When NIS2 applies directly
- You work in one of the sectors listed in the directive's annexes, for example energy, transport, health, digital services, food, manufacturing or waste. National laws can differ slightly; Bulgaria's Act lists 17 sectors and covers public administration separately.
- And you are at least a medium-sized enterprise: 50 or more staff, or annual turnover and balance sheet above €10 million.
- Size is calculated together with linked and partner enterprises. A subsidiary cannot settle the question by counting only its own staff.
When size does not matter
Some providers are covered at any size, for example trust service providers, top-level domain name registries, DNS (Domain Name System) service providers and some providers of public electronic communications. An organisation that is the sole provider of an essential service is also covered.
How NIS2 reaches small companies indirectly
Organisations in scope must manage the risk from their suppliers (in Bulgaria, Art. 22(2)(4) of the Act). So banks, hospitals, public bodies and large companies send their suppliers:
- security questionnaires;
- contract clauses on security and incident notification;
- requests for evidence: multi-factor authentication, backups and staff training.
What a small company should do
- Take the two-minute self-check to see whether NIS2 (EU cybersecurity directive) applies to you directly.
- Get the basics in order: multi-factor authentication for email and remote access, backups with a tested restore, a supplier list and an incident contact.
- When a questionnaire arrives, answer only with what you can prove. If something is missing, give a date for it.
If a customer wants a questionnaire or evidence, we can help with the answers and show what is missing.