NIS2 for medium-sized companies, without a big compliance team
NIS2 reaches far more companies than its predecessor: any company with 50 or more staff in one of the listed sectors may be in scope. Many have no compliance department, and need a clear plan more than a heavy tool.
In short: Medium-sized companies (50 to 249 staff, or turnover and balance sheet both above €10 million) in an NIS2 sector are usually important entities. In Belgium they can start free with Secrato’s NIS2 Starter, built on CyFun® BASIC, and grow into CyFun® IMPORTANT, ISO/IEC 27001 or more frameworks on a paid plan. Small companies are usually out of scope, but their customers may still ask for proof.
Most medium-sized companies in listed sectors are in scope
Important entities must take the NIS2 risk-management measures, report significant incidents and train their management body; supervision happens after the fact, when there is a reason. Check first whether you are in scope and as what. Use the NIS2 scope checker →
A clear path for a small team
The NIS2 Starter on CyFun® BASIC
The free NIS2 Starter covers CyFun® BASIC (34 controls, maturity target 2.5) and NIS2 notifications to the CCB, for one user and one workspace. It is in early access: request a place via the plans page.
Know what to do next
Every control shows its status, owner and evidence, and the dashboard shows what is missing, so a small team always knows the next step without hiring consultants for every question.
From one framework to several
When customers ask for ISO/IEC 27001 or you need CyFun® IMPORTANT, move to a paid plan and keep everything you have built: controls and evidence are reused across frameworks.
BUILT FROM BELGIUM
What applies to SMEs in Belgium and the Netherlands
Belgian SMEs register with the CCB via Safeonweb@Work; the CCB’s CyFun® risk assessment tool points you to the right level. Dutch SMEs in scope register with the NCSC via MijnNCSC under the Cyberbeveiligingswet. Small suppliers outside scope often receive security questionnaires from customers that are in scope.
Secrato is built in Belgium and hosted in a Tier IV data centre in Antwerp. Start with the free NIS2 readiness checklist. Growing beyond one framework? See GRC for mid-market companies.
Common questions
Does NIS2 apply to small and medium-sized companies?
NIS2 applies to medium-sized and large entities in the listed sectors. Medium-sized means 50 or more staff, or annual turnover and balance sheet both above €10 million. Small and micro companies are out of scope unless a size-independent rule applies or the authority designates them.
Are SMEs essential or important entities?
Medium-sized companies are generally important entities, unless they are designated as essential or fall under a size-independent rule, such as qualified trust service providers or DNS service providers.
What does the free NIS2 Starter include?
CyFun® BASIC (34 controls, maturity target 2.5), NIS2 notifications to the CCB, one user and one workspace. It is in early access. See compare plans.
We are small, but our customers ask about NIS2. What should we do?
Customers in scope must manage supply-chain risk, so they ask their suppliers for proof. A recognised baseline such as CyFun® BASIC, kept current with evidence, is a practical and credible answer.
Start your NIS2 programme with Secrato
Request your place in the free NIS2 Starter, or book a short demo to see the path for your company.
