NIS2 — the EU cybersecurity directive — formally applies to medium and large entities in critical sectors. In practice, it reaches a small company in a different way: as a fourteen-page questionnaire, emailed by a major customer, with a six-week deadline.
Since early 2025 we have been seeing this scenario almost every month. A 20–40-person company, supplier or subcontractor to a large corporation, receives an attachment called something like "Supplier cybersecurity assessment". Dozens of questions, much of it about things nobody in the company has ever called a "policy". First reaction: panic. Second: looking for a consultant. Third, if the consultant is honest: a calm list of five to eight moves, most of which cost working hours rather than tens of thousands of zlotys.
This piece is about not getting sold an enterprise-grade solution when what you really need is solid basics.
Who NIS2 applies to directly
The NIS2 directive (transposed into Polish law in 2024 as an amendment to the National Cybersecurity System Act) generally covers "medium and larger" entities — broadly: over 50 employees and EUR 10M revenue — operating in sectors such as energy, transport, healthcare, banking, digital infrastructure, public administration, water and wastewater, manufacture of chemicals and food, and ICT service providers.
If you run a 25-person manufacturer, an accounting office, a building materials wholesaler or a marketing agency — you most likely do not fall under NIS2 directly. That is the good news.
The bad news is that NIS2 introduces a supply-chain risk management obligation. Every large entity that is in scope has to assess its suppliers. Including you. That is where the real conversation begins.
How NIS2 reaches a small company
A recent typical case. A 30-person logistics firm, providing transport services to a retail chain, receives an email. The attachment is a 14-page questionnaire. Concrete questions — is there a documented information security policy, is there an incident reporting procedure with a 24-hour response time, is the network segmented, are backups validated by an actual restore, is there a register of suppliers with data access, do employees go through phishing training.
Deadline: 6 weeks. Consequence of not filling it in: risk of the contract not being renewed in January.
The starting state was typical. Antivirus — yes, the same one for four years. Backup — on a NAS in the server room, once a night. Incident procedure — none. Network segmentation — none, one flat network for everyone. Supplier register — a two-year-old Excel. Security awareness training — nobody remembers.
After three months of work they answered the questionnaire honestly. Out of 13 required areas, 8 were genuinely closed: MFA was switched on for email and admin accounts, basic segmentation was introduced (a separate VLAN for accounting and another for the fleet team), a one-page incident procedure was written down, the first backup restore test was run (which revealed that a full restore takes 9 hours, not 2 as people had assumed), a password manager was rolled out, and a one-hour phishing awareness session was run for the whole team. The remaining 5 areas — full policy, supplier register, phishing simulations, DLP and formal clauses in subcontractor agreements — went onto a 9-month roadmap.
The customer kept the contract. Importantly — not because the supplier had everything. The customer did not expect a supply-chain SME to have bank-level maturity. They expected the supplier to know where they were, where they wanted to be, and how they would get there. Those are two different questions, and only one of them is realistic for a small company.
What the questionnaires usually ask about
Regardless of the customer's industry and their specific policy, the questions cluster around eight areas. Worth knowing — these are also the same things a cyber insurance underwriter will want to see if you ever buy a policy.
- Information security policy — documented, signed by management, reviewed annually.
- Asset inventory — computers, servers, SaaS apps, suppliers with data access.
- Identity and access management — MFA on email and critical systems, clear onboarding and offboarding rules.
- Backup and continuity — a 3-2-1 strategy, restore tests, documented RTO and RPO.
- Incident response — who, what, in what time, whom we notify.
- Network security — segmentation, firewall, egress control.
- Awareness — training, phishing simulations.
- Supplier management — register, risk assessment, contractual clauses.
None of these areas can be solved purely by buying a licence. They are processes, not products.
Where to start — five moves on a small budget
If the questionnaire just landed on your desk, here are five things that mostly cost time and show the customer good faith:
- Write down what you have. An IT inventory — hardware, software, suppliers with access — in one Excel. Two to four hours of work. Without it no policy makes sense, because nobody knows what it is about.
- Switch on MFA wherever it is still missing. Email, admin panels, RDP, VPN. Microsoft 365 and Google Workspace include it. Half a day of work for IT plus a short note to staff.
- Write a one-page incident procedure. Who calls whom, when we pull cables, whom we notify in the first 24 and 72 hours. One A4 page beats an 80-page ISO-style document that nobody will read at three in the morning.
- Run a restore test from backup. Not when the server crashes — now, on a Friday at 2 PM, with a note on how long it took and what actually came back.
- Appoint one person responsible for security. Not a full-time role — a function. Could be the IT manager, the owner or an external advisor, but there must be a name and a quarterly review on the calendar.
These five moves typically cover 60–70% of the questions in a typical supplier questionnaire. The remaining 30% is a roadmap you can show the customer honestly.
What not to do
In response to NIS2, several vendors will start knocking with off-the-shelf offers. "Comprehensive NIS2 compliance in one package" — typically priced at PLN 30,000–80,000 a year and built around an enterprise GRC platform that no one in a 25-person company has the capacity to operate. It is not bad software. It is bad software for that scale.
For a supply-chain SME, real compliance is solid basics: a documented policy, MFA, segmentation, tested backups, an incident procedure, training. Three to five consultant days, a dozen-or-so hours of internal work, two to three calendar months. The cost is in the thousands, not tens of thousands.
The second thing not to do: do not lie in the questionnaire. A customer who screens suppliers under NIS2 increasingly asks for evidence — a copy of the policy, a training log, a screenshot of MFA configuration. "Yes, we have it" without a document to back it up is worse than an honest "we don't have it yet, planned for Q3, here is the roadmap".
What next
For a 10–50-person company, NIS2 is not a regulatory burden imposed by Brussels. It is the conversation your customers were already having with you — only now it has an official name and a shared vocabulary. Do the basics properly, and the same work will answer most supplier questionnaires, whether the customer cites NIS2, ISO 27001, DORA or their own policy.
If a questionnaire just landed and you are not sure where to start — half an hour of talking is often enough to see where you actually have gaps and where you only have unnamed ones.
The customer does not expect a small supplier to have everything. They expect the supplier to know where they are, where they want to be, and how they will get there.