A webshop today rarely operates as a standalone system. In the background, inventory management, invoicing, online payments, courier service connections, an ERP system, external APIs and various user permissions are all attached to it. What looks like a simple webshop to the customer is in reality part of a far more complex IT environment.
As an e-commerce business grows, it becomes harder and harder to draw a sharp line between the webshop and the infrastructure behind it. That's why a security problem doesn't necessarily surface through the webshop itself: it can start from a compromised user account, flawed permission management or a vulnerable external integration. Cybersecurity regulation therefore looks at the business's operations in a much broader sense.
With NIS2, then, the best first question isn't "does my webshop meet the NIS2 requirements?" You first need to clarify whether the business operating the webshop falls under the scope of the regulation at all. If it does, you also need to examine separately what obligations apply to it — and whether a mandatory cybersecurity audit is among them. Falling under NIS2 and being subject to the audit obligation are not the same thing.
Not every webshop is subject to NIS2
NIS2 significantly expanded the European Union's cybersecurity regulation. The regulation defines who is affected based on sectors and organisation types. Annexes 2 and 3 of the Hungarian act name, among others, businesses in energy, transport, healthcare, digital infrastructure, postal services, the food industry, the chemical industry and certain manufacturing sectors — and among digital providers, online marketplaces appear as well. This does not mean, however, that every business selling on the internet is automatically subject to NIS2. A merchant selling their own products in their own webshop does not, in itself, qualify as an online marketplace.
An online marketplace is a platform that also enables other merchants or users to conclude distance contracts through it. Typically, then, the offerings of several sellers appear on the same platform — which is substantially different from how a single merchant's own webshop operates. This is one of the most important distinctions a webshop operator needs to see clearly.
When is a webshop affected?
The primary question isn't whether the site has a cart and online payment, but what economic activity the business behind the webshop carries out.
It can happen, for example, that a company sells its own manufactured products online while the manufacturing activity itself falls into one of the sectors covered by the Cybersecurity Act. Another business may operate an online marketplace, or provide a digital service the legislation specifically names.
Annex 3 of the act lists several areas that are relevant from an e-commerce perspective too. These can include certain food industry businesses, manufacturers and distributors of chemicals, manufacturers of medical devices, certain industrial manufacturers, postal service providers and online marketplaces. But whether a business is affected must always be judged on the basis of its actual activity.
A webshop selling consumer electronics therefore doesn't automatically become affected just because it sells products whose manufacture is listed in the act. Trading and manufacturing activities are not the same from this point of view.
Size matters too
Sector classification alone doesn't determine the obligation in every case. As a general rule, the current Hungarian regulation covers the organisations listed in Annexes 2 and 3 that reach the company size defined in the act or meet other size criteria.
Among other things, the legislation works with a headcount threshold of 50 employees, and in certain cases with revenue and balance sheet total thresholds equivalent to EUR 10 million. That's already a relevant order of magnitude for many higher-turnover e-commerce businesses.
At the same time, the classification can't always be settled by checking the given company's headcount and annual revenue. For corporate groups, linked enterprises and partner enterprises, the SME classification may require a separate assessment. For a webshop operating in several countries, with its own manufacturing, or run through several legal entities, you therefore shouldn't start from the webshop's own turnover alone.
There are also a few size-independent categories
For certain organisations, the regulation doesn't start from classic company size. These can include electronic communications providers, trust service or DNS service providers, top-level domain name registries, and domain name registration providers, to which special rules may apply.
That's why the often-quoted "50-employee NIS2 threshold" can easily mislead. The simplification that below fifty employees there's definitely nothing to do, and above fifty there definitely is, simply isn't true. The sector, the company's size, its actual activity and any special legal status have to be examined together.
And who is the audit itself mandatory for?
This is another important dividing line. Under the Hungarian Cybersecurity Act, organisations subject to the audit obligation must regularly prove, with the involvement of an independent auditor, that they comply with the prescribed cybersecurity requirements.
The general rule prescribes a cybersecurity audit every two years. Newly registered organisations must conclude an agreement with an auditor listed in the appropriate register within 120 days, and as a general rule must have their first audit carried out within two years of registration.
According to the SZTFH's announcement of 10 July 2026, of the 2,520 registered organisations subject to the audit obligation, 2,132 met this deadline.
The audit is not a simple website security check
In a webshop context, it's easy to imagine the cybersecurity audit as an expert looking over the webshop, running a few vulnerability scans and then issuing a certificate. The reality is far more complex.
NIS2 doesn't focus on protecting a single website; it examines the risks of all the network and information systems used in the organisation's operations. This includes, among other things, risk analysis, incident handling, business continuity, backup and recovery, supply chain security, access management, cryptography, staff training and, where justified, multi-factor authentication as well.
For a webshop, then, it isn't only the webshop itself that may come under scrutiny, but also the ERP, the warehouse and business management systems, corporate email, employees' devices, admin access, APIs and the integrations connecting to external services. That's already far more than checking whether the site has an SSL certificate.
A rented webshop doesn't lift NIS2 off the merchant's shoulders either
Here it's important to separate the responsibility of the webshop platform from that of the business using it. A modern SaaS system takes plenty of technical tasks off the merchant's plate: they don't have to run their own web server, install security updates or oversee the entire application code. That's a serious advantage, but it doesn't mean a business within the scope of NIS2 automatically complies with the requirements just because it uses a secure rented webshop system. Compliance applies to the organisation as a whole.
NIS2 pays special attention to the risks posed by the supply chain and external providers. An e-commerce business subject to the audit obligation therefore also has to know which external systems it relies on, what data those systems can access, and how critical they are to business operations.
What does this mean if you use a Sellvio webshop?
Sellvio offers several technical capabilities that fit well into a security-conscious operation. On the admin interface, for example, two-factor authentication can be enabled, so a one-time code may be required alongside the password to log in. This is especially important wherever orders, customer data, prices and settings that affect how the webshop runs can be accessed.
The system also provides detailed permission management. New users don't automatically receive full access, and the administrator can control at user and group level who can view, edit or delete what. A content editor, for instance, doesn't need access to user administration or other modules they don't require.
This follows the fundamental principle that every user should only have access to the systems and data they actually need for their work.
With APIs, permissions are especially important
A larger webshop rarely operates in isolation. Data moves constantly between the webshop, the ERP, the warehouse management system, the invoicing software, the logistics system and other external applications. The more such connections are built, the more important it is to control precisely what data each integration can access.
Sellvio's REST API uses OAuth 2.0-based authentication, and access is controlled through separate permission sets known as scopes. This way an integration doesn't automatically have to receive access to the webshop's entire dataset — only to the data it actually needs. From a cybersecurity perspective, that's a substantial difference. The narrower and more precisely defined an external system's access is, the smaller the risk in case of a faulty configuration or a compromised integration.
Four questions every larger webshop should ask
Does the business's actual activity appear among the sectors covered by the Cybersecurity Act? It's not the mere existence of the webshop that counts, but the activity of the organisation behind it.
Does the business reach the relevant size threshold, or does it fall into a special category to which different rules apply?
Which electronic information systems does the business depend on? Beyond the webshop, this can include the ERP, CRM, warehouse management, invoicing, email and API integrations as well.
Can it be proven that the security measures don't just exist on paper but actually work in practice? During an audit, this is a fundamental question.
If you can't give a clear answer even to the first two points, it's worth bringing in an expert to clarify the business's classification under NIS2.
Legal note: this article is general professional information and does not constitute legal advice or an official position. The scope of NIS2 and the Cybersecurity Act must always be assessed on the basis of the given business's activity, size, position within a corporate group and other legal circumstances.