Separate applicability from implementation
Small practices and care providers are not automatically covered by NIS-2. Applicability depends on the organisation and statutory criteria. Controls such as firewalls and backups contribute to security but do not establish compliance on their own.
