Medium-sized electronics manufacturer receives a registration letter
A Slovenian company with 48 employees and €13.2 million annual turnover manufactures embedded controllers for infusion pumps and sells them to hospitals across the EU. Its only production site is near Ljubljana; it has no subsidiaries. The company holds ISO/IEC 27001:2022 certification issued in 2023 and a customer audit report. In January, the management board receives a letter from the national NIS authority asking it to register as an entity under NIS 2. The CEO argues that the company is too small, that it is not a hospital, and that ISO 27001 proves it is already compliant, so registration would be redundant. The company's IT is outsourced to a local managed service provider; the contract does not mention incident notification to the customer. The company has 14 days to respond.
1. Is the company within NIS 2 scope? Explain the classification and whether the authority is right to ask for registration.
Read the worked answer
Conclusion: the manufacturer is likely in scope as an important entity. NIS 2 covers medium-sized and large entities operating in the sectors listed in Annex II, and manufacturing of computer, electronic and optical products or electrical equipment is an Annex II activity. The size test is not based on staff headcount alone. With 48 employees the company would be small on headcount, but €13.2 million turnover exceeds the small-enterprise ceiling of €10 million, so it is medium-sized. It provides services in the Union from Slovenia. The fact that its customers are hospitals does not make it a health-sector entity; its own activity is manufacturing. Registration is consistent with the NIS 2 registry obligation. ISO/IEC 27001 certification does not determine scope and does not create an exemption. The authority is therefore right to request registration, although the exact registration deadline and portal depend on national transposition.
2. Assess the CEO's three arguments and identify the immediate compliance actions.
Read the worked answer
The 'too small' argument fails because turnover, not just headcount, can push an entity into the medium-sized category. The 'not a hospital' argument confuses the customer's sector with the entity's own sector; Annex II manufacturing is enough. The ISO 27001 argument confuses good practice with legal compliance. A certificate can be useful evidence that many Art 21 measures exist, but it does not replace registration, incident reporting, management-body accountability, or supply-chain risk management. Immediate actions: confirm registration and designate the responsible management body; map the current ISMS against the Art 21 measures; amend the managed service provider contract to require prompt incident notification to the company and cooperation with regulatory reporting; document a 24-hour early warning, 72-hour notification and one-month final report workflow; and record the supplier risk assessment.
3. What supply-chain and incident-reporting gaps should be prioritised first?
Read the worked answer
The managed service provider is a critical supplier because it operates the company's IT. The contract should require security baselines, unique accounts, MFA where appropriate, logging, vulnerability remediation, incident notification to the manufacturer without undue delay, cooperation with the manufacturer's NIS 2 reporting, audit rights, and termination rights. The manufacturer should not wait for the supplier to report to the authority; the legal reporting duty sits with the manufacturer. Internally, it should define what counts as a significant incident, test the escalation path to the CSIRT and authority, and preserve evidence. Because the company supplies hospital equipment, it should also assess contractual customer notification duties. These steps address Art 21 supply-chain security and Art 23 reporting rather than relying on the ISO certificate.