Major client says we fall under NIS2: What is NIS2, does it really apply to an SME in France?

Corporate legal departments just copy-paste and blast these documents to everyone to cover their own backs. Stay calm, sit down at the table, and narrow the scope by telling them, 'We are not part of your critical infrastructure, we are an isolated software vendor.'

We got a similar letter 3 months ago from a client in the energy sector. Initially, they demanded a 60-item audit. We sat down, talked it out, and brought it down to 8 items just by proving database access logs and two-factor auth, without spending an extra dime.

How exactly are you connected to your client's system? If you have permanent, unrestricted access to their servers via a direct VPN, their concern is understandable. Is the connection strictly via a one-way API, or are you inside the network?

note: I wrote this based on my own experience, it might not apply to everyone.

Put together a security summary right away: internal two-factor authentication, backup frequency, and basic security training for staff. Send that to the client's risk department and say, 'This is our security profile at SME scale.'

Lately there are opportunistic consultants popping up everywhere trying to bill small firms 20-30k euros under the name of 'NIS2 compliance consulting'. Absolutely do not sign anything, the regulation cannot directly fine SMEs.

Article 2 of the EU directive clearly defines the enterprise size thresholds. In the official letter you send your client, it is in your best interest to put on record, in legal language, that you have no direct obligations by citing the European Commission's SME definition.

our client hit us with the exact same panic, the second companies hear nis2 they try to dump the whole burden on the supplier. keep the communication calm, once you show basic controls the matter usually goes away.

Timely topic. An untested backup is not a backup.

Having backups accessible on the same network and with the same identity makes them part of the target. If you post the result here, it will help others too.

I agree with this. When making a decision, first look at what data you have on hand.

We need to make a distinction here. Everyone rushing into what is nis2 gets stuck at the same point.

Taking measures without an inventory leaves doors you haven't seen open. Correct me if I'm wrong.

If you're going this route, sort this out first. Payment information changes are never verified through the channel they came from.

Payment information changes are never verified through the channel they came from. If I were you Id go this route.

Yes, that's exactly how it is with what is nis2. Start with a small trial; don't commit to everything at once.

If you don't write this down from the start, it leads to arguments later. If you have questions, write them; I'll answer as best I can.

the discussion got scattered let me summarize.. but forgotten test enviornments are more often the entry point than live systems.

if you don't write this down from the starrt it leads to arguments later but proven by experience.

You're right... Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

Let me summarize what's been said so far. Just because everyone does it doesn't mean it's right.

If its your first time start small; scaling comes later.

I feel the same way. Forgotten test environments are more often the entry point than live systems.

If permission and scope aren't in writing, don't start that test.

Noted, thanks. Don't rely on a single measure; go layer by layer.

The harder it is to reverse a decision, the slower you should make it. If you post the result here, it will help others too.

We got stuck at the same point for a while. The biggest time-waster for us was not knowing who had the final say.

An automated scan report is not the same as a penetration test. Just leaving this note it might be useful.