A collaborator clicks on a link in an email that perfectly imitates a usual supplier. A few hours later, the accounting files are encrypted and a ransom appears on the screen. This scenario affects thousands of French companies every year, including those with fewer than fifty employees. Protecting your business against cyber threats in 2024 is no longer a technical choice reserved for large groups, but an operational necessity to integrate right now.
NIS2 Directive and SME Cybersecurity: What the European Regulation Changes
Most guides on IT protection for businesses focus on technical best practices. They overlook a major regulatory change: the European NIS2 directive. This text extends cybersecurity obligations far beyond just operators of vital importance.
Specifically, several thousand SMEs subcontracting in critical sectors are now targeted: energy, health, digital infrastructure, manufacturing, agri-food, and B2B IT services. The criterion used is that of the average company, meaning that a company with around fifty employees working for a hospital or an energy operator falls within the scope.
France was supposed to transpose NIS2 into national law by October 17, 2024, at the latest. This deadline was not met, and France was even referred to the EU Court of Justice in July 2026 for this delay.
As long as the transposition law and its decrees are not enacted, the NIS2 obligations are not yet legally enforceable against French companies. The European framework exists, but its concrete application remains pending.
Waiting for the enactment to act would be a mistake. Companies that anticipate these requirements (formalized risk analysis, documented incident management, securing the subcontracting chain) will have a head start when the decrees are issued. Specialized resources like cyberion.fr can help assess exposure levels and structure an approach suitable for the size of the company.
Protecting Company Data: Three High-Impact Technical Actions
Have you noticed that the majority of successful cyberattacks exploit vulnerabilities that have been known for months? Patches exist, but no one has installed them. Before seeking complex solutions, three simple actions significantly reduce the attack surface.
Updates and Network Segmentation
Applying security updates within 72 hours of their release closes the door to automated attacks that scan for vulnerable systems. This applies to operating systems, business software, router firmware, and connected devices.
Network segmentation involves separating environments. The visitor Wi-Fi network should not have access to the accounting file server. If a workstation is compromised in one area, the attacker cannot freely move to sensitive data. This measure does not require a substantial budget, but rather a rigorous configuration of the internal firewall.
Offline and Tested Backups
A ransomware encrypts everything it reaches, including backups connected to the network. Offline backup, on a physically disconnected medium, remains the only guarantee of recovery after a ransomware attack. The principle: a daily copy on a disk or isolated storage service, with a restoration test at least once a quarter.
Testing the restoration is the point that many neglect. A backup that does not restore correctly is equivalent to having no backup at all.
Employee Awareness of Cyberattacks: The Decisive Link
Technology alone is not enough if an employee shares their credentials in response to a fake email. Social engineering, that is, psychological manipulation, remains the most common attack vector. Phishing is the most common form: an urgent message, a familiar logo, a malicious link.
Training teams is not just an annual presentation of twenty slides. Effective programs rely on three pillars:
- Regular phishing simulations, with personalized feedback for each employee who clicked on the malicious link, to instill the verification reflex.
- Clear procedures for reporting a suspicious email, with a dedicated channel (internal address, button in the email client) and a quick response time from the IT team.
- A password policy coupled with multi-factor authentication (MFA) on all critical access: email, VPN, management software, website administration interface.
Multi-factor authentication blocks almost all account takeover attempts, even when the password has been compromised. It is the measure with the best effort/protection ratio.
IT Security Incident Management: Preparing for the Aftermath of an Attack
No protection is infallible. The question is not whether an incident will occur, but how the company will respond. An incident response plan, even a simplified one, radically changes the outcome of a crisis.
This plan specifies who does what in the first hours: isolating affected machines, notifying the IT service provider, contacting ANSSI if necessary, notifying the CNIL in case of a personal data breach (the regulatory deadline is 72 hours). Documenting each action during the incident facilitates post-crisis analysis and regulatory compliance.
For organizations without an internal IT team, outsourcing security supervision (managed SOC) allows for continuous detection of abnormal behaviors on the network. The monthly cost of such a service remains lower than the average cost of a several-day business shutdown.
- Draft a one-page reflex sheet: contacts, isolation steps, internal crisis communication channel.
- Identify in advance a provider capable of intervening in forensic (post-incident analysis) within 24 hours.
- Test the plan once a year with a simulation exercise, even tabletop, to identify blind spots.
A company’s cybersecurity relies on a balance between regulatory anticipation, technical rigor, and internal culture. SMEs that formalize their approach before being forced to do so limit both the risk of attack and the financial impact of an incident. The NIS2 directive will eventually apply in France, and organizations that are already prepared will not have to catch up in an emergency.
