NIS2 Compliance

NIS2 Compliance Checklist for UK SMEs: What You Actually Need in 2026

By Piotr Kleszcz, Fifth Ace 7 min read Updated July 2026

If you run a business with 10 to 100 employees and work with EU clients, partners, or suppliers — NIS2 may already apply to you. And if you're not compliant, the penalties are significant: up to €10 million or 2% of global annual turnover.

This checklist cuts through the noise. No legal jargon. No corporate frameworks. Just what a small or medium business actually needs to implement to meet NIS2 Article 21 requirements.

Important: NIS2 does not issue a compliance certificate. Your obligation is to implement the required controls and be able to demonstrate them to a regulator or client on request. That's exactly what a structured audit delivers.

Who Does NIS2 Apply To?

NIS2 applies to organisations in specific sectors that meet size thresholds:

Category	Employees	Turnover	Examples
Essential	250+	>€50M	Energy, transport, healthcare
Important	50–249	€10M–€50M	IT services, manufacturing, digital providers
Supply chain	Any size	Any	Suppliers to essential/important entities

Even if your business falls below the thresholds, your enterprise clients may contractually require NIS2 compliance from their suppliers. This is increasingly common in UK and EU procurement.

The NIS2 Article 21 Checklist

Article 21 defines ten security measures that organisations must implement. Here's what each one means in practice for a small business:

✦ NIS2 Article 21 — 10 Required Controls

Risk Management Policy — A documented process for identifying, assessing, and treating cybersecurity risks. Updated at least annually.

Incident Handling Procedure — A written plan for detecting, responding to, and reporting incidents. Significant incidents must be reported to the relevant authority within 24 hours.

Business Continuity & Disaster Recovery — Documented backup procedures, recovery time objectives, and a tested restoration process.

Supply Chain Security — Assess the cybersecurity posture of your key suppliers and document the process. Ask them about their controls.

Network & Systems Security — Firewall configuration, network segmentation, and access controls on critical systems.

Vulnerability Management — Regular vulnerability scans, a patching schedule, and evidence of remediation. Penetration testing recommended annually.

Access Control & MFA — Least-privilege access, role-based permissions, and multi-factor authentication on all critical systems and remote access.

Encryption — Data encrypted at rest and in transit. TLS on all web services. Encrypted backups.

Security Awareness Training — Annual training for all staff covering phishing, password hygiene, and incident reporting. Document attendance.

Board-Level Accountability — Senior management must approve the security policy and can be held personally liable for non-compliance.

Where Most SMEs Fall Short

Based on our audits of small and medium businesses, these are the most common gaps:

No documented risk assessment — most businesses manage risk informally, with nothing written down
No incident response plan — when a breach happens, there's no process to follow
MFA not enforced — especially on email, VPN, and remote desktop access
No patch management process — systems running outdated software for months
No security awareness training — employees remain the easiest attack vector

How Long Does NIS2 Compliance Take?

For a business starting from scratch, a realistic timeline looks like this:

Phase	Activity	Timeline
Gap Analysis	Audit current posture against all 10 controls	1–2 weeks
Documentation	Write policies, procedures, risk register	2–4 weeks
Technical Controls	Implement MFA, firewall rules, encryption, backups	2–6 weeks
Training	Staff awareness session and documentation	1 week
Maintenance	Quarterly reviews, ongoing monitoring	Ongoing

Next Steps

The fastest way to understand your current NIS2 posture is a structured gap analysis. This maps your existing controls against all Article 21 requirements and produces a prioritised remediation plan.

At Fifth Ace, our NIS2 Business Audit delivers exactly that — a complete gap analysis, executive report, and remediation roadmap, designed specifically for businesses with 10 to 100 employees.

Ready to find out where you stand?

Our NIS2 Business Audit gives you a complete picture of your compliance posture — with a clear plan to fix what's missing. Fixed price. No surprises.

Book Your NIS2 Audit — £799 →

Download our free NIS2 Readiness Checklist

Not ready to book an audit yet? Take our free 5-minute self-assessment and get the PDF checklist straight to your inbox.

Download our free NIS2 Readiness Checklist →