Does NIS2 apply to a company with 60 employees?

Probably yes, if it operates in one of the covered sectors and exceeds the medium-sized enterprise threshold. The assessment must be based on activity and revenue, not just the number of employees.

How long does it take to implement basic measures?

For a typical Slovenian SME, it takes two to four months if we approach it by priority rather than trying to do everything at once.

Do we need an ISO 27001 certificate?

No, NIS2 does not require certification. However, ISO 27001 covers a large portion of the requirements and makes proof easier.

Who has to report an incident?

The regulated entity itself, through the competent national authority. You must have the process and contact persons determined in advance.

What if our IT is fully outsourced to an external provider?

The responsibility remains with you. You need a contract that precisely defines security measures, access, and reporting deadlines.

← Blog

NIS2 Directive: What Slovenian Companies Must Prepare Before an Audit

NIS2 is more than paperwork — it requires verifiable security measures. Learn what you need to arrange and in what order.

German Vitali·27. september 2026·3 min branja·Cybersecurity

The NIS2 Directive has been transposed into Slovenian national law and applies to a significantly wider range of companies than the previous NIS. In this article, we explain who is a regulated entity, which measures you must prove, and how to approach implementation without duplicating costs.

TL;DR — Key Highlights

NIS2 covers medium-sized companies in energy, transport, healthcare, manufacturing, IT services, and waste management.
It requires demonstrable risk management, incident reporting within 24 hours, and supply chain security.
Responsibility lies with the management — not just the IT department.
Most requirements are covered by MFA, backups, EDR, segmentation, and documented procedures.

What NIS2 Actually Requires

NIS2 does not prescribe specific products but rather results: risk management, business continuity, supply chain security, access control, cryptography, incident management, and employee training. For every area, you must have a written policy, implemented technical measures, and evidence that these measures actually work.

The key difference compared to the previous regulation is reporting: an early warning about a significant incident within 24 hours, a formal notification within 72 hours, and a final report within one month. If you do not have a pre-prepared procedure and contact points, it is practically impossible to meet these deadlines.

Why This Is Important for Slovenian Companies

Even if your company is not a direct regulated entity, you will likely receive requirements through clients who are — NIS2 explicitly addresses the supply chain.

Fines reach up to 10 million EUR or 2% of annual global turnover for essential entities.
Management is personally responsible for overseeing security measures.
Public sector and industrial clients are already demanding security questionnaires from suppliers.
Cyber insurance becomes significantly more expensive or unavailable without basic controls.

How to Get Started — Recommended Process

Determine if you are a regulated entity (activity, size, role in the supply chain).
Inventory your assets: servers, applications, data, access levels, and external suppliers.
Conduct a risk assessment and assign owners to individual measures.
Close technical gaps by priority: MFA, backup with restore testing, EDR, segmentation, patch management.
Write an incident response procedure with clear 24/72-hour deadlines and contact points.
Conduct an annual drill and internal review, documenting the findings.

Measure Priorities Based on Impact and Cost

Measure	Impact on Compliance	Typical Cost	Implementation Time
MFA for all access	Very high	Low (included in M365)	Days
Backup with restore test	Very high	Medium	Weeks
EDR on all devices	High	Medium	Weeks
Network segmentation	High	Medium to high	Months
Incident response procedure	Very high	Low (labor)	Weeks

Common Mistakes

The most common mistake is treating NIS2 as a documentation project. Policies without technical implementation will fail during the first audit — an inspector will ask for proof: logs, restore test reports, and a list of MFA exceptions.

Another common mistake is overlooking the supply chain. If an external provider manages your servers, you need contractual provisions regarding security, incident reporting, and access — otherwise, the gap is yours, not theirs.

How We Help at VitalIT

At VitalIT, we perform an NIS2 status review, prepare a prioritized action plan, and handle the technical implementation. Our cybersecurity and IT consulting services are designed to help you achieve compliance without duplicating tools.

We also recommend the articles Annual IT Audit: 12 Things You Must Review Every Year and SIEM and Centralized Security Monitoring.

Frequently Asked Questions (FAQ)

Does NIS2 apply to a company with 60 employees?: Probably yes, if it operates in one of the covered sectors and exceeds the medium-sized enterprise threshold. The assessment must be based on activity and revenue, not just the number of employees.
How long does it take to implement basic measures?: For a typical Slovenian SME, it takes two to four months if we approach it by priority rather than trying to do everything at once.
Do we need an ISO 27001 certificate?: No, NIS2 does not require certification. However, ISO 27001 covers a large portion of the requirements and makes proof easier.
Who has to report an incident?: The regulated entity itself, through the competent national authority. You must have the process and contact persons determined in advance.
What if our IT is fully outsourced to an external provider?: The responsibility remains with you. You need a contract that precisely defines security measures, access, and reporting deadlines.

#NIS2#Compliance

Sorodne objave

Cybersecurity