NIS2 and the Croatian Cybersecurity Act: does it apply to your company

The European NIS2 Directive was transposed in Croatia by the Cybersecurity Act, in force since 2024, with the requirements detailed in the accompanying Cybersecurity Regulation. Many companies still do not know whether the Act applies to them, and some have already received a request from a customer asking for proof of security measures. This article is an overview, not a legal opinion, but it should be enough for you to know which question to ask.

Who the Act applies to

Entities in scope are divided into essential and important. Whether a company is one, the other or neither depends on two things: sector and size.

Sectors of high criticality include, among others: energy, transport, banking and financial market infrastructure, health, drinking water and waste water, digital infrastructure, ICT service management for other companies, and public administration.

Other critical sectors include: postal and courier services, waste management, manufacture and distribution of chemicals, production and distribution of food, part of manufacturing (medical devices, computers and electronics, electrical equipment, machinery, motor vehicles and other transport equipment), digital providers and research.

Size. The rule is that medium-sized and large enterprises in those sectors are covered. A medium-sized enterprise is, simplified, one with 50 or more employees or with annual turnover or balance sheet above EUR 10 million. Some types of entity are covered regardless of size, for example certain providers of digital infrastructure and trust services.

How to find out whether you are in scope

In Croatia, classification is carried out by the competent authorities, which deliver a notice of categorisation to the entity. Deadlines for implementing measures run from that notice.

That does not mean you should wait. If you are in one of the listed sectors and exceed the size threshold, it is reasonable to assume you will be covered and to start preparing, because implementation takes months.

Why it concerns you even if you are not in scope

Entities in scope must manage the security of their supply chain. In practice that means they send questionnaires to their suppliers, ask for proof of measures and write security clauses into contracts.

A small company that maintains software, supplies parts or keeps the books for a larger entity is not covered by the Act, but will receive the same requirements from its customer. Whoever cannot answer them risks the contract.

What the Act requires

Risk management measures. The Act does not prescribe specific products, but areas that must be covered. They include:

• risk assessment and security policies
• incident handling
• business continuity, backups and recovery
• supply chain security
• security in acquiring, developing and maintaining systems
• access control and asset management
• multi-factor authentication and encryption where appropriate
• staff training

Incident reporting. A significant incident is reported within short deadlines: an early warning within 24 hours of becoming aware, a fuller notification within 72 hours and a final report within a month. Those deadlines cannot be met without a procedure and responsible people agreed in advance.

Management responsibility. Management approves the measures, oversees their implementation and is accountable for failures. Security is no longer only a topic for the IT department, and board members must undergo appropriate training.

Fines. For essential entities, fines of up to EUR 10 million or 2% of total annual turnover are provided for; for important entities, up to EUR 7 million or 1.4% of turnover.

Where to start

1. Establish your status. Sector, size, affiliated companies. If you are on the borderline, ask for expert advice.
2. List your assets. Systems, data, devices and services the business depends on, with a responsible person for each. You cannot protect what you do not know exists.
3. Do a gap analysis. Compare the current state with the requirements. The result is a list of what is missing, ordered by risk.
4. Fix the basics. Multi-factor sign-in, regular updates, limited administrator rights and tested backups remove a large share of the risk at relatively low cost.
5. Write an incident procedure. Who decides, who reports, who gets called at two in the morning, and where it is kept when the network is down.
6. Review your suppliers. Who has access to your systems and data, and what the contract says about it.
7. Document. In an inspection, what counts is what can be shown. A measure that exists but is not written down is hard to prove.

The most common misconceptions

• “We have antivirus and a firewall.” Those are two of dozens of measures. The Act asks for risk management, not a list of tools.
• “That is the IT people’s job.” Responsibility lies with management, and a good part of the measures is organisational: policies, contracts, training.
• “We are too small for anyone to attack us.” Most attacks are automated and do not choose the victim by size. Small companies pay ransoms more often precisely because they have no backups.
• “We will buy a solution.” No product brings compliance by itself. A procedure that is followed and can be proven does.

What to check

The list of sectors, thresholds, deadlines and fine amounts in this article is given in summary. To decide on the status of your own company, check the text of the Act and the Regulation or take advice, because exceptions and the rules on affiliated companies can change the conclusion.

We carry out the assessment and the plan of measures as part of cybersecurity, together with the financial side of the story: what the measures cost and how much risk they cover. If you want to know where you stand, get in touch.