What is NIS2?
NIS2 sets cybersecurity and incident reporting obligations for medium and large organizations in critical sectors, including energy, transport, health, banking, digital infrastructure, food, chemicals and manufacturing. Member states had to transpose it by October 2024. One of its requirements is supply chain security, so companies in scope increasingly ask their software vendors for evidence of good security practice.
Who needs it
- Startups selling to companies in NIS2 sectors
- Digital service providers that may be in scope themselves
What usually triggers it
- A customer in a critical sector sends you a supplier security assessment
- You need to know whether your own company is in scope
How the process works
- Check whether you are in scope, or whether your customers are
- Assess your security measures against NIS2 requirements
- Set up incident reporting and supplier management
- Use ISO 27001 as a structured way to meet many of the measures
How Holam helps
We work out whether NIS2 is what your customers actually need, and in what order alongside other frameworks. We then introduce you to a compliance platform and specialists that fit your stage, and stay involved until the result is in your hands. Holam receives a referral fee from providers we introduce when you engage them. You pay the provider directly, we add nothing to their price, and you remain free to choose another provider.
Frequently asked questions
We are a small startup. Does NIS2 apply to us?
Usually not directly, as it targets medium and large entities in specific sectors. But your customers may pass requirements on to you through contracts.