Simple and practical cybersecurity guides for small and medium-sized businesses that want to reduce cyber risk without building a large internal security team. We cover MFA, backups, phishing, password policies, Microsoft 365 security, employee training, basic risk assessment and minimum incident response planning.
NIS2 for Polish SMEs: A Simple Explanation and 5 Quick Wins to Implement Now
NIS2 and the amended Polish national cybersecurity rules are not only a topic for large corporations. Many SMEs may be affected directly or indirectly through customer, insurer, bank, investor and larger contractor requirements. A company should first check whether it operates in a covered sector, meets size criteria and must register in the national cybersecurity register. Then it should implement 5 quick wins: MFA, backup with restore testing, patching and EDR, phishing training and a simple incident procedure. The key conclusion: NIS2 does not require perfection from day one, but it does require real risk management, evidence and board decisions.
Prepared by: CCyber Editorial Team
NIS2 and Polish national cybersecurity rules mean that many companies must approach cybersecurity more systematically. This is not only about buying antivirus software or writing a policy. A company should know whether it is in scope, which services and systems are critical, who owns risk, how backup works, whether accounts have MFA, how to report an incident and which evidence it can show to a customer, auditor, insurer or regulator. For SMEs, the most reasonable approach is to start with simple, effective actions: MFA, backup and restore testing, patching and EDR, phishing training, incident procedure and supplier assessment. NIS2 should not be a paperwork project. It should increase resilience against real attacks.
July 2026
NIS2 is the EU directive on cybersecurity of network and information systems. Its goal is simple: raise cyber resilience in sectors important for the state, economy and citizens. The directive does not tell every company to buy a specific product. It requires covered organizations to manage risk, implement appropriate security measures, report serious incidents and involve management.
For Polish companies, the most important element is the amendment to national cybersecurity rules implementing NIS2. These rules define practical obligations, deadlines, the national register, incident reporting through S46, ISMS, audits and supervision.
Polish national cybersecurity rules expand the catalogue of entities covered by obligations. Previously, many organizations were not formally part of the national cybersecurity system. Now more companies must independently check whether they fall into scope.
It depends. NIS2 and national rules do not automatically cover every small company. Sector, company size, service type, role in the supply chain and exceptions must be checked. Some entities may be covered regardless of size, while others may feel the regulation indirectly through customer requirements.
Many SMEs say: “NIS2 does not apply to us because we are too small”. This may be true formally, but not always commercially. A large customer covered by NIS2 may require suppliers to have certain safeguards. A bank, insurer, investor, auditor or contractor may ask about MFA, backup, EDR, incident procedure, training and supplier assessment.
The company should not build separate programmes for every regulation. In practice, many requirements repeat: risk, access, backup, incidents, suppliers, training, evidence and reporting. A good approach is to create one cyber resilience programme that supports multiple obligations.
Different regulations may have different definitions, deadlines and thresholds, but the operational foundation is similar. For SMEs, this is good news: practical safeguards can help in many areas at once.
MFA, or multi-factor authentication, is one of the simplest and most effective actions. Start with email, administrators, VPN, cloud, backup, finance systems and supplier accounts.
The Medibank case is a useful example. The Australian regulator alleged that lack of MFA on VPN access allowed the attacker to use stolen credentials and access the network. The incident led to data of millions of people being published on the dark web. This shows that MFA is not an “extra”. It is a control that often separates stolen credentials from real environment compromise.
The lesson for SMEs is simple: even if the company does not have a mature SOC, it can quickly reduce account takeover risk by enabling MFA. Phishing-resistant methods are best for critical accounts, such as security keys, passkeys or apps with number matching. SMS is better than no MFA, but should not be the target standard for critical accounts.
Backup without restore testing is a declaration, not resilience. The company should know what is backed up, where copies are stored, who has access, whether backup is ransomware-resistant and how long it takes to restore a critical system.
Many attacks start with a known vulnerability or infected computer. An SME should have a basic patching process, endpoint protection and a review of internet-facing systems.
Phishing, BEC and AI scams are everyday risks for SMEs. Training should be short, practical and repeated. The most important point is that employees know how to report suspicious messages without fear of punishment.
During an incident, there is no time to decide who makes decisions, who calls the provider, who reports the incident and who informs customers. An SME should have a simple procedure that can be activated in the first hour.
NIS2 and national rules strengthen management accountability. The board does not need to know every technical detail, but it must understand risk, approve priorities, ensure budget and require reporting. Cybersecurity is no longer only the IT administrator’s task.
An SME does not need to start with a huge document system. It is better to prepare a small practical pack answering the most common questions from customers, insurers and auditors.
Evidence is more important than declarations. A customer, auditor or insurer does not only want to hear that the company has security. They want to see that the process works.
Various market reports mention averages for the share of cybersecurity in IT budgets. Treat these carefully. For one company, 15% of IT budget may be too little, for another too much. A good budget does not come from one average. It comes from risk, sector, number of systems, customer requirements, incident history, insurance and downtime cost.
Formally, many small companies may not be directly in scope, but requirements can come from customers, insurers and partners.
A tool without owner, configuration, monitoring and procedure does not create resilience.
The company has copies, but does not know whether and how quickly it can restore a critical system.
First protect administrator accounts, email, VPN, backup and suppliers. These are common entry points.
The provider has system access, but the company does not know whether MFA, named accounts, action logging and incident reporting procedure are in place.
A document is not enough. Run a tabletop and check whether the company knows what to do in the first hour.
The board must see risks, decisions, budget and action progress. Without this, cyber remains an IT problem.
A services company has 85 employees and provides software to large customers in manufacturing and logistics. It is unsure whether it falls directly under national cybersecurity rules, but receives security questionnaires from customers. Questions cover MFA, backup, restore testing, EDR, suppliers, incident procedure and training.
The first review shows that MFA works only for some employees, backup has not been tested for a year, the IT provider has remote access without regular access review and the incident procedure is outdated. The company does not immediately need a full SOC or advanced GRC. It needs a 90-day plan.
After three months, the company has MFA for critical accounts, restore test, risk register, incident response plan, phishing training, IT supplier assessment and board report. It can answer customers with concrete evidence, not a declaration that “security is important”.
This topic can be connected with further reading and CCyber services to move from understanding NIS2 to practical implementation of security basics.
ccyber.io helps SMEs translate NIS2 and national cybersecurity rules into a practical action plan that can be implemented without chaos and random purchases. We start with risk, critical systems and evidence, then select tools and providers.
We can support your organization with:
The best first step is a NIS2 Quick Wins Workshop for SMEs. In a short workshop, the company can check whether it is in scope, which quick wins to implement immediately, which evidence to prepare and how to plan the budget for the next 12 months.
No. Sector, size, service type and exceptions must be checked. Even if the company is not directly in scope, it may receive requirements from larger customers.
No. Antivirus or EDR is only one element. The company needs MFA, backup, restore testing, incident procedure, training, supplier assessment and evidence.
Enable MFA on critical accounts, check backup, perform restore test, update systems, launch phishing training and prepare a simple incident procedure.
Yes. Microsoft research shows MFA is highly effective in reducing account compromise. Phishing-resistant MFA is best for critical accounts.
Backup is necessary, but not enough. It must be deletion-resistant, protected by MFA, tested and connected with a recovery procedure.
Not always. It requires detection, response and risk management proportionate to the organization. An SME may start with baseline monitoring, EDR, MDR or provider support.
MFA report, restore test, EDR report, risk register, incident procedure, training report, supplier assessment and remediation action list.
Start by checking sector, company size, services, customer relationships and exceptions. Then prepare a board decision and action plan.
NIS2 and national cybersecurity rules change how Polish companies should think about cybersecurity. It is not only about new legal requirements, but about real resilience against attacks that can stop operations, compromise data, disrupt deliveries or block customer communication.
For SMEs, the best approach is practical: MFA, backup, restore test, EDR, updates, training, incident procedure, supplier assessment and evidence. These actions help with NIS2, national cybersecurity rules, cyber insurance, customer audits and everyday security.
The best rule is: do not start by asking how to satisfy NIS2 on paper. Start by asking what would stop your company during an attack and which five actions you can implement now to reduce the impact.
FBiO Funding for Local Government Cybersecurity: What Can Be Funded and How to Prepare the Project?
The Security and Defence Fund can be an important financing source for local governments to strengthen digital resilience, cybersecurity, critical infrastructure protection and continuity of public services. However, it is not a standard grant for any IT purchase. In practice, it is preferential financing for investments that strengthen the security and resilience of the state and local services. A local government should prepare the project around real risks: water supply, wastewater, transport, crisis communication, e-services, backup, monitoring, MFA, SOC, digital hygiene, data protection, incident procedures and compliance with national cybersecurity rules and NIS2. The biggest mistake is treating FBiO as fast money for equipment. The best projects connect cybersecurity with civil protection, business continuity and measurable resilience improvement.
Prepared by: CCyber Editorial Team
The Security and Defence Fund can help local governments finance cybersecurity projects, but the best projects should not start with a shopping list. They should start with the question: which public services must continue to operate during a crisis, failure, cyberattack or sabotage? FBiO can support investments that strengthen security and resilience, including cybersecurity, threat detection and warning systems, critical infrastructure, ICT services, continuity of operations and dual-use solutions. For local government units and municipal companies, this is an opportunity to finance projects that were previously postponed: backup, recovery, MFA, monitoring, SOC, EDR, crisis communication systems, OT protection, cybersecurity of water, wastewater, transport and e-services. However, this is an investment project with conditions, documentation, eligible costs, deadlines and the need to sustain outcomes.
July 2026
The Security and Defence Fund is financed from Poland’s National Recovery and Resilience Plan. Its purpose is to support investments strengthening state security and resilience, civil protection, dual-use infrastructure, cybersecurity, continuity of critical services and the potential of enterprises, including the defence sector.
In practice, FBiO has two main pillars: a loan part operated by BGK and an equity part implemented by Chrobry S.A. The loan part is especially important for local governments, municipal companies, the rail sector and enterprises planning investments in security and resilience.
In discussions about FBiO, terms such as “money”, “support” or “financing” often appear. For local governments, however, it is important to understand the mechanism precisely. In the loan part, this is a preferential loan, not a classic non-refundable grant for any purchase.
This still requires careful financial planning. Even with zero interest and possible cancellation, a local government must understand the project’s impact on the budget, repayment capacity, investment maintenance and operating costs after completion.
In the municipal loan part, financing may cover several investment categories. Cybersecurity is one of them, but it can also connect with other categories, such as detection and warning systems, civil protection infrastructure, crisis communication and critical service resilience.
A local government should not treat cyber as a separate add-on to infrastructure. In practice, cybersecurity can strengthen almost every resilience project: shelters need communication, water utilities need control systems, transport needs ICT systems, a crisis management centre needs secure communication, and the office needs backup, MFA and response procedures.
Exact eligibility depends on the call rules and BGK documentation, so every idea must be formally checked. The list below shows which types of projects may fit the FBiO logic if they are connected with security, resilience and continuity of services.
The best FBiO-funded project should support obligations under national cybersecurity rules and NIS2. This helps a local government avoid a situation where infrastructure is financed, but there is still no compliance evidence, procedures, risk owners or incident readiness.
Every FBiO project with a cyber component should be mapped to a risk, critical service and organizational obligation. If the project buys a tool, it must show which process the tool supports, who owns it, which evidence will be produced and how resilience improvement will be measured.
Do not start with hardware. Start with the list of services that must operate during crisis: water, wastewater, heating, transport, resident communication, crisis management, e-services, document workflow, finance system and resident data.
The project should come from risk. Example: ransomware may stop the office and municipal utility, missing backup prevents recovery, supplier account takeover gives attackers access to systems, and missing monitoring delays incident detection.
The outcome should be measurable. Not “security improvement”, but for example: 100% of administrator accounts with MFA, 95% of endpoints with EDR, restore test for a critical system every six months, incident escalation under 30 minutes or 24/7 monitoring for five critical systems.
A cyber project should show how the solution will operate: which systems are covered, which data is processed, which integrations are needed, who will administer it, what supplier access looks like and how logs will be secured.
A loan can finance investment, but the local government must maintain the outcomes. Licences, monitoring, MSSP services, updates, tests, training and maintenance need a funding source after project completion.
Costs must comply with the call and eligibility rules. The list below is a practical starting point for budgeting a cyber project, but every item must be verified against BGK documentation.
A server, storage, firewall or licence will not increase resilience if there is no owner, procedure, configuration, testing and maintenance.
SIEM, EDR or backup generate value only when someone analyzes alerts, performs tests, updates rules and responds to incidents.
A security system must be connected to real data sources: email, identity, endpoints, servers, cloud, firewalls, domain systems and OT.
If there is no budget for licences, service, monitoring and training after project completion, the outcome will quickly disappear.
The application should be complete, signed with a qualified electronic signature and compliant with the call requirements. It is important to prepare attachments, cost descriptions, formal documents and investment justification in advance.
A good project shows how the investment will reduce the risk of service interruption for residents, businesses or dependent units.
The outcome should be countable: systems covered by monitoring, accounts with MFA, recovery time, trained people, tests performed, vulnerabilities closed.
If the project supports incident response, business continuity, supplier assessment, asset management, backup, training or risk management, its strategic character is easier to justify.
The local government should know how much the solution will cost after the first year, who will operate it and whether an external service will be needed.
A project without an owner on the office or municipal company side quickly becomes a procurement issue instead of a resilience investment.
FBiO is not only for local governments. Enterprises can use the loan part and equity instruments if the project strengthens state security and resilience. In the loan part for enterprises, financing may cover cybersecurity projects, continuity of energy and fuel supply, physical security of critical infrastructure, ICT services, transport and dual-use production.
A local government may use different programmes at the same time, but it must avoid double financing of the same costs. FBiO cannot finance expenses already settled or submitted for settlement under the National Recovery Plan or other EU programmes, nor costs covered by other national support.
One project may be part of a broader resilience strategy, but each cost must have one funding source, clear justification and documentation. It is useful to prepare a financing map showing which actions are funded by FBiO, which by own budget, which by Digital Europe and which by other sources.
First describe the critical service, risk and expected outcome. Only then choose technology and suppliers.
An external contractor can implement the solution, but the office or municipal company must own decisions, acceptance and maintenance.
The project is financed, but there is no budget for licences, monitoring, service, training and testing in the following years.
The local government buys tools, but procedures, registers, evidence, reports and incident reporting mechanisms are not created.
The office strengthens its systems, but water utilities, municipal services or education units remain outside the project.
Backup, SOC, incident procedure and emergency communication must be tested. Without tests, the project is incomplete.
The project includes costs that are not well linked to the financing objective, are not described or may be excluded.
Evidence is hardest to recreate at the end of the project. Documentation should be created during delivery, at each milestone and acceptance.
A medium-sized municipality has an office, water utility, tax system, document workflow, public information bulletin, email, e-delivery and an external IT provider. After risk analysis, the biggest threat is ransomware and the inability to quickly recover office and water utility systems. In addition, some administrator accounts do not have MFA, and the IT provider uses remote access without full action logging.
The municipality prepares an FBiO project not as an “IT equipment purchase”, but as a digital resilience programme for critical services. The scope includes ransomware-resistant backup, MFA, EDR, segmentation, log monitoring, incident procedure, restore test, tabletop and supplier assessment. The project covers the office and water utility because the utility provides a critical service to residents.
After implementation, the municipality has not only new tools, but also evidence: MFA report, restore test report, risk register, supplier register, incident reporting procedure, business continuity plan and leadership report. This connects financing with national cybersecurity rules, NIS2 and real resilience for residents.
This topic can be connected with further reading and CCyber services to move from an FBiO idea to a well-prepared project, application and implementation.
ccyber.io helps local governments, municipal companies and suppliers prepare cybersecurity projects for FBiO and other national and EU financing programmes. We connect financing, cybersecurity, national cybersecurity rules, NIS2, IT projects, suppliers and delivery evidence.
We can support your organization with:
The best first step is an FBiO Cyber Project Workshop for local governments. In a short workshop, the organization can decide whether the idea fits the financing, which critical services it covers, which costs should be planned, which evidence will be produced and how to connect the project with national cybersecurity rules and NIS2.
Not in the classic sense. For the municipal sector, it is primarily a preferential loan that may have interest from 0%, a long repayment period and possible partial cancellation for eligible local government units.
Yes, cybersecurity projects are indicated as one of the categories eligible for financing. However, the project must show a link with security, resilience and eligible costs.
This may be justified if the project is linked to resilience of critical services, incident detection, national cybersecurity rules, NIS2 and business continuity. Eligibility of a specific cost model must be checked in the call rules.
A backup and recovery project can fit well into cyber resilience, especially if it concerns critical systems, ransomware protection and restore tests. However, the outcome and post-project maintenance must be described.
Yes, the BGK product for the municipal sector indicates local government units and municipal companies as recipients. Project structure, roles, ownership, costs and impact on public services must be described.
A broader financing strategy can be planned, but the same costs cannot be financed twice. A clear cost and funding source map should be maintained.
The key is connecting the project with a critical service, risk, measurable outcome, budget, cost eligibility and outcome maintenance plan.
Start with critical services, system register, backup, MFA, suppliers, risks and incident procedure. Only then build the financing project and select technology.
FBiO can become one of the most important instruments for financing local government resilience in the coming years. For local government units and municipal companies, it creates an opportunity for projects that connect civil protection, service continuity, cybersecurity, warning systems, critical infrastructure and digital resilience.
The key is the right approach. The project should not be a shopping list or an attempt to spend money on any IT. It should come from risk, concern services important to residents, have measurable outcomes, a maintenance plan, owners and delivery evidence.
The best rule is: do not first ask what can be bought. Ask which public service will stop after a cyberattack, how long recovery will take, who will make the decision and which financing will truly increase resident resilience.
How to Achieve Full Asset Inventory and Visibility for NIS2 Without Expensive Enterprise Tools?
A full asset inventory aligned with NIS2 does not have to mean an expensive enterprise platform. For SMEs, the key is to know which devices, accounts, applications, cloud services, data, suppliers, critical systems and internet-facing assets the company has. You can start with a spreadsheet, exports from Microsoft 365 or Google Workspace, data from routers, DHCP, DNS, EDR, antivirus, backup systems, invoices, contracts, accounting systems and simple network scans. The tool is not the main point. The process is: asset owner, criticality, data, access, backup, updates, supplier, security status and regular review.
Prepared by: CCyber Editorial Team
Full asset inventory and visibility aligned with NIS2 does not have to start with buying an expensive CMDB, EASM, CAASM or enterprise platform. For SMEs, the key is to build a reliable, regularly updated asset register and connect it with simple data sources: identity directory, email system, MDM or EDR, router, DHCP, DNS, firewall, backup, cloud, invoices, contracts and accounting system. The company should know which devices, applications, systems, accounts, data, cloud services, suppliers and internet-facing assets it has. Full visibility does not mean perfect automation on day one. It means the company can answer: what do we have, who owns it, how critical is it, what data is there, who has access, is there backup, are there updates and is the asset monitored?
July 2026
NIS2 does not say that every company must buy a specific inventory system. It does require cybersecurity risk management, and that cannot be done without asset visibility. If the company does not know which systems it has, who has access, where data is located and which services are critical, it cannot reliably assess risk, prepare continuity plans or demonstrate compliance.
Simply put, asset inventory is the foundation for risk, MFA, backup, vulnerabilities, incidents, suppliers, business continuity and audit.
No. In a small or medium-sized company, full inventory does not mean that every cable, device and application is automatically visible in one console from day one. It means the company has a process that continuously moves toward completeness and quickly detects gaps.
An auditor or customer rarely expects an SME to have a global enterprise-grade platform. They will expect a clear register, owners, dates, criticality, security status and evidence of recurring review.
Expensive tools can be very helpful, but they will not solve the problem if the company does not have a process. A tool without owners, classification, review and business decisions becomes another outdated database.
The key point is that the register is used for decisions. If the register shows that a system has no owner, backup or public exposure, a remediation action must be created.
The register does not need to be complicated. It must contain fields that support risk decisions.
This is a spreadsheet, simple database, ticketing system or lightweight IT asset management tool. The main register is where the company makes decisions. It does not need to discover everything automatically, but it must collect outputs from many sources.
These are systems where you collect data: Microsoft 365, Google Workspace, identity directory, MDM, EDR, antivirus, firewall, DHCP, DNS, backup, cloud, hosting, code repository and network scanner.
Automation does not know everything. The business owner must confirm whether the system is still used, whether it is critical, what data it contains and whether the supplier still has access.
Visibility should lead to action. Unknown device, missing MFA, missing backup, public port, unused application or former employee account should become a remediation item.
Microsoft Entra ID, Active Directory, Google Workspace or another identity directory shows users, groups, administrator accounts, devices, applications and logins.
The admin panel shows licenses, users, groups, devices, services, applications and some security settings.
Even a simple router, DHCP server or DNS server provides useful information about devices seen on the network.
The firewall shows public services, remote access, NAT rules, VPN and internet traffic. This is very important for attack surface visibility.
If the company has endpoint protection, the console usually shows laptops, servers, operating system versions, agent health and missing updates.
The backup system shows which systems are covered, which are not, which jobs failed and when restore was tested.
AWS, Azure, Google Cloud, hosting, VPS and PaaS platforms show assets that may be invisible in the local network.
Some of the most important assets are hidden in costs. An invoice for a SaaS tool may reveal a service that IT did not know about.
A periodic internal network scan can show devices, open services and unexpected systems. It must be done carefully, especially in OT environments.
Not everything can be found technically. Marketing, sales, finance, HR and production may use tools that central IT cannot see.
Shadow IT means tools, accounts, applications, devices and services used outside formal organizational control. In SMEs, it often appears without bad intent. Someone buys a marketing tool, creates a test account, uses a private drive or orders a small application from a supplier.
Not every asset needs the same attention. Criticality helps prioritize safeguards and remediation actions.
An asset whose outage stops sales, production, payments, customer service, security, data access or recovery.
An asset important for many users, customer data, finance, operations or suppliers, but with a short-term workaround available.
An asset that supports a department or process, but does not stop the whole company and can be worked around manually for some time.
A supporting, test or low-importance asset without sensitive data and without impact on critical services.
Without an owner, the register will die after the first export. The process owner does not need to know every system personally, but owns completeness, review cycle and reporting.
Define whether the inventory covers the whole company, one entity, one branch, one system, production environment or customer audit scope.
A spreadsheet is enough to start, but it should have version control, an owner and clear mandatory fields. Later it can move to a lightweight ITSM or asset management tool.
Start with identity directory, Microsoft 365 or Google Workspace admin panel, EDR, backup, DHCP, firewalls and invoices. Do not wait for perfect data.
The same laptop may appear in EDR, DHCP, identity directory and invoice data. Define a matching rule, for example by serial number, device name, user and MAC address.
Every critical asset must have a business owner and technical owner. “IT” as owner of everything is weak evidence.
The process owner should define whether the asset supports a critical service and what data it processes.
For every critical asset, check MFA, backup, EDR, updates, logs, suppliers and public exposure.
Missing owner, missing backup, missing MFA, missing EDR, missing restore test or public port should have a status and remediation action.
The register must be updated periodically and after changes. A good minimum for SMEs is quarterly review of critical assets and annual full review.
The company creates a spreadsheet before an audit, then nobody updates it. After three months, the register no longer reflects reality.
Modern SMEs often have more risk in SaaS services than in laptops. The register must include cloud tools and business applications.
IT knows that the system exists, but not how important it is for the process or what data it contains.
The company knows laptops, but not which domains, subdomains, ports and admin panels are reachable from the internet.
An IT, backup, hosting or SaaS provider may have more impact on continuity than an internal laptop.
The system name alone is not enough. The register should show MFA, backup, EDR, logs, updates and restore tests.
Old systems, unused accounts, abandoned subdomains and forgotten test environments are often the easiest targets.
A tool helps, but it does not replace decisions: who owns it, what is critical, what must be fixed and who closes gaps.
The board does not need the list of every laptop. It needs to see risk, gaps and decisions.
A services company has 85 employees. It uses Microsoft 365, CRM, invoicing system, file repository, marketing tools, an external IT provider and several SaaS applications bought by business departments. The board asks whether the company is ready for NIS2 requirements, but IT does not have a complete asset list.
The company starts without an expensive enterprise tool. It creates an asset register spreadsheet, exports users and devices from Microsoft 365 and EDR, collects SaaS invoices, checks backup, lists domains, public IPs and suppliers. After one month, it discovers 14 SaaS tools outside IT awareness, 6 administrator accounts without formal owner, 3 critical systems without confirmed restore test and 2 old subdomains pointing to unused services.
After 90 days, the company has an asset register, owners, criticality, MFA status, backup status and supplier status. It is not yet an enterprise platform, but the company can show the board and auditor what it has, what is critical, where gaps exist and what actions are in progress.
ccyber.io helps SMEs build asset inventory and visibility aligned with NIS2 without overloading the company with unnecessary enterprise tools. We start with process, data sources and a practical register, and only then choose automation.
We can support your organization with:
The best first step is an Asset Visibility for NIS2 Workshop. In a short workshop, the company can determine which assets it already sees, which are hidden, which data sources can be used without new costs and what register is sufficient for the first stage.
No. NIS2 requires risk management and asset management as part of security measures, but it does not prescribe a specific tool. For SMEs, a working process and evidence matter more.
At the start, yes, if it has an owner, versioning, mandatory fields, recurring review and is compared with technical data. Long term, it can be replaced with a lightweight ITSM or asset management tool.
Critical assets should be reviewed at least quarterly and after every material change. Full inventory review can be done annually or more often if the company changes quickly.
Both matter. In many SMEs, the greatest risk is now in SaaS, administrator accounts, cloud services, public assets and suppliers, not only in laptops.
Check invoices, card payments, OAuth apps, SSO logins, DNS, department surveys, project repositories and supplier lists. These often reveal Shadow IT.
It is useful, but should be done carefully. Network scans help detect devices and services, but in production and OT environments they should be planned with responsible teams.
Systems supporting critical services, identity, email, backup, finance systems, production systems, customer data, critical suppliers and internet-facing assets.
Start with critical systems, users, administrators, devices, SaaS, backup, public IP addresses, domains and suppliers. Then assign owners and security status.
Full asset inventory and visibility aligned with NIS2 does not have to begin with expensive enterprise tools. For SMEs, the key is to build a real, current and used asset register that connects devices, applications, data, accounts, cloud, suppliers, backup, public exposure and business criticality.
The greatest value comes from a simple process: collect data from existing sources, assign owners, mark criticality, check baseline safeguards, compare the register with reality and regularly report gaps to the board.
The best rule is: do not start by asking which tool to buy. Ask whether the company can say today what it has, what is critical, where the data is, who has access, what is exposed to the internet and what it still cannot see.
How to Get Cheaper Cyber Insurance? Implement These Controls Now
Cheaper cyber insurance does not come from simply declaring that the company “cares about security”. Insurers look at real controls, incident history, industry, revenue, data, suppliers and the company’s ability to recover after an attack. The biggest impact on insurability and policy terms usually comes from MFA, tested backup, EDR, updates, administrator account control, secure remote access, email protection, training, payment procedures, incident response plan, BCP, supplier control and an evidence pack. There is no guaranteed premium reduction, but well-documented safeguards can help obtain better terms, higher limits, fewer exclusions or smoother renewal.
Prepared by: CCyber Editorial Team
To increase the chance of cheaper cyber insurance, a company should improve what insurers see as the biggest risk sources: no MFA, untested backup, weak endpoint protection, outdated systems, excessive administrator rights, uncontrolled remote access, weak email protection, no training, no payment procedure, no incident response plan and no evidence. A lower premium cannot be guaranteed because pricing depends on industry, revenue, claims history, coverage scope, limits and the insurance market. However, a company can improve its insurability and position in discussions with a broker and insurer. The key point is not to declare safeguards by word alone. Every questionnaire answer should have scope, owner and evidence.
July 2026
Yes, but the word “cheaper” must be understood correctly. The insurer does not sell a discount for a tool name. The insurer assesses risk. If the company can show that it reduced incident likelihood and can limit impact, it may have a better position when discussing premium, limits, exclusions and renewal.
Better preparation may help with:
Important: cyber insurance is not a reward for having tools. It is a mechanism for transferring part of the risk. The company still needs to manage risk, maintain safeguards and update information provided to the broker and insurer.
The insurer wants to answer a simple question: how likely is this company to have an expensive incident and how large could that cost be?
You cannot change all factors. You cannot easily change the industry or incident history. But you can improve safeguards, prepare evidence, organize processes and show that the company has real control over cyber risk.
If a broker or insurer asks whether the company has MFA, backup, EDR and training, “yes” is too weak. The company must show exactly where the control works, who is covered, which exceptions exist and when it was last checked.
Weak: “We have backup”.
Strong: “Backup covers Microsoft 365, file server, finance system and CRM. Copies are separated from production. The latest restore test was performed on 12 June 2026. The test result and remediation actions are in the report.”
MFA is one of the most important controls from the insurer perspective. It protects against account takeover after password theft, phishing or credential leaks.
Evidence for the insurer: MFA report, list of covered accounts, exception list and risk acceptance decisions.
Backup without testing is a promise, not evidence. The insurer wants to know whether the company can recover after ransomware, failure, human error or data loss.
Evidence for the insurer: backup report, restore test report, RTO, RPO and remediation list.
The insurer will ask whether laptops, servers and workstations are protected. Antivirus alone may not be enough if nobody monitors alerts or if protection does not cover all devices.
Evidence for the insurer: EDR or antivirus coverage report, exception list, alert report and response procedure.
Unpatched systems, VPNs, firewalls, servers and internet-facing applications are common entry points. The insurer may ask how quickly the company patches critical vulnerabilities.
Evidence for the insurer: vulnerability report, patch management report and overdue vulnerability list.
Administrator accounts are a shortcut to the whole company for an attacker. Insurers pay close attention to MFA, number of administrators, named accounts and access reviews.
Evidence for the insurer: administrator account report, PIM or PAM report, access review and list of removed permissions.
Remote access is convenient, but it is also one of the most important risk points. Public RDP, old VPNs, supplier accounts without MFA and permanent service access are especially dangerous.
Evidence for the insurer: remote access model description, MFA report, supplier access list and session logs.
Email is often where fraud, account takeover and fake payment attempts begin. The insurer may ask about MFA, filtering, SPF, DKIM, DMARC and training.
Evidence for the insurer: email configuration report, SPF/DKIM/DMARC status, training report and phishing report register.
Training should not be one annual presentation. From the insurer perspective, it matters more whether the company teaches employees to recognize phishing, report mistakes, use MFA and verify payments.
Evidence for the insurer: training plan, participant list, materials, test results and reporting metrics.
Business email compromise and fake payments may not be covered by a standard policy or may have sublimits. Regardless of coverage, the company should reduce fake payment risk.
Evidence for the insurer: payment procedure, second-channel confirmation register and finance training report.
The policy may provide access to experts, but the company still needs to know what to do in the first hour of an incident. The response plan should be short, current and exercised.
Evidence for the insurer: incident response plan, contact list, tabletop report and remediation action list.
Cyber insurance may cover downtime costs, but the insurer will want to know whether the company can limit downtime and operate in emergency mode.
Evidence for the insurer: BCP, DRP, restore test report, downtime cost analysis and board decisions.
If the company does not know which systems and data it has, it cannot answer insurer questions well. Inventory is the foundation for risk and coverage scope.
Evidence for the insurer: asset register, critical system map and data classification.
An incident at an IT, cloud, hosting, backup or finance system provider can stop the company. The insurer may ask whether the company manages third-party risk.
Evidence for the insurer: supplier register, risk assessments, security clauses and list of suppliers with access.
After an incident, the company must reconstruct what happened. Missing logs make response, investigation, notifications and claims handling harder.
Evidence for the insurer: log source report, SIEM or log management configuration, sample alerts and retention policy.
The best safeguards will not help much in a broker conversation if the company has no evidence. An evidence pack shortens discussions, reduces ambiguity and supports renewal.
Evidence for the insurer: organized evidence repository with dates, owners and freshness status.
Every insurer has its own assessment model, but in practice the strongest weight often goes to controls that reduce ransomware, account takeover and downtime.
“We have MFA” is risky if MFA does not cover administrators, VPN or suppliers.
Exceptions are normal, but they must be known, documented and accepted. A hidden exception may become a problem after an incident.
The company may have EDR, but nobody responds to alerts. It may have backup, but nobody tests it. It may have an incident plan, but nobody knows it.
The insurance questionnaire should be reviewed by IT, security, the board, finance, legal and process owners.
A cheaper policy with large exclusions may not protect against the scenario most realistic for the company.
The broker can compare offers, but if company risk is high, price competition has limited value.
Backup marked as “working” in a questionnaire without a restore test is weak evidence.
MFA on standard accounts is not enough if administrators, VPN, suppliers and the finance system are excluded.
The IT provider knows part of the technology, but usually does not know the full picture of data, finance, incident history, suppliers and board decisions.
Fake payments may be excluded or limited. A second-channel procedure is inexpensive and very important.
Training without participant lists, programme and test results is hard to show in an audit.
The company changes cloud, supplier, system or data scope, but does not update broker and insurer information.
The key question is not only “how much does the policy cost”, but what it actually covers and excludes.
A services company has 70 employees and wants to buy cyber insurance. The first offer is expensive, and the broker points to questionnaire issues: MFA works only in Microsoft 365, backup has not been tested for a year, there is no formal incident response plan, EDR does not cover all devices and no payment procedure exists.
The company does not immediately look for another cheaper offer. First, it closes key gaps over 60 days. It enables MFA for administrators and VPN, performs a restore test, completes EDR coverage, prepares an incident response plan, trains employees, implements second-channel verification for bank account changes and collects evidence.
After the questionnaire update, the broker has stronger material for discussions with insurers. The company is not guaranteed the lowest premium, but it gains a better negotiation position, less ambiguity and a greater chance of a policy that matches real risk scenarios.
ccyber.io helps SMEs prepare for cyber insurance in a practical, risk-based and evidence-driven way. We do not promise an automatic premium reduction because the decision belongs to the insurer. We help improve insurability, close key gaps and prepare an evidence pack for the broker.
We can support your organization with:
The best first step is a Cyber Insurance Cost Reduction Readiness Workshop. In a short workshop, the company can check which safeguards are already implemented, where evidence is missing, which gaps most affect broker discussions and what should be done before sending the questionnaire.
There is no guarantee, but MFA is one of the most important controls assessed by insurers. Missing MFA may make it harder to obtain good terms.
Not backup alone. Restore testing, separated copies, backup account protection and critical service recovery planning are important.
It depends on the insurer, industry and company size. In practice, endpoint protection, alert monitoring and incident response are very commonly assessed.
It may help as evidence of maturity, but the insurer may still ask about specific controls such as MFA, backup, EDR, incident response and suppliers.
Yes, through a broker the company can discuss coverage, limits, exclusions, sublimits and requirements. Better security evidence may make that discussion easier.
No. A cheaper policy may have lower limits, higher deductible, more exclusions or missing coverage for important scenarios such as BEC or supplier incidents.
Do not hide them. Describe the actual state, scope, remediation plan and deadlines. A “partially implemented” answer with evidence is better than an unsupported declaration.
Start with MFA, backup testing, endpoint protection, administrator review, secure remote access, incident response plan and evidence pack for the broker.
Cheaper cyber insurance does not start with price negotiation, but with reducing real risk. The insurer will look at whether the company has basic safeguards and whether it can prove them.
The most important solutions are MFA, tested backup, EDR, updates, administrator control, secure remote access, email protection, training, payment procedure, incident response, BCP, supplier control, logs and evidence repository.
The best rule is: do not try to buy a cheaper policy based on wishful answers. Implement basic controls, test them, collect evidence and only then discuss terms with your broker.
Does My Company Fall Under NIS2? A Simple Guide for SMEs
An SME should not answer the NIS2 applicability question only based on employee count or business activity code. Five things must be checked: sector, company size, size-independent exceptions, supply chain role and current national rules implementing NIS2. A small company often will not be directly an essential or important entity, but it may be indirectly affected by customer requirements if it provides IT, software, cloud, managed services, components, maintenance, data or processes to regulated entities.
Prepared by: CCyber Editorial Team
Not every small or medium-sized company in Poland is directly subject to NIS2. The fact that a company is an SME is not enough. The sector, type of services, company size, group relationships, size-independent exceptions and whether the company is a supplier to a regulated entity must be checked. As a rule, NIS2 mainly covers medium-sized and large entities in defined sectors. However, small and micro companies may be covered in exceptional cases or affected indirectly through customer requirements, contracts, security questionnaires and supplier audits. The safest approach is to prepare a short applicability assessment with date, sources, board decision and a minimum cybersecurity action plan.
July 2026
NIS2 is a European Union directive. This means that the practical answer in Poland must look at the directive, but also at national implementing rules, especially amendments to the national cybersecurity system. Therefore, the answer to “does my company fall under NIS2?” should include a date and the legal version used.
This guide helps prepare a practical assessment. It does not replace individual legal advice, but it shows how an SME board should organize the topic before speaking with a lawyer, auditor, customer or cybersecurity provider.
If the company is micro or small, does not operate in a special sector and does not provide critical services to larger entities, it will probably not be directly an essential or important entity. This does not mean it can ignore the topic.
If the company is medium-sized, operates in one of the NIS2 sectors or serves customers from those sectors, a formal applicability assessment should be performed.
If the company provides IT, cloud, managed, security, DNS, hosting, telecommunications, trust, domain registration services or maintains customer systems, NIS2 should be treated as a priority regardless of whether the company is ultimately directly covered.
Only answers to these questions allow a reasonable conclusion. A business activity code alone, employee count alone or the general label “IT” is not enough.
NIS2 covers sectors of high criticality and other critical sectors. For SMEs, the key point is to check whether the company’s real activity fits one of these sectors or whether the company serves customers from those sectors.
A small manufacturing company may think NIS2 does not concern it, but if it produces components for the medical, transport, energy or technology sector, it may receive customer requirements. A software house may not be an obvious essential entity, but if it maintains a system for a hospital, infrastructure operator, bank or managed service provider, NIS2 requirements may appear in the contract.
As a rule, NIS2 covers medium-sized and large entities in the sectors listed by the directive. In practice, employee count, turnover, balance sheet total and links with other entities must be checked.
For NIS2, it is especially important whether the company qualifies as a medium-sized enterprise or exceeds the thresholds for a medium-sized enterprise. Partner and linked enterprises must also be considered because the corporate group may affect qualification.
If the company has fewer than 50 employees and does not provide special services, it will often be outside the direct NIS2 scope. If the company has 50 to 249 employees and operates in a NIS2 sector, applicability assessment becomes a board-level task.
Some entities may be covered by NIS2 regardless of size. This is especially important for technology, telecommunications, domain, trust service and entities of special importance for society or the economy.
A small company should not automatically assume it is outside the scope. If it provides a service of special importance, operates in digital infrastructure or is essential for a critical customer service, deeper analysis is needed.
NIS2 divides entities into essential and important. The distinction matters for supervision and enforcement. For SMEs, the first priority is to determine whether the company is directly in scope at all.
An essential entity is generally an organization of higher importance, often larger and operating in high criticality sectors or meeting special criteria. Essential entities are usually subject to stronger supervision.
An important entity is an organization covered by NIS2 that does not qualify as essential. Risk management and incident reporting obligations still matter, but the supervisory regime may differ.
For most SMEs, the first question is: are we directly in scope? Only then is it useful to decide whether the status is essential or important.
This is the most important part for many SMEs. The company may not be directly an essential or important entity, but it may serve customers that are subject to NIS2. Then requirements will appear in contracts, security questionnaires, audits, procurement procedures and access requirements.
No. A business activity code may be a useful starting point, but it does not replace analysis of real activity. NIS2 concerns service types, sectors, the importance of activity, scale and the organization’s role. A company may have a broad activity code, but in practice provide a critical service to a regulated customer. It may also have a technology code but operate outside NIS2 scope.
The company operates in a NIS2 sector, meets the size threshold or falls under a size-independent exception. In this case, a fuller compliance and evidence programme is needed.
The company operates close to a regulated sector, has an unusual role, is part of a group, provides a service of special importance or its qualification depends on national rules.
This is a very common scenario for SMEs. The company may not be a formal regulated entity, but customers will require specific safeguards and evidence.
The company does not operate in a covered sector, does not meet the size threshold and has no regulated customers. However, changes in law, customers and business model should be monitored.
The software house may not be directly an essential or important entity if it does not meet NIS2 criteria. However, it may be an important supplier to a healthcare entity. The customer may require secure SDLC, testing, vulnerability management, SLA, incident reporting and subcontractor controls.
If the manufacturing customer is subject to NIS2, the IT provider may be covered by contractual requirements. This is especially likely if it has administrator access, manages backup, user accounts, networks or critical systems.
A typical small online shop will usually not be directly covered only because it operates online. However, scale, service type, possible platform status, customer data, payment providers and contractual requirements should be checked.
Such a company should perform an applicability assessment. It may be a medium-sized enterprise, a digital or ICT service provider and a supplier to regulated customers. Even if final legal qualification requires deeper analysis, customer requirements are highly likely.
Size alone may suggest no direct applicability. However, if the company supplies critical components to healthcare, energy, transport or large regulated customers, it may be affected through the supply chain.
If the assessment indicates that the company may be directly covered by NIS2, it should not wait for an audit or customer letter. A readiness plan should be prepared.
This is the most common scenario for SMEs. The company should prepare “NIS2 supplier readiness”, meaning the evidence pack and controls that regulated customers will expect.
A supplier that can quickly answer a NIS2 questionnaire, show evidence and explain its security model has an advantage when selling to larger customers.
A small company may be indirectly affected through customers or directly through an exception. Facts must be checked first.
Business activity codes do not show the full picture of services, customers, system access and importance in the supply chain.
Company size may depend on partner and linked enterprises. This can change qualification.
The company may be outside direct scope, but a regulated-sector customer may impose contractual requirements.
A verbal answer “NIS2 does not apply” is weak. A note or assessment with reasoning is needed.
Even if qualification needs clarification, the company can already implement the basics: MFA, backup, incident response, access review and training.
NIS2 is not only legal analysis. It also concerns cyber risk, suppliers, incidents, business continuity and evidence.
Larger companies will ask suppliers about safeguards. SMEs should have answers and evidence ready.
Even if the company is not directly subject to NIS2, basic safeguards are needed. They protect against ransomware, phishing, email takeover, data loss and customer relationship problems.
A SaaS company has 42 employees. It provides a document handling platform for customers in manufacturing, healthcare and local public administration. The board asks whether the company falls under NIS2 because the company itself is small and does not consider itself critical.
The assessment shows that direct applicability requires checking service details, size, customers and national rules. At the same time, it is clear that the company is indirectly affected by NIS2 because several customers may be regulated entities. Customers already ask about MFA, backup, incident reporting, security testing and subcontractors.
The company does not wait for final interpretation. Within 90 days, it prepares applicability assessment, customer evidence pack, MFA, restore test, incident response plan, customer incident reporting procedure and supplier assessment. This makes the company ready for customer requirements and further legal analysis.
ccyber.io helps SMEs determine whether NIS2 may affect the company directly or indirectly. We combine legal, technical, supplier and business perspectives. We do not stop at a “yes” or “no” answer. We prepare a practical action plan and evidence pack that helps in conversations with customers, auditors and insurers.
We can support your organization with:
The best first step is a NIS2 Applicability Workshop for SMEs. In a short workshop, the company can determine whether it may be directly covered, whether it is indirectly affected by customers and which minimum safeguards should be implemented regardless of final qualification.
No. A small company usually is not directly covered only because it operates a business. Sector, service, exceptions and customers must be checked.
No. A medium-sized company is covered when it operates in a sector or provides a service covered by NIS2 or meets special criteria. Size alone is not enough.
No. It may help, but it does not replace analysis of real activity, customers, services, data, system access and supply chain role.
Not always directly. However, it may be covered by customer requirements in contracts, audits, security questionnaires and incident reporting procedures.
Yes, if it meets sector, size or special service criteria. Even if it is not directly covered, it may be indirectly affected as a system supplier to regulated entities.
Prepare an applicability assessment, collect company, service and customer data, check NIS2 sectors and consult the conclusion with a lawyer or advisor. In parallel, implement basic safeguards.
Most often: MFA, backup, restore test, incident response plan, access review, training, vulnerability management, supplier security and incident reporting procedure.
Start with five things: service list, regulated customer list, company size data, analysis of size-independent exceptions and a quick review of basic safeguards.
The question “does my company fall under NIS2?” requires practical analysis. Checking company size or business activity code is not enough. Sector, service, exceptions, customers, capital links, access to data and systems, and current national rules must be assessed.
For many SMEs, indirect impact will be the most important issue. The company may not be a formal essential or important entity, but as a supplier to a regulated entity it will need to show safeguards, procedures and evidence.
The best rule is: do not wait for a customer questionnaire or inspection. Prepare an applicability assessment, implement the cybersecurity minimum and collect evidence that shows the company manages risk in practice.
We write about regulations such as NIS2, DORA, CRA and ISO 27001, cybersecurity for SMEs and critical infrastructure, as well as cyber hygiene, emerging threats and building security awareness within organisations.
Every article delivers practical knowledge - no jargon, just concrete steps you can act on to effectively protect your data, people and business continuity.