NIS2: start with evidence and the fundamentals
The NIS2 directive requires a step up in cybersecurity maturity from a far wider range of organisations than its predecessor. France is a telling example: around 500 entities fell under the original NIS directive, while the French scope under NIS2 rises to 10,000, and by some estimates 15,000 to 18,000 companies. Across the European Union, the final framework in each country still depends on national transposition and implementing texts (in France, in early October 2026, the Resilience Bill, adopted by the Senate in March 2025, is still awaiting its plenary debate in the National Assembly: scheduled for 7 October 2026, it was withdrawn from the agenda again on 6 October, with no new date set), but the fundamentals are already known: governance, risk management, security measures, business continuity and incident reporting.
For a small or medium-sized business, the mistake would be to wait for the last decree before acting. The useful actions today are the same ones that insurers, large corporate customers and partners already expect: knowing what you protect, who can access it, how you restore it and how you respond to an incident.
To organise these actions, France's ANSSI offers a framework: ReCyF (Référentiel Cyber France), whose working version 2.5 was published on 17 March 2026 and supplemented on 7 September 2026 by practical guidance sheets. It remains a non-binding working document, which ANSSI will only finalise after transposition; it is nonetheless a useful checklist to make sure the plan below covers the right topics.
A marked tightening compared with the old regime
NIS2 sharply shortens reporting deadlines compared with the first NIS directive: the early warning to the national authority or CSIRT (ANSSI in France) must now be sent within 24 hours of detection, followed by an incident notification within 72 hours and a detailed final report within a month. This change calls for much faster internal detection and escalation than before, which is why logging and an incident procedure are among the priorities of the first 60 days of this plan.
Another structural change: the directive provides for the personal liability of senior management in the event of serious failings, with measures that can go as far as the temporary suspension of their duties. Cybersecurity thus becomes an explicit matter of individual governance, not just corporate compliance. Until a country's transposition law is in force, these sanctions do not yet apply there; but the European timetable leaves little doubt about their arrival, especially since the European Commission referred France, Spain, Ireland and the Netherlands to the Court of Justice of the EU on 8 July 2026 for failing to transpose, and it is better to prepare calmly than to discover them under pressure.
Days 1 to 30: regain visibility
Inventory servers, workstations, administrator accounts, critical applications and suppliers.
Identify sensitive data and business dependencies.
Review privileged accounts: dormant accounts, old passwords, missing MFA.
Document backups: scope, frequency, storage location, last restore test.
List remote access routes: VPN, VDI, supplier accounts, exposed ports.
This first phase does not aim for perfection. It aims to clear the fog. A business that does not know precisely which systems are critical cannot prioritise its security measures.
Days 31 to 60: reduce the immediate risks
Enable or strengthen MFA on sensitive accounts, ideally with phishing-resistant methods (see our guide to passkeys and phishing-resistant MFA).
Separate administrator accounts from everyday office accounts.
Update the most exposed systems.
Close unnecessary access and harden remote access.
Test a backup restore.
Set up minimum logging on critical services.
Write a simple incident procedure: who to call, what to cut off, what to preserve.
These actions sharply reduce operational risk, even before any formal compliance exercise.
Days 61 to 90: structure compliance
Draw up a simplified map of the information system.
Document the measures already in place.
Define a prioritised action plan.
Update security clauses with critical suppliers.
Prepare the evidence: test reports, policies, inventories, procedures.
Raise staff awareness of the most common risks: phishing, passwords, validation of sensitive requests.
The key word is proportionate. A small business does not need to imitate a large organisation, but it must be able to show a coherent, monitored and documented approach. With a NIS2 scope that could cover up to 18,000 companies in France alone, and tens of thousands across the EU, the likelihood that a customer already demands this evidence in its contracts, even before national laws are final, grows every month.
This plan holds even if NIS2 does not apply to you directly
The value of this 90-day plan goes beyond regulatory compliance: these measures reduce the real risk of an incident, whatever your company's exact status under NIS2. A business outside the direct scope but working for customers who are in scope will in any case benefit from being able to present this approach, if only to answer a supplier security questionnaire.
The role of the initial audit
A short audit turns a vague sense of risk into an action plan. It highlights the priorities: Active Directory, backups, remote access, updates, suppliers, monitoring. It is the right starting point to prepare for NIS2, but also to genuinely improve resilience.
If you only do one thing, start here
Faced with a long list of measures, a small business without dedicated resources can feel paralysed. The good news is that not all actions pay off equally. If only one priority were to be kept, it would be MFA on privileged accounts: it offers the best ratio between effort and protection, because it blocks the vast majority of account takeovers. Close behind comes a tested, offline backup, the only real safety net against ransomware.
These two measures do not tick every NIS2 box on their own, but they already reduce the real risk dramatically. Starting with what works best, rather than trying to tackle everything at once, remains the best way to avoid getting stuck at the stage of good intentions.
The 24-hour deadline reveals how prepared you are
Of all the NIS2 requirements, the 24-hour reporting deadline is the one that worries businesses without a security team the most, and rightly so. Alerting the authority within a day of detecting a significant incident first means detecting it, then assessing it, then knowing who informs whom. Without preparation, meeting that deadline in the middle of a crisis is close to impossible.
That is precisely why logging and the incident procedure sit among the priorities of the first sixty days of this plan. The 24-hour deadline is not just a regulatory constraint; it is a real-life test of the company's ability to react quickly and in an orderly way. Preparing calmly, by writing down in advance who to call, what to cut off and what to preserve, turns a daunting requirement into a reflex that can be applied on the day.
Start now, whatever the timetable
No approach guarantees the absence of sanctions or incidents, but a business able to demonstrate a coherent, documented posture maintained over time is in a radically different position, with the regulator as with its insurer, from one that has never formalised anything. This 90-day plan does not wait for national legislation to produce its effects: it reduces the real risk today, and it produces exactly the evidence that customers are already starting to require in their contracts.
SolidKern can support you with an Active Directory audit, a Security Audit package and cybersecurity awareness training, delivered remotely, with on-site visits available on quote.
Sources: ANSSI, NIS 2 directive · French National Assembly, legislative file of the Resilience Bill (in French) · Leto, withdrawal from the agenda on 6 October 2026 · European Commission, referral of four Member States to the Court of Justice (8 July 2026) · ANSSI MesServicesCyber, ReCyF and practical sheets (in French) · ANSSI, IT hygiene guide