requirements that have followed: the NIS2 Directive extended cybersecurity obligations to many more business categories, and product-specific certification schemes have proliferated across sectors.

Whether the Cybersecurity Act directly affects you depends primarily on the sector you operate in and the type of services or products you provide. Digital service providers, managed service providers, and businesses in critical infrastructure supply chains have the most direct obligations.

NIS2 and SME Obligations

The Network and Information Security 2 Directive (NIS2) expanded cybersecurity requirements to a much broader set of entities than its predecessor. Medium-sized enterprises with 50 or more employees or €10 million in turnover in relevant sectors — including digital infrastructure, ICT service management, and several others — have explicit legal obligations.

Even if your business falls below these thresholds, your larger clients' compliance requirements often cascade to you as a supplier. If you provide IT services, consulting, or any digital service to entities that are themselves subject to NIS2, expect to face contractual cybersecurity requirements as a condition of doing business.

Practical Baseline Cybersecurity Measures

Regardless of your formal compliance obligations, implementing strong baseline cybersecurity practices protects your business and satisfies most client contractual requirements. Start with: strong unique passwords plus a password manager; two-factor authentication on all business accounts; encrypted storage for client data; regular software updates; and a documented backup process with offsite copies.

Document your security measures formally. When clients ask about your cybersecurity posture — and increasingly they will — you need a written information security policy you can share, not a verbal reassurance. Your business documentation should live alongside your financial records in a structured, accessible format.

Incident Response Planning

Under NIS2, covered entities must report significant incidents to national authorities within 24 hours of awareness. Even if you're not formally covered, having a documented incident response plan is good practice and may be contractually required by clients. A basic plan covers: how you detect incidents, how you contain them, how you assess the impact, how you notify affected parties, and how you document and learn from the event.

Staying Current with EU Cybersecurity Requirements

Cybersecurity regulation in the EU is evolving rapidly. Subscribe to ENISA's newsletter, follow your national cybersecurity agency's communications, and review your compliance posture annually. Track your security-related expenses and investments through financial tracking tools to demonstrate ongoing investment in compliance.