Protecting your small business from cyberattacks involves more than just installing antivirus software. Protection relies on three complementary lines of defense: reducing the attack surface, being able to weather an incident without shutting down, and having financial coverage in case an incident does occur. This guide details all three, along with related resources for each, and links to our cybersecurity and compliance page if you’re looking for direct assistance.

Key Takeaways

According to ANSSI’s 2025 Cyber Threat Overview (March 2026), 48% of the ransomware victims known to the agency are microbusinesses, small and medium-sized enterprises (SMEs), or mid-sized companies. The likelihood of an incident occurring is no longer the real issue—it is the ability to weather it that makes the difference.
Technical cybersecurity (firewalls, EDR, training) reduces the risk of an incident occurring. The business continuity and disaster recovery plan determines whether your operations will be suspended for 2 hours or 3 weeks if an incident does occur. Cyber insurance determines who pays the bill.
If you are a critical or important entity as defined by NIS2 (generally, an organization with 50 or more employees, or with revenue and total assets exceeding €10 million, in one of the 18 covered sectors), business continuity is one of the measures required by Article 21 of the directive.

The Three Lines of Defense for an SME

‍

Line of Defense	Objective	What happens if she's absent?	Further information
01Technical Prevention	Reduce the likelihood of a successful attack	The incident happens sooner and more easily	See the section below
02Operational Resilience(BCP / PRA)	Keep operating, or resume operations quickly, when an incident does occur	A 2-hour incident turns into a shutdown lasting several weeks	Detailed below
03Financial Protection(cyber insurance)	Don't bear the cost of the incident alone	You are responsible for the costs (ransom, business losses, liability insurance)	Detailed below

‍

Most small and medium-sized businesses invest only in the first line of defense because it is the least expensive to implement. It reduces the risk of an incident occurring, but it does not protect against the consequences when prevention ultimately fails—which eventually happens almost everywhere sooner or later. According to the 2025 Cyber Threat Panorama published by ANSSI in March 2026, 48% of the ransomware victims known to the agency are microbusinesses, SMEs, or mid-sized companies: it is not the large corporations that bear the brunt of the risk, but rather the organizations with the fewest resources to absorb it.

Who is actually affected by NIS2?

The NIS2 Directive classifies sectors into two annexes, which determine whether you are an “essential” or “important” entity (the level of oversight and penalties differs between the two):

‍

Appendix	Sectors Affected	Entity Level
Appendix IHighly Critical	EnergyTransportationBankingFinancial MarketsHealthDrinking WaterWastewaterDigital InfrastructureICT Service ManagementPublic AdministrationSpace	EEEIEssential entities if large, significant entities if medium-sized
Appendix IIReviews	Postal ServicesWaste ManagementChemicalsAgri-foodManufacturingDigital ServicesResearch	EISignificant Entities in General

‍

If your sector does not appear on either list, NIS2 likely does not apply to you directly. This does not change the actual operational risk; it only affects the legal obligation to document your preparedness. The simulator provided by ANSSI allows you to verify your specific situation rather than relying on an estimate. Our digital security and compliance page explains how this issue relates to your other IT priorities.

Line 1: Technical Prevention

Technical prevention is the foundation, and that’s probably what you’ve already started working on. Rather than explaining everything all over again here, here’s where to dig deeper into each component:

Know where your vulnerabilities are. An IT security audit or a penetration test (pentest) provides a concrete picture of what an attacker would see from the outside.
Harden the core of your IT infrastructure. Active Directory is a prime target for ransomware attacks: our Active Directory security guide explains how to protect it, and an IT bastion secures sensitive access.
Detect what slips through the cracks. Microsoft Sentinel and Microsoft Defender for Cloud handle technical detection; a SOC managed by an MSSP takes over if you don’t have a dedicated team, as part of our MSP offerings and managed services.
Train your teams. Spear phishing and CEO fraud using deepfake voice technology target people, not technology. Even the best technology can’t make up for a team that isn’t aware of the risks.
Staying Compliant. If NIS2 applies to you, our guides “What Is NIS2?” and “NIS2 Technical Measures” cover the requirements in detail.

Line 2: Operational Resilience, Business Continuity Plan (BCP), and Risk Assessment Plan (RAP)

Operational resilience is the least-addressed line of defense in small and medium-sized businesses, even though it determines whether an incident results in two hours or two months of downtime. Our guide , “Business Continuity Plan (BCP) and Recovery Plan (RPP): Definitions, Differences, and Implementation,” details the complete methodology, and our IT governance, risk, and compliance offering outlines the support we provide.

The Business Continuity Plan (BCP) covers the entire organization: business processes, human resources, crisis communication, supplier relations, and alternate facilities. It describes how the company continues to operate during an incident.

The Disaster Recovery Plan (DRP) is the technical component, focused on the information system: restoring servers, data, and applications. It describes how the information system is restarted after an incident.

A disaster recovery plan (DRP) without a business continuity plan (BCP) allows servers to be restarted, but does not specify who notifies clients, where teams will work in the meantime, or how operations will continue if a site remains inaccessible.

What NIS2 Requires. Article 21 of the directive lists ten mandatory risk management measures for affected entities, including business continuity: backup management, disaster recovery, and crisis management. The directive does not specify a testing frequency, but a plan that has never been tested proves nothing in the event of an audit: testing at least once a year and documenting each test is the recommended practice. Penalties for noncompliance can reach 10 million euros or 2% of global revenue for critical entities, and 7 million euros or 1.4% for significant entities.

Where to start:

Identify your critical processes (those whose downtime is most costly or has the shortest recovery time) and their acceptable recovery time objective (RTO) and acceptable data loss objective (RPO).
Document who does what in the event of a crisis (crisis committee, contacts, roles): this is the business continuity plan (BCP) section.
Document and automate the technical recovery process (backups, redundancy) as much as possible: this is the disaster recovery plan (DRP) component. Be careful not to confuse backups with retention: the Recycle Bin and Microsoft 365 retention periods are not a substitute for an independent backup.
Test at least once a year, under conditions that are as realistic as possible, and document the test results.

Three ways to test, from the simplest to the most comprehensive:

The targeted restore test. Restore a single file or database to verify that the backup actually works. This is the bare minimum, and yet many small and medium-sized businesses have never done it: a backup that fails to restore is useless, and you often don’t realize this until you actually need it.
Tabletop exercise. A verbal simulation of a crisis scenario, conducted around a table, in which each participant (production, IT, security, management) describes how they would respond. Inexpensive to organize, it is useful for verifying that roles and communication procedures are clear before moving forward.
The live failover test. An actual reboot into the disaster recovery environment, under conditions that closely resemble real-world scenarios. This is the only one of the three that truly measures whether the target RTOs and RPOs can be met, and it is also the most resource-intensive to organize, which is why it makes sense to start with the first two.

A disaster recovery plan that never makes it past the draft stage remains merely a compliance exercise. It generally fails at the first real incident—precisely when the company can no longer afford to fail.

Line 3: Financial Protection, Cyber Insurance

Even with robust preventive measures and a solid business continuity plan (BCP) and disaster recovery plan (DRP), an incident costs money: IT expert fees, legal and notification costs, lost revenue during the outage, and potential ransom payments. Cyber insurance is the line of defense that determines who pays that bill.

What it typically covers: crisis management costs, business interruption losses, third-party liability (affected customers or partners), data breach notification costs, and cyber extortion costs (ransom).

The exclusions that most often catch people off guard:

Proven negligence. Lack of documented updates or backups: The insurer may deny coverage if basic security measures are not in place.
"Cyberwar" clause. Since March 2023, Lloyd's of London has required that policies underwritten in its market exclude state-sponsored cyberattacks. Since the line between a state-sponsored attack and a criminal attack can be difficult to draw, make sure your policy provides a precise and restrictive definition.
Failure to file a complaint within 72 hours. Since the enactment of the LOPMI (Framework and Planning Act of the Ministry of the Interior), insurance coverage for a cyberattack is contingent upon filing a police report no later than 72 hours after the victim becomes aware of the incident. Failure to file the report within this time frame may result in the loss of coverage, regardless of the terms of the policy.

This last point ties insurance to the first line of defense: the 72-hour window begins when the attack is discovered, and rapid detection—via a managed SOC or a SIEM such as Sentinel—limits the damage while allowing the incident to be assessed and the evidence for the claim to be gathered in a timely manner.

Where to Start, Depending on Your Situation

‍

Your Situation	Immediate Priority
None of the three existing lines	Line 1A security audit to find out where you really stand
Preventive measures are in place, but we've never tested what happens in the event of an incident	Line 2Implement a basic disaster recovery plan for your critical systems and test it
Prevention and Business Continuity Plan (BCP) / Disaster Recovery Plan (DRP) in Place	Line 3Check what your current insurance policy actually covers (or purchase one) and the deadlines for filing a claim
Critical or important entity as defined by NIS2	NIS2All three lines are expected, documented, and verifiable in the event of an audit

‍

FAQ

Does NIS2 apply to an SME with fewer than 50 employees? Generally speaking , no: small businesses are exempt, except in specific cases provided for by the directive (certain providers of electronic communications or trust services, for example). The absence of a legal obligation does not change the actual risk: according to ANSSI, microbusinesses, SMEs, and mid-sized companies are the primary victims of ransomware in France.

Does a disaster recovery plan (DRP) replace a traditional backup? No , backup is one component of a DRP, not a DRP on its own. A DRP also includes recovery procedures, recovery time objectives (RTO) and recovery point objectives (RPO), and testing. A backup that has never been restored under real-world conditions remains a backup whose reliability is not truly known.

Should you have a disaster recovery plan (DRP) in place before purchasing cyber insurance, or the other way around? The two reinforce each other: a documented DRP is often an eligibility or underwriting criterion for cyber insurance, and insurance is never a substitute for the ability to continue operating during an incident.

Which sectors are covered by NIS2? There are two annexes: highly critical sectors (energy, transportation, banking, healthcare, water, digital infrastructure, public administration, space, among others) and critical sectors (waste management, chemicals, agri-food, manufacturing, digital services, research). The level of compliance required depends on both the sector and the size of the company.

What is a tabletop exercise? It is a crisis simulation conducted in a conference room, without involving actual systems: each team describes how it would respond to a given scenario. It is the least expensive way to verify that roles and crisis communication procedures are clear before moving on to a full-scale technical test.

‍

Not sure where to start with prevention, business continuity plans (BCPs) and insurance?

IT Systèmes helps you set priorities based on your specific circumstances and regulatory requirements.

Let's talk about it →

‍