Does NIS2 / the Cybersecurity Act apply to our company?

The EU's NIS2 directive was implemented in Finland through the Cybersecurity Act, which entered into force in April 2025. Many business leaders have heard about it but are not sure whether it applies to them. The answer depends on two things: whether you fall within the scope of the law directly, and whether your customers require the same things from you through contracts.

Does the law apply to your company directly?

As a rule, the law applies to medium-sized and large companies in certain sectors. Check two things:

1. Size: the company has at least 50 employees, or its turnover and balance sheet both exceed 10 million euros. The figures of companies in the same group or partner companies may have to be included.
2. Sector: the company operates for example in energy, transport, health care, water supply, digital infrastructure, banking and finance, waste management, food, chemicals, postal and courier services or certain manufacturing industries (such as machinery, electronics and vehicles). Managed service providers producing IT services for other companies are also included, as are online marketplaces, for example.

Some operators fall within the scope regardless of their size, for example certain telecommunications and trust service providers. The sector classification is not always clear-cut, so borderline cases are worth checking carefully.

If the law applies to you, you must register with the supervisory authority for your sector and meet the requirements of the law.

What does the law require?

The requirements are largely good basic security work that simply has to be done systematically and documented:

• Risk management: a documented way of identifying and managing cyber risks.
• Security measures: for example access management, multi-factor authentication, backups, vulnerability management and encryption.
• Continuity: a plan for how operations continue and recover after a disruption.
• Incident reporting: significant incidents must be reported to the authority within strict deadlines, with the first early warning within 24 hours.
• Supply chain security: the risks of your own suppliers and service providers must be assessed and managed.
• Management responsibility: the company's management must approve the measures, oversee their implementation and acquire sufficient competence.

Neglect can lead to significant penalty payments, but the most important reason to act is simpler: the same measures protect the business from real attacks.

Requirements also come through the supply chain

This surprises many. Even if your company is too small or in the wrong sector, the law can affect you indirectly. Companies within its scope must manage the risks of their supply chain, so they require the same from their suppliers.

In practice this shows up as security questionnaires, new security appendices in contracts, audits and requirements such as multi-factor authentication or reporting incidents. Companies providing IT services, software, maintenance or subcontracting in particular face these requirements more and more often.

Those who can answer the questions quickly and credibly win deals. Those who cannot may drop off the supplier list.

Three common misconceptions

• "We're too small." Size only decides direct application. Requirements coming through the supply chain don't look at the number of employees.
• "Our IT partner takes care of this." The partner can carry out technical measures, but responsibility for risk management and management's obligations stays with the company itself.
• "It's enough to fill in the questionnaire." The answers must match reality. If something happens, what was promised in the contract will be checked.

How to get started?

1. Find out whether the law applies to you directly based on size and sector.
2. List the customers that are likely to fall within the scope and think about what they may require of you.
3. Compare your current state with the requirements and fix the biggest gaps first.
4. Appoint a responsible person and bring the matter to management.

Foregon's fixed-price NIS2 Review tells you in about a week whether the law applies to you directly or through your customers, and what the most important next steps are. If a customer has already sent you a security questionnaire, we can also help you answer it.

← All articles