NIS2 Top-7 Quick Wins for SMEs in 2026

The following seven measures are not a separate legal framework but a prioritisation within the statutory areas of measures: in Germany, § 30(2) BSIG lists ten areas; in Austria, § 32(4) NISG 2026 sets out the substantively parallel catalogue ((a) to (j), same order). Each item therefore names its legal basis first and the implementation second. For context: the effort and tool figures in the TL;DR and in the seven items (person-days, product names) are practical experience values as at 2 May 2026, not legal statements and not assured outcomes; the impact lines name the area of measures an item contributes to.

For whom the seven quick wins have mandatory character

The seven items acquire mandatory character not as a wording but through the statutory areas of measures they contribute to — and only once your entity can be assigned to a type under Annex 1 or Annex 2 and reaches the size thresholds (in Austria from the start of application on 1 October 2026); size alone is never sufficient. The law does not prescribe the specific design (such as 3-2-1 or a quarterly cycle). Exempt from the size test are the types covered irrespective of size (see below); entities of the federal administration are covered separately by § 29 BSIG.

Germany (§ 28 BSIG): A particularly important entity is any other entity of a type specified in Annex 1 that employs at least 250 employees or has an annual turnover of more than EUR 50 million and, in addition, an annual balance sheet total of more than EUR 43 million (§ 28(1)). An important entity is an entity of a type specified in Annex 1 or Annex 2 with at least 50 employees or an annual turnover and an annual balance sheet total each above EUR 10 million (§ 28(2)). Two pitfalls: turnover alone is never sufficient — § 28(1) no. 4(b) requires turnover above EUR 50 million and additionally a balance sheet total above EUR 43 million; the only stand-alone criterion is the employee count from 250 upwards. And for important entities there is no upper employee limit: a company with 5,000 employees that can only be assigned to an Annex 2 type remains an important entity. Covered irrespective of size are, among others, operators of critical installations, qualified trust service providers, top-level domain name registries and DNS service providers.

Austria (NISG 2026): A large company employs at least 250 employees or achieves an annual turnover above EUR 50 million with an annual balance sheet total above EUR 43 million; a medium-sized company employs at least 50 employees or has an annual turnover above EUR 10 million with a balance sheet total above EUR 10 million (§ 25(2) and (3)). Large companies of the Annex 1 types are essential entities (§ 24(1) no. 3); Annex 1 and Annex 2 types that are large or medium-sized companies are important entities (§ 24(2) no. 1). For the size calculation, Recommendation 2003/361/EC applies in both countries, with the exception of Art. 3(4) of its Annex (§ 28(4) BSIG, § 25 NISG 2026).

1. Enable MFA everywhere

Multi-factor authentication appears verbatim in the law: § 30(2) no. 10 BSIG requires multi-factor authentication or continuous authentication as well as secured communication; in Austria, the minimum catalogue of § 32(4) NISG 2026 likewise names multi-factor authentication expressly ((j)). Microsoft 365, Salesforce, AWS, Azure, all admin accounts. Cost: free of charge (authenticator apps) or hardware costs per user for FIDO2 keys.

Effort: 4-8 hours. Impact: contributes directly to § 30(2) no. 10 BSIG, which expressly names multi-factor authentication; basis for the MFA policy as evidence.

Scope: all admin accounts and all external access paths (VPN, cloud) — this is how BSI practice describes the standard case. Practice recommendation: start with the admin accounts. For plain employee office use, a different solution can be justified on a risk basis, because § 30(1) BSIG requires appropriate, proportionate and effective measures and the depth of implementation scales with the risk.

Evidence: § 30(1) BSIG additionally requires compliance to be documented. Practice recommendation: an MFA policy with its scope, a list of justified exceptions and a dated extract from the identity system showing the coverage rate per account class.

2. 3-2-1 backup + immutable

Backup is not a nice-to-have but part of the mandatory area of "business continuity": § 30(2) no. 3 BSIG names backup management, disaster recovery and crisis management in one breath; in Austria the area is set out in § 32(4)(c) NISG 2026. 3 copies, 2 media, 1 offsite + immutable against ransomware. Veeam hardened repos, Object Lock S3.

Effort: 2-3 days. Impact: an immutable copy as the starting point for restoring after ransomware; contributes to backup management under § 30(2) no. 3 BSIG.

The law names backup management without prescribing a specific pattern; 3-2-1 is the common practical implementation ("or equivalent"). The area also comprises three documents: a business continuity plan that sets out, for each business process, how long it may be unavailable (recovery time objective, RTO) and how much data loss is acceptable (recovery point objective, RPO); a disaster recovery plan with a tested restore routine; and a crisis management plan including internal and external communication. Practice recommendation: the restore test is the evidence, not the backup log — document the date, the scope and the recovery time actually measured; it shows whether the RTO set in the business continuity plan is achievable at all.

3. Document patch cycles

Patch and vulnerability management falls under "security in acquisition, development and maintenance" — § 30(2) no. 5 BSIG; the Directive frames this area as security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure (Art. 21(2) Directive (EU) 2022/2555); in Austria it is set out in § 32(4) NISG 2026 ((e)). Critical <72h, high <1 week, medium <1 month. Tools: WSUS, MS Defender, Tanium.

Effort: 1 day setup. Impact: fixed deployment deadlines per criticality shorten the vulnerability window; contributes to § 30(2) no. 5 BSIG.

Important distinction: the 72 hours in this line are a practice rhythm for deploying critical patches. They have nothing to do with the statutory 72-hour reporting deadline under § 32(1) no. 2 BSIG (AT: § 34(2) no. 2 NISG 2026) — see item 6 and the deadline table. This area additionally comprises a vulnerability management process with a vulnerability disclosure policy following the CVD principle (coordinated vulnerability disclosure). Practice recommendation: the policy names a published reporting address, a committed response time and the path from receipt of a report through to the fix. The patch compliance rate is at the same time one of the KPIs that can evidence the effectiveness assessment (§ 30(2) no. 6 BSIG, see the last FAQ).

4. Phishing training + tests

Training is mandatory on two levels: § 30(2) no. 7 BSIG requires basic training and awareness measures in the field of information technology security, and § 38(3) BSIG obliges the management personally to participate regularly. Quarterly phishing simulations + mandatory e-learning modules. KnowBe4, Sosafe.

Effort: 2-4 person-days/year. Impact: makes the click rate measurable and thus supplies a metric for the effectiveness assessment; contributes to § 30(2) no. 7 and § 38(3) BSIG.

Austria: The area is set out in § 32(4)(g) NISG 2026; under § 31(2) NISG 2026, the management bodies must attend specifically designed cybersecurity training, and entities must regularly offer corresponding training to their employees. The common term "cyber hygiene" does not come from the BSIG but from Art. 21(2)(g) of the NIS2 Directive.

Practice recommendation — rhythms, not statutory deadlines: quarterly phishing simulation with click-rate monitoring, annual training for all staff with a quiz, onboarding training for new employees within the first four weeks, sector-specific deep dives (for example SCADA training in industry). Why these intervals are not statutory deadlines is explained in the FAQ at the end of the article.

5. Build a supplier inventory

Supplier security is a mandatory area in its own right — § 30(2) no. 4 BSIG, in Austria § 32(4)(d) NISG 2026. In audit practice, this area is in our experience frequently the subject of findings (practical assessment) — which findings are typical is set out in the FAQ at the end. Per supplier: criticality, data processing agreement, ISO 27001 status, last audit. Prioritise the top 20.

Effort: 3-5 person-days initially. Impact: the first of four elements customary in practice within the supply chain security area (§ 30(2) no. 4 BSIG) — the basis for risk classification and contract renegotiation.

Four elements belong in this area: a supplier assessment with risk classification, cybersecurity clauses in the standard contracts, a right to audit for critical suppliers, and a contractually agreed incident notification from the supplier to you — customarily within no more than 24 hours — which is what keeps your own statutory 24-hour early warning achievable at all. Practice recommendation on the right to audit: expressly name the audit right, the notice period and who bears the costs.

A data processing agreement is not the same thing: the data processing agreement under Art. 28 GDPR has its own minimum content under data protection law — the subject matter and duration, the nature and purpose of the processing, the types of data, the categories of data subjects, and the obligations and rights of the controller (Art. 28(3) GDPR). The cybersecurity requirements under § 30(2) no. 4 BSIG come on top of that.

6. Incident response plan + tabletop

The incident response plan is a mandatory area (§ 30(2) no. 2 BSIG, AT: § 32(4)(b) NISG 2026) and at the same time the precondition for being able to meet the statutory reporting deadlines at all. Crisis team, escalation, communication. Run a tabletop exercise with the crisis team once a year.

Effort: 5 person-days initially + 1 person-day/year. Impact: creates the precondition for being able to meet the reporting deadlines of § 32(1) BSIG; contributes to § 30(2) no. 2 BSIG.

What the plan must cover: the early warning without undue delay, at the latest 24 hours after becoming aware of the incident — not from the start of the incident —, the report with an initial assessment within 72 hours, and the final report at the latest one month after the 72-hour report (§ 32(1) no. 1, 2 and 4 BSIG; AT § 34(2) no. 1, 2 and 4 NISG 2026). If the incident is ongoing, a progress report initially takes the place of the final report. The addressee in Germany is the joint reporting office of the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK), and in Austria the competent sector-specific CSIRT, or failing that the national CSIRT (§ 34(1) NISG 2026).

Trigger: what must be reported is the significant security incident — it has caused or is capable of causing severe operational disruption of the services or financial loss for the entity, or it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage (§ 2 no. 11 BSIG). The same standard applies in Austria, there with "severe financial losses" (§ 35(1) NISG 2026).

Practice recommendation: an annual tabletop exercise with the crisis team — staffed from management, IT operations, information security, communications and legal — based on a concrete scenario, for example ransomware encrypting the file servers on a Friday evening. What can ultimately be presented is the record: date, participants, scenario, the reporting points simulated as achieved, gaps identified and the measures derived from them, each with an owner and a deadline. Plus a reporting chain reachable around the clock — the 24-hour deadline runs from becoming aware, at night and at weekends too.

7. Asset inventory + classification

The asset inventory is the basis for areas 1 and 9: the policies on risk analysis and on information system security under § 30(2) no. 1 BSIG (AT: § 32(4)(a) NISG 2026) need a defined subject matter, and the access rights concept from area 9 (human resources security and access control, § 30(2) no. 9 BSIG) presupposes known systems. Hardware, software, data, cloud services. Tools: Lansweeper, Snipe-IT.

Effort: 5-10 person-days initially. Impact: precondition for risk management.

Secondary benefit for registration: registration under § 33(1) BSIG requires, among other things, the name including legal form, the address and current contact details including email, telephone numbers and public IP address ranges, the relevant sector under Annex 1 or 2, and the list of EU Member States in which services are provided. Part of this information — in particular the public IP address ranges and the technical contact details — is supplied by a well-maintained inventory. If it changes, it must be re-notified within two weeks (deadline table).

Practice recommendation: classification on a need-to-know basis — one protection level and one named owner per asset, from which the access rights are derived. Per entry at least: designation, asset type (hardware, software, data, cloud service), location or operator, owner, protection level, dependency of the business process — this is what links the inventory to the RTO and RPO from item 2 — and, for externally operated assets, the associated supplier from item 5. The protection level determines which access rights from area 9 are granted; externally reachable assets are at the same time the scope of the MFA policy from item 1. Add an onboarding and offboarding workflow and a regular review of access rights: the same data set, just from the perspective of area 9.

Which quick win contributes to which area of measures

The seven items touch eight of the ten statutory areas of measures; which two areas remain open is set out in the FAQ "Is that enough for NIS2 compliance?" at the end. The table maps which area a quick win contributes to; how deep the implementation must go is determined by the risk-based standard of § 30(1) BSIG and § 32(1) NISG 2026 respectively.

For quick win 1, quick win 3 and the access control in quick win 7, the letter follows from the identical order of the catalogue (§ 32(4) NISG 2026 compared with § 30(2) BSIG); the others are expressly assigned in the cited provisions.

Sequence by dependency: items 1 and 2 first — both are named verbatim in the catalogue and can be evidenced immediately. Then item 7, because risk analysis (area 1) and the access rights concept (area 9) presuppose a defined subject matter, and because part of the registration details under § 33(1) BSIG — the public IP address ranges and the technical contact details — comes from that same inventory. Item 6 before any reporting-obligation situation, because the 24-hour deadline runs from becoming aware and cannot be met without a reporting chain. Items 3 and 4 on an ongoing basis, item 5 last but not later — in audit practice it is in our experience frequently the subject of findings (practical assessment, see the FAQ at the end). This is a practice recommendation, not a statutory sequence.

What that means in terms of effort: adding up the initial effort for items 1, 2, 3, 5, 6 and 7 — item 1 at roughly one person-day for the 4 to 8 hours mentioned — gives around 17 to 25 person-days. On an ongoing basis, item 4 adds 2 to 4 person-days per year and item 6 adds 1 person-day per year. This total covers the technical implementation only. It does not include the documentation: § 30(1) BSIG requires compliance to be documented. The areas of measures themselves give rise to the business continuity, disaster recovery and crisis management plans (§ 30(2) no. 3 BSIG), the vulnerability management process (no. 5) and the supplier clauses (no. 4); the vulnerability disclosure policy, the MFA policy and the tabletop record are the practice recommendations mentioned above. For budget planning, factor in the documentation effort on top of the 17 to 25 person-days (practice recommendation).

Which deadlines run alongside the quick wins

The quick wins have no deadline of their own — the dates come from registration, reporting and evidence. All figures in this table are statutory deadlines and dates; practice rhythms are expressly marked as practice recommendations elsewhere in this article.

What failing on the seven items costs

What is sanctioned is not the missing quick win but the infringement of the risk-management obligation (Section 30 BSIG, § 32 NISG 2026) and of the reporting obligation (§ 32 BSIG, § 34 NISG 2026).

Germany: As the competent administrative authority, the BSI enforces the fine framework of § 65(5) to (7) BSIG — up to EUR 10 million against particularly important entities and up to EUR 7 million against important entities. The turnover variant of 2 % and 1.4 % respectively applies, by way of derogation, only where total turnover exceeds EUR 500 million and only for the infringements designated there; total turnover is the sum of all worldwide revenues of the undertaking to which the entity belongs in the financial year preceding the authority's decision (§ 65(8) BSIG). Where a data protection supervisory authority has already imposed a fine under the GDPR for the same conduct, an additional fine under the BSIG is excluded (§ 65(11) BSIG) — practically relevant in exactly the ransomware case that triggers both reporting paths.

Austria: The administrative penalty is imposed by the district administrative authority (§ 44(1) NISG 2026); the Cybersecurity Authority (Cybersicherheitsbehörde, Austria) reports the suspicion of an administrative offence and remains the supervisory authority. The penalty ranges of § 45(2) and (3) NISG 2026 apply from the start of application on 1 October 2026: up to EUR 10 million or 2 % of worldwide annual turnover for essential entities, up to EUR 7 million or 1.4 % for important entities — whichever amount is higher. Other offences carry penalties of up to EUR 50,000, and up to EUR 100,000 in the event of repetition (§ 45(4) NISG 2026).

Management: Alongside the fine against the entity, Germany provides for internal liability under § 38(2) BSIG — liability towards the entity itself under the rules of the company law applicable to the legal form; details in the linked article on management liability. The NISG 2026 contains no express internal liability rule in § 31 analogous to § 38(2) BSIG.