NIS2 in your SME base: who's in, who feels it

For most small companies, NIS2 doesn't arrive as legislation. It arrives as an email from their biggest customer, with a security questionnaire attached and a new clause in the supply contract. The owner forwards it to the accountant, the accountant forwards it to whoever fixes the printers, and it sits open in a browser tab for three weeks.

That email is your opening. Most sales teams walk past it, because they've filed the whole subject under "things only specialists talk about".

The legal minimum, then stop

In Italy, NIS2 is implemented by legislative decree 138/2024, in force since 16 October 2024, with ACN as the competent authority. The decree separates essential from important entities, requires risk-management measures, sets incident reporting duties, and puts responsibility for those measures on the management body itself.

The reporting clock is the part to memorise, because it's what rearranges an owner's priorities: an early warning within twenty-four hours of becoming aware of the incident, a full notification within 72 hours, a final report within one month. When personal data is involved, GDPR adds its own notification to the supervisory authority within 72 hours, and the two deadlines run at the same time. Penalties reach up to 10 million euro or 2% of worldwide annual turnover for essential entities, and up to 7 million or 1.4% for important ones.

If you want the regulation laid out properly, we've written it up already: the NIS2 directive in Italy. For a sales floor, though, the paragraphs above are already more law than anyone needs.

Who's actually in scope, and who gets hit sideways

Some customers in your base fall inside the perimeter outright, by sector and by size. With them you're not arguing about whether the rule applies; they know, they've usually had reminders, and what they lack is someone who moves them from a list of obligations to work that's been done. Bigger accounts, longer cycles, slower signatures.

Then there's the wide group, the one that moves your numbers. These are SMEs outside the perimeter that sell to, build for, or deliver into companies inside it. An essential entity has to manage risk across its own supply chain, so it pushes requirements down to suppliers as questionnaires, contract clauses and requests for evidence. For the supplier, the pressure doesn't come from a law that names them; it comes from an invoice that might not repeat next year. That's a sharper lever than any penalty, and a rep grasps it immediately, because it's the same logic behind everything else they sell.

Where the conversation usually breaks

It breaks when the rep reads the fine amounts out loud. The owner hears "10 million", concludes it has nothing to do with a twenty-person business, and listens with half an ear from then on. Generic fear doesn't convert. Small companies have lived for years with risks far more likely than the one you're describing.

Starting with a question about their week works better. If the accounting system is encrypted tomorrow morning, who picks up the phone, how long until you can invoice again, and who writes the email to your largest customer explaining what happened. The regulation comes in afterwards as framing, not as a threat.

From law lecture to sales conversation

Your rep doesn't need to become a NIS2 consultant. Before dialling, they need four things about that specific customer: what's true about their exposed surface, which duty touches them directly or through a client, which question opens discovery, and which service in your catalogue closes the gap.

The lead generation co-worker assembles the signals on every SME in your base, from the scan of exposed assets to credentials showing up in a breach, plus compliance questionnaires written in language a non-technical owner can answer. What comes out is a point-by-point view of where that customer stands against NIS2, with the holes marked. The sales co-worker turns that into the four-phase brief (Prepare, Discovery, Objections, Close) and into the proposal your rep carries into the meeting, with every gap tied to a service from your catalogue, at your price, in a report wearing your brand.

Say one thing plainly before the customer asks it: the platform helps them prepare and helps document the work, it doesn't certify anything and it isn't an audit. Claiming otherwise is the fastest way to burn the trust that got you into the room.

What you're really selling

You're not selling compliance, because compliance isn't a product you can ship. You're selling the work that makes it reachable, and that work recurs: periodic assessments, access management, backups somebody actually tests, mail protection, training for the people who click, the questionnaire that has to be redone when the business changes shape. All of it already sits in your price list, and customers renew it instead of buying once and forgetting.

There's a quieter effect that shows up at renewal. The supplier who helps an SME answer its biggest customer's questionnaire becomes the person that owner calls next time, before calling anyone else. That seat gets handed out right now, while the questionnaires are going round.

NIS2 isn't useful to you as a scare story. It's useful as a calendar: there's a date, there's an authority watching, and there are companies demanding evidence from their suppliers while you read this. Whoever calls first holding a fact, rather than a slide about the directive, keeps the conversation and usually the renewal too.