NIS2 is a European cybersecurity directive that requires companies to get their digital resilience in order. Even if your organisation doesn’t directly fall under the directive, it’s wise to implement the basic measures: they protect your website, email, and customer data against downtime and misuse. This article explains what NIS2 entails, who it’s relevant for, and which concrete steps you can take.
What is NIS2?
NIS2 stands for the revised Network and Information Security Directive of the European Union. The purpose of this directive is to better protect organisations against cyber threats such as data breaches, ransomware, and disruption of digital services. The directive sets requirements for risk management, incident reporting, and the responsibility of directors for digital security.
Where earlier regulations mainly focused on large, critical sectors, the scope of NIS2 is broader. This means more organisations will face obligations around cybersecurity, including medium-sized companies and suppliers of essential services.
Who is this relevant for?
Not every business owner falls directly under the formal obligations of NIS2. Whether your organisation is covered depends on your sector and size. Still, the directive is relevant in practice to far more companies than it might seem at first glance:
- Companies that fall directly under the directive must demonstrably implement cybersecurity policies.
- Suppliers and partners of these companies are often subject to requirements imposed through contracts, even if they’re not directly covered by the directive themselves.
- Every business owner operating online benefits from the underlying principles: a secure website, secure email, and a working recovery plan in case of incidents.
In short: even without a legal obligation, it’s wise to get your digital foundation in order according to the principles of NIS2.
What measures are part of NIS2?
The directive calls for a risk-based approach to cybersecurity. In practice, this comes down to a number of recognisable building blocks:
- Risk management: identifying which systems and data are vulnerable, and aligning measures accordingly.
- Access security: strong passwords, two-factor authentication where possible, and limited access rights.
- Encrypted connections: use of SSL/TLS for websites and secure protocols for email.
- Backups and a recovery plan: regular, tested backups so you can recover quickly after an incident.
- Incident logging: keeping track of what happens during outages or attacks, so you can learn from them and report where necessary.
- Supply chain responsibility: also taking into account the security of suppliers and service providers.
Concrete steps for your website and hosting
For website administrators and business owners, NIS2 mainly translates into practical hygiene in the areas of hosting, email, and domain management. The steps below provide a concrete starting point.
Map out your digital environment
Note which websites, domains, mailboxes, and integrations you use, and who has access to them. Without an overview, risk management isn’t possible.
Check SSL and security settings
Make sure every website runs over HTTPS by default and that certificates renew automatically. With web hosting that includes free SSL, you don’t need to worry about this yourself.
Secure your business email
Make sure you have correct SPF, DKIM, and DMARC records in place to prevent spoofing and phishing via your domain. This is part of good business email.
Set up automatic backups
Make sure your website and email are backed up daily, and regularly test whether a restore actually works.
Check domain management and ownership
Make sure domain names are registered under the correct organisation, with up-to-date contact details and a lock against unwanted transfers.
Document policy and agreements
Document who is responsible for security, what happens in the event of an incident, and how you assess suppliers for digital security.
In the Plesk control panel of your hosting, you’ll often find settings for SSL, backups, and email security readily available, allowing you to quickly check or activate these basic measures.
Frequently Asked Questions
Does my company automatically fall under NIS2?
This depends on your sector and the size of your organisation. If in doubt, consult a legal advisor or your industry association for a concrete assessment.
Is NIS2 only relevant for large companies?
No. Smaller companies that are part of a supply chain with larger organisations are also often subject to requirements through contracts or procurement conditions.
Is an SSL certificate and backup sufficient if I don’t fall under the directive?
That’s a good foundation, but risk management, access security, and an incident process are also part of a mature security approach, regardless of whether you’re formally obligated.
What happens if I do nothing?
Without basic measures, you run a greater risk of data breaches, downtime, and reputational damage, and in the event of an incident, it will be harder to demonstrate that you acted diligently.
Where can I go with questions about my hosting environment?
For questions about SSL, backups, or email security, you can visit the knowledge base or contact your hosting provider’s support.
Conclusion
NIS2 is about structurally managing digital risks: knowing what you have, securing access and connections, ensuring backups and a recovery plan, and taking responsibility for your entire digital supply chain. Even without a direct obligation, it’s wise to get this foundation in order for your website, email, and domains.