Our client told us the NIS2 directive affects us, what exactly is this and is it mandatory in Spain?

Here is exactly how the process works: 1) The major primary manufacturer is directly subject to the NIS2 directive. 2) The law tells this manufacturer, "any vulnerability in the suppliers you work with is your vulnerability, audit them." 3) To fulfill their own obligation, the manufacturer tries to get you to sign this form. So, you aren't impacted by the law itself, but by the contract.

The technical clauses in the client's form are usually standard: mandatory VPN and MFA for remote access to servers hosting CAD/CAM design files, up-to-date endpoint security on employee devices, and weekly offline backups. If you can document that you meet these four requirements, you'll easily pass the audit.

Many companies relax after seeing the "under 50 employees is exempt" clause in the law, but in practice, that's an illusion. When major automotive giants put that contract in front of you and say "sign this or we won't buy parts," the legal exemption has zero commercial value.

We're a 25-person industrial automation team in Barcelona. Last month, a similar German client sent us a 40-item NIS2 security commitment form. We paid a freelance specialist 3,800 euros for internal logging and firewall configuration, patched the gaps, and got the form approved.

Is your client just asking for a self-assessment declaration signed by an authorized company officer, or are they requiring a penetration test or audit report from an accredited third-party cybersecurity firm? This distinction will massively change your operational costs.

In Spain, the National Cybersecurity Institute (INCIBE) provides guidelines and self-assessment tools for businesses in the supply chain. Before responding to your client, it would be beneficial to review the minimum security measures outlined in INCIBE's SME guides.

You aren't in the tier that directly faces statutory fines under the law, but implementing the minimum measures in the specifications is a must if you don't want to lose the client.

When we first heard about it it felt like just another piece of pointless European Union red tape. But when we audited our systems at the client's request, we realized our on-prem server was completely exposed to the outside world and former employees' passwords were still active. As annoying as the requirement is you're actually saving your own company from disaster.

Correction: I misremembered the figure, it was a bit lower.

I'm curious too.

I agree, and I'd like to emphasize that. Processes without records never improve, because you don't know what to fix.

Good call starting this thread. Having backups accessible on the same network and with the same identity makes them part of the target.

Proven by experience.

Three different views emerged, they all complement each other. Most incidents start with a leaked password, not a vulnerability.

Of course, it varies if your situation is different.

How did you solve this? Hasty decisions become decisions you have to fix six months later.

Don't rely on a single measure; go layer by layer. I'm also curious if anyone does it differently.

Theres a trap here let me mention it. btw mistakes made on the what is NIS2 side are usually reversible but expensive.

If you have questions write them; I'll answer as best I can.

There's also a measurement aspect to this. If you scold false alarms, nobody will report again.

That's all, sorry if I went on too long.

Theres a common mistake people make when doing this. Just because everyone does it doesnt mean its right.

Just leaving this note it might be useful.

The most overlooked point about what is NIS2 is this: Everyone rushing into what is NIS2 gets stuck at the same point.

Correct me if I'm wrong.

I think it's hard to be that definitive about what is NIS2. Trying to do this alone is the most expensive way.

Most time waste accumulates in tasks waiting for approval.