NIS2 compliance 2026: tasks and schedule for SMEs

By 2026, NIS2 (Directive (EU) 2022/2555) will no longer be a "future issue" for many Hungarian SMEs, but rather a daily operational requirement: risk management, auditable controls, supplier requirements, incident management, and management responsibility. The good news is that even as an SME, you can prepare in a predictable way if you don't launch an "all at once" project, but rather a scheduled, evidence-based program.

In this article, you will find a practical to-do list and schedule focused on 2026: what needs to be sorted out immediately, what needs to be documented, and how to put together a minimum "audit-proof" package.

Quick context: what is NIS2, and why does it affect SMEs?

NIS2 is the EU's cybersecurity directive, which imposes broader risk management and incident reporting obligations than before and places a strong emphasis on executive responsibility and supply chain risks. Official text: EUR-Lex, Directive (EU) 2022/2555.

In the case of SMEs, the most common impact is not just that the company will be "obliged." In 2026, many companies will also be forced to achieve NIS2 maturity in order to:

• Larger customers (manufacturers, financial institutions, logistics, energy, healthcare) require security controls and evidence as a supplier requirement.

• Insurance companies, tenders, or audits (ISO 27001, customer audits) expect controls similar to NIS2.

• A serious incident (ransomware, data leak, shutdown) causes immediately measurable damage to the business.

Important: accurate classification (affected or not, and in which category) depends on Member State implementation and industry definitions. If you are unsure, it is worth starting with a brief scope and gap assessment.

The reality of 2026: what kind of "evidence" is needed, not just what kind of tools?

Many SMEs make the mistake of purchasing an EDR, setting up MFA, and considering themselves compliant. In practice, NIS2 compliance consists of three parts:

• Controls: technical and organizational measures (e.g., backup, logging, authorization management).

• Operation: who, at what frequency, how it is checked (e.g., patch report monthly, restore test quarterly).

• Evidence: auditable trace (policy, minutes, ticket, log, report, training attendance).

When you make a schedule for 2026, the goal should be to ensure that critical controls are accompanied by repeatable operations and evidence.

NIS2 tasks for SMEs: the minimum package of 10 areas

It is worth breaking down the NIS2 risk management requirements into SME-compatible control packages. The following 10 areas typically cover the most important audit issues and real risks.

1) Scope and critical services map

Most subsequent debates and delays stem from this: what constitutes a critical business service, what systems support it, and where the data is located.

Tangible deliverables:

• list of services (e.g., order taking, production planning, invoicing, customer service)

• application and infrastructure inventory (cloud, SaaS, servers, endpoints)

• data flows and integrations (especially ERP, CRM, email, file sharing)

Related topic if you have multiple systems: system integration between ERP, CRM, and BI.

2) Management responsibility and governance

In 2026, "ownerless" security is already a business risk. The minimum requirement is:

• designated responsible person (not necessarily a full-time CISO, but with responsibilities)

• decision-making forum (monthly or quarterly risk review)

• metrics (e.g., patch compliance, MFA coverage, backup success)

3) Risk management and basic policies

We don't need a policy factory, but rather a few, well-used documents:

• information security management system (ISMS-lite)

• access management rules (MFA, admin accounts)

• backup and recovery rules (RPO, RTO)

• incident management procedure

4) Identity and access (MFA, privilege hygiene)

The "highest yield" control for SMEs in 2026 is typically:

• Mandatory MFA for all remote access and critical SaaS

• Separation of admin accounts (daily user vs. admin)

• RBAC and regular authorization review

5) Patch and vulnerability management

You don't need an enterprise vulnerability platform in the first month, but you do need rhythm and reporting:

• hardware and software inventory

• SLA for critical updates (e.g., within 14 days)

• documentation of exceptions (why there is a delay, what compensatory controls are in place)

6) Backup, recovery, business continuity

When it comes to ransomware, backup quality is key. The minimum requirement in 2026 will be tested recovery.

A good SME model is to supplement the 3-2-1 principle with an immutable or offline element (depending on the service provider and architecture). If your service is critical, power supply risks may also be part of continuity (e.g., UPS, generator, on-site electrical safety). It is worth checking out expert sites on this topic, such as Notstrom and elektrotechnikai megoldások áttekintéséhez.

7) Logging and detection (minimum monitoring)

The goal is not to pour everything into SIEM, but to have:

• central log at least for critical systems (identity, mail, firewall, server)

• alert triggers (suspicious logins, admin actions, mass deletions)

• log retention and access control

8) Incident management and reporting skills

One of the most painful aspects of NIS2 for many companies is that there is no "script" for incidents, which delays decision-making and communication.

Minimum package:

• incident runbook (what we consider an incident, who decides, who communicates)

• internal escalation list and contact details

• supplier contacts (cloud, MSP, developer)

• tabletop exercise at least once a year

9) Supplier and cloud risks (supply chain)

In 2026, supplier controls will often arrive faster from the customer side than from the regulatory side. As an SME, these are the most important steps:

• list of critical suppliers (IT operations, SaaS, developers)

• minimum security requirements (MFA, backup, log, incident notification)

• contractual points (SLA, RTO/RPO, notification deadlines, subcontractors)

If you're in the cloud, a good starting point is cloud migration for SMEs.

10) Awareness and role-based training

"Everyone watch a video" is rarely enough. More effective:

• basic training upon entry + annual refresher courses

• Targeted training for finance (BEC fraud), IT (phishing, incidents), managers (decision-making situations)

• short test or campaign (phishing simulation) and corrective action

Roadmap to 2026: risk reduction + audit-proof evidence

The following schedule is designed for SMEs with 1-3 IT staff (or outsourced operations), with the goal of achieving a stable, defensible level within 6-12 months.

0–30 days: scope, rapid risk reduction, "hemostasis"

At this stage, the goal is not to have perfect documentation, but to immediately reduce the greatest risks.

• list of critical systems and data

• Mandatory introduction of MFA (especially for email, VPN, and admin interfaces)

• assessment of backups, at least one restore test

• organizing admin accounts

• incident contact list and minimum runbook

31–90 days: standard operation and basic evidence

This is where you build up the operation that you can already defend in audits or customer questionnaires.

• hardware and software inventory, patch rhythm, and report

• authorization review process (at least quarterly)

• minimum logging and alarm thresholds

• List of minimum supplier requirements and critical contractual deficiencies

• 6-10 page policy package (usable, not oversized)

3–6 months: maturity, continuity, supplier controls

• business continuity plan for the top 3 services

• RTO/RPO targets and tested restore

• tabletop exercise (incident simulation)

• audit or questionnaire of key suppliers (with request for evidence)

• security metrics (dashboard or monthly report)

6–12 months: audit-ready, continuous improvement

• internal audit-type review (gap list, repair backlog)

• technical debt management (legacy systems, unsupported versions)

• automation: onboarding-offboarding, log collection, patch reporting

• Integrated DevSecOps or change control (if there is development)

Related practical implementation: DevSecOps in practice.

NIS2 controls in SME language: what to show during an audit?

The table below will help you not only to "have it," but also to prove it.

The most common SME mistakes in 2026 (and how to fix them quickly)

"We bought a tool, so we're compliant."

The tool is just one element. What matters is rhythm, responsibility, and evidence. Improvement: every critical control should have an owner and a monthly status.

"The supplier will take care of it."

Responsibility is often shared. Remediation: documented RTO/RPO, incident notification, and access policies.

"When the audit comes, we'll put the documents together."

The most expensive route. Correction: document while running (ticket, minutes, export), not afterwards.

"Nothing ever happens here anyway."

SMEs are frequent targets because they can be blackmailed more quickly and are less likely to have good backups. Remedy: restore test and MFA within the first 30 days.

Frequently asked questions (FAQ)

Will NIS2 be mandatory for all SMEs in 2026? No. The obligation depends on the industry, the size of the company, and the implementation rules of the Member States. However, many SMEs, as suppliers, will be subject to the same controls "indirectly."

What are the top three things you can do to reduce risk? Mandatory MFA on critical systems, tested backup and recovery, and tidying up admin accounts and permissions.

How long does it realistically take to prepare? Typically, a stable, defensible baseline can be achieved in 3–6 months, and audit-ready operations can be achieved in 6–12 months, provided there is a dedicated person in charge and weekly capacity.

Is ISO 27001 required for NIS2? Not necessarily, but ISO 27001 can be a good framework for organizing governance and evidence. As an SME, an "ISMS-lite" is often sufficient in the first round.

What do customers most often ask for during supplier audits? MFA, backup and restore evidence, patch rhythm, incident management procedures, logging basics, and supply chain controls.

Next step: NIS2 gap assessment and 90-day implementation plan

If you want to quickly get a clear picture of where you stand in terms of NIS2 in 2026, the most effective way to start is with a short scope + gap assessment, followed by a prioritized, evidence-based roadmap (0–30, 31–90 days, 3–6 months).

The Syneo IT consulting team can help with this: we assess critical services and systems, define the minimum control package, and accompany you through the implementation (policy, technical controls, supplier requirements, incident preparedness). To get started, see what deliverables you can expect: IT consulting: when is it needed and what do you get for it?