Cybersecurity has become a strategic priority for organisations of all sizes. In response to the growing number of cyber threats and increasingly sophisticated attacks, the European Union introduced the NIS2 Directive to strengthen the resilience of businesses and public administrations.<\/p>\n\n\n\n
Building on the original NIS Directive, NIS2 significantly expands the number of organisations concerned and introduces new requirements for governance, risk management and incident reporting.<\/p>\n\n\n\n
With the first implementation deadlines approaching, one question remains: Is your organisation truly prepared?<\/strong><\/p>\n\n\n\n In this article, we review the key obligations introduced by NIS2, identify which organisations are affected and outline the actions that should be taken today.<\/p>\n\n\n\n The Network and Information Security Directive 2 (NIS2)<\/strong> is a European regulation designed to strengthen cybersecurity across all Member States.<\/p>\n\n\n\n Its objectives are twofold:<\/p>\n\n\n\n Unlike the original directive, NIS2 no longer applies solely to Operators of Essential Services. Its scope has been considerably broadened and now covers thousands of additional organisations.<\/p>\n\n\n\n The Directive distinguishes between two categories.<\/p>\n\n\n\n These include organisations operating in sectors such as:<\/p>\n\n\n\n NIS2 also extends to many additional sectors, including:<\/p>\n\n\n\n Company size, turnover and the organisation’s role within the supply chain may also determine whether NIS2 applies.<\/p>\n\n\n\n As a result, many SMEs and mid-sized organisations are discovering that they fall within the scope of the Directive.<\/p>\n\n\n\n Compliance goes far beyond implementing additional security tools.<\/p>\n\n\n\n It requires a comprehensive cybersecurity governance framework.<\/p>\n\n\n\n Organisations will be expected to:<\/p>\n\n\n\n Cyber risks must be identified, assessed and monitored on an ongoing basis.<\/p>\n\n\n\n This includes:<\/p>\n\n\n\n Supply chain attacks continue to increase.<\/p>\n\n\n\n NIS2 therefore requires organisations to assess and manage cybersecurity risks linked to suppliers, subcontractors and business partners.<\/p>\n\n\n\n Cybersecurity is no longer an individual responsibility\u2014it is a collective one.<\/p>\n\n\n\n Senior management is now directly accountable.<\/p>\n\n\n\n Executives must:<\/p>\n\n\n\n Cybersecurity becomes a governance issue alongside financial and regulatory risks.<\/p>\n\n\n\n Major cybersecurity incidents must be reported to the relevant authorities within defined timeframes.<\/p>\n\n\n\n The objective is to improve coordination across Europe and reduce the impact of cyberattacks.<\/p>\n\n\n\n Beyond potential financial penalties, failing to prepare may result in significant consequences, including:<\/p>\n\n\n\n NIS2 compliance should therefore be viewed as an investment in organisational resilience rather than a regulatory burden.<\/p>\n\n\n\n Compliance cannot be achieved overnight.<\/p>\n\n\n\n The first steps generally include:<\/p>\n\n\n\n This structured approach helps organisations anticipate investments, engage stakeholders and progressively reduce cyber risks.<\/p>\n\n\n\n At L\u00f9kla, we support organisations in strengthening their cybersecurity posture.<\/p>\n\n\n\n Our experts provide assistance in areas including:<\/p>\n\n\n\n Our approach combines technical expertise, business understanding and long-term support to deliver cybersecurity strategies tailored to each organisation’s needs.<\/p>\n\n\n\n The NIS2 Directive represents a significant shift in the way organisations approach cybersecurity.<\/p>\n\n\n\n More than a regulatory requirement, it offers an opportunity to strengthen information system resilience and foster a lasting cybersecurity culture.<\/p>\n\n\n\n Organisations that take action now will reduce their exposure to cyber risks, improve their security maturity and be better prepared for tomorrow’s evolving threat landscape.<\/p>\n\n\n\n Evaluate your current level of maturity and build a roadmap tailored to your business and regulatory requirements.<\/em><\/p>\n\n\nWhat is the NIS2 Directive?<\/h1>\n\n\n\n
\n
Which organisations are affected?<\/h1>\n\n\n\n
Essential entities<\/h2>\n\n\n\n
\n
Important entities<\/h2>\n\n\n\n
\n
The key NIS2 requirements<\/h1>\n\n\n\n
Implement risk management measures<\/h2>\n\n\n\n
\n
Secure the supply chain<\/h2>\n\n\n\n
Strengthen governance<\/h2>\n\n\n\n
\n
Report significant incidents<\/h2>\n\n\n\n
What are the risks of non-compliance?<\/h1>\n\n\n\n
\n
How can your organisation prepare?<\/h1>\n\n\n\n
\n
How L\u00f9kla can help<\/h1>\n\n\n\n
\n
Preparing today to secure tomorrow<\/h1>\n\n\n\n
Assess your NIS2 readiness<\/h2>\n\n\n\n