NIS2: even out of scope, your customers will impose it — the cascade effect for SMEs
France’s transposition isn’t finalized, but the reference framework already exists and large buyers are demanding assurances from their suppliers. What you can prepare right now.
The NIS2 directive greatly widens the number of entities bound by cybersecurity obligations. In France, its transposition (the draft "resilience law") ran late: according to several guides published in 2026, the text was still not promulgated by summer and the European Commission had referred the country to the Court of Justice for failure to transpose. Should you wait? For an SME working with customers of a certain size, the answer is no.
An obligation that flows down the chain
NIS2 doesn’t directly apply to every subcontractor, but the entities it targets must manage supply-chain risk: software vendors, hosts, IT providers, agencies. In practice, they turn that into contractual requirements and security questionnaires sent to their suppliers. An SME that is "not covered" by the directive can therefore find itself subject to its requirements because a customer makes them a condition of a contract or renewal.
A framework already available
According to the same sources, ANSSI published the Référentiel Cyber France (ReCyF) in March 2026, which breaks expectations into security objectives — about twenty for essential entities, about fifteen for important ones. Even without a promulgated law, it is a usable roadmap to structure your approach and answer a customer questionnaire.
What a customer may reasonably ask you
- Governance: who is responsible for security in your company? Is there a written policy?
- Access management: multi-factor authentication, controlled privileged accounts, rights reviews.
- Backup and recovery: isolated backups, regularly tested, defined recovery objectives.
- Detection and response: ability to spot an incident and report it within contractual deadlines (see our hybrid SOC).
- Patching and vulnerabilities: update timelines, asset inventory.
- Your own subcontractors: the chain keeps propagating.
Prepare an answer without waiting for the final text
Take a factual inventory of these six points, with evidence (configuration screenshots, procedures, restore-test results) rather than statements. Fix low-cost gaps first — MFA, updates, backups — which cover most of the risk (the basics that matter). Document: a reusable response file saves weeks on every questionnaire.
A limit to know
This article describes a trend and a practical approach; it does not determine whether your company falls within the directive’s scope, which depends on your sector and size. For that, rely on the transposition texts and your counsel’s advice. An audit at least tells you precisely where you stand.
Sources
Frequently asked questions
How do you prepare for NIS2 as a subcontractor?
Take a factual inventory of six areas — governance, access management, backup and recovery, detection and response, patching and vulnerabilities, your own subcontractors — with evidence rather than statements. Close the low-cost gaps first: MFA, updates, backups. Then document a reusable response pack.
Does NIS2 affect SMEs that fall outside its scope?
Not directly. But the entities it covers must control their supply chain risk, and they translate that into contractual requirements and security questionnaires sent to their suppliers. An SME that is “not concerned” by the directive can therefore end up subject to its requirements, because a customer makes it a condition of a contract or a renewal.
Where does France’s transposition of NIS2 stand?
According to several guides published in 2026, the draft resilience law had still not been enacted by the summer and the European Commission had referred France to the Court of Justice for failure to transpose. Whether your company falls within the directive’s scope depends on your sector and size: rely on the texts and on your own counsel.
What is the Référentiel Cyber France (ReCyF)?
According to the same sources, ANSSI published a control framework in March 2026 that breaks the expectations down into security objectives: around twenty for essential entities, around fifteen for important ones. Even without an enacted law, it is a usable roadmap for structuring your approach and answering a customer questionnaire.
A question about your situation?
Take the self-audit — 93 questions, no sign-up — or ask for a free audit straight away: we’ll look at your specific case.