Building an ISMS under NIS2: 10-Week Plan for SMEs

1. Legal Basis: NIS2 vs. ISO 27001

Practice recommendation: build an ISO 27001-compliant ISMS; certification optional.

2. Defining the ISMS Scope

Scope definition:

• Which processes: all / only critical / specific
• Which locations
• Which IT systems
• Which subsidiaries

Recommendation for SMEs subject to NIS2: the entire company in scope.

3. Risk Analysis + Treatment Plan

1. Asset inventory: all IT assets, data classes, business processes
2. Threat analysis: typical threats per asset (ransomware, data breach, outage)
3. Vulnerability assessment: current protection level
4. Risk score: likelihood of occurrence × impact
5. Treatment options: reduce / accept / transfer / avoid
6. Statement of Applicability (SoA): which controls are applicable

4. 12 Mandatory Policies

1. Information Security Policy (top-level)
2. Acceptable Use Policy
3. Access Control Policy
4. Cryptographic Controls Policy
5. Backup + Recovery Policy
6. Patch Management Policy
7. Incident Management Policy
8. Supplier Management Policy
9. Mobile Device + BYOD Policy
10. Clear Desk + Clear Screen Policy
11. Password Policy
12. Physical Security Policy

5. Internal Audit + Management Review

• Annual internal audit: full ISMS scope, performed by an independent internal auditor (or external)
• Annual management review: management reviews the audit report, incidents and risk changes
• Continuous improvement: CAPA process (corrective + preventive actions)

6. 10-Week Roadmap