NIS2: How the EU cyber directive changes things for SMEs in 2026

What is the NIS2 directive and why is 2026 decisive?

NIS2 is the EU directive 2022/2555 on cybersecurity, replacing and broadening the original NIS directive. It aims to raise security standards across numerous organizations in Europe, spanning sectors from healthcare to digital services, energy, transport, manufacturing, and waste management.

France's transposition occurred in 2024-2025 through legislation on critical infrastructure resilience and cybersecurity strengthening. Precise calibration of obligations, sectors, and thresholds depends on implementing decrees expected through 2025-2026, making this period critical for compliance.

Important: Exact thresholds, decree timelines, and penalty amounts should be verified through official sources (ANSSI, Légifrance) before any decision, as they continue to be clarified.

Am I affected by NIS2 as an SME?

NIS2 distinguishes two categories: 'essential' and 'important' entities. The latter includes many SMEs and mid-market companies, especially those operating in covered sectors or forming part of the supply chain of a NIS2-subject entity.

In practice, many SMEs discover their exposure not directly, but through contractual clauses imposed by their customers: large groups or public administrations subject to NIS2 that cascade security requirements to their suppliers.

Concretely, you are likely affected if you match one of these scenarios:

• You operate in a NIS2-covered sector and exceed certain size or revenue thresholds.
• You are a subcontractor or supplier to a large group or public administration subject to the directive.
• Your contracts now include security clauses, audit requests, or proof of system hardening.

What concrete obligations and what penalties?

NIS2 imposes risk management measures and incident notification obligations, proportionate yet demanding for both entity categories. This covers access management, updates, backups, monitoring, and incident reporting.

The EU text provides for financial penalties potentially reaching high amounts for essential entities (up to 10 million euros or 2% of global revenue under applicable provisions), with lower but still significant levels for important entities. These amounts should be confirmed in the official text and national transposition.

ANSSI is France's designated national authority for supporting and overseeing NIS2 compliance.

• Expected technical measures: MFA, access management, regular updates.
• Tested backups and verified recovery, stored off-site.
• Server hardening and monitoring enabling incident detection and reporting.

Why are servers and hosting environments your priority security focus?

Cybersecurity reports (ANSSI, CERT-FR, vendors) consistently document the same entry vectors year after year: poorly hardened shared hosting and VPS environments, outdated cPanel or Plesk panels, absent off-site backups, and weak passwords. These vulnerabilities disproportionately target under-resourced SMEs.

Meanwhile, ransomware and phishing campaigns maintain pressure, and insurers now condition cyber coverage on minimum measures: MFA, tested backups, hardened servers.

Securing your servers and applications is therefore not just a compliance checkbox—it's your best defense against threats that won't wait for decrees to be finalized.

• Outdated cPanel / Plesk panels.
• Missing externalized and tested backups.
• Poor access segregation, weak passwords, absent MFA.
• Insufficient monitoring to detect incidents in time.

How to achieve NIS2 compliance by 2026 (and gain competitive advantage)?

NIS2 compliance requires concrete evidence: not just intentions, but documented technical hardening and the ability to detect and report incidents. This is exactly where JD Solutions audits, hardens, and monitors your servers (VPS, cPanel, Plesk) and secures your business applications and hosting environments.

For an SME subcontracting to a large group or public administration, presenting a security audit and a documented hardening plan becomes a sales argument as much as a regulatory response. The compliance requirement transforms into competitive advantage for winning or retaining contracts.

A pragmatic approach starts with current assets, prioritizes high-impact vulnerabilities, and delivers professional deliverables for your customers.

• Conduct a security audit of your servers and applications.
• Create a prioritized and documented hardening plan.
• Implement tested backups, MFA, and incident monitoring.
• Maintain evidence you can present to customers and insurers.

Go further

To transform NIS2 obligations into concrete evidence, these services directly address hardening and monitoring requirements:

• securing your servers — Documented audit and hardening of your VPS, cPanel and Plesk—the concrete foundation of NIS2 compliance.
• secure business applications — Protect your applications and hosting environments handling sensitive data required by your customers.