Why NIS 2 is the backbone of European cyber resilience

The Network and Information Security Directive 2 (NIS2) is the EU’s updated cybersecurity framework aimed at establishing a high common level of cybersecurity across all Member States. It replaces the original 2016 NIS Directive, significantly expanding its scope, strengthening requirements, and introducing more robust supervisory and enforcement mechanisms.

At its core, NIS2 asks organizations three fundamental questions:

• Are you in scope based on your sector and size?
• Are you managing your cyber risks appropriately and in a structured way?
• Are you able to detect, respond, and report when a significant incident occurs?

Unlike its predecessor, NIS2 goes beyond technical safeguards. It positions cybersecurity as a governance and leadership responsibility. Management bodies must approve and oversee cybersecurity risk management measures, ensure adequate resources are allocated, and undergo training to understand cyber risks. This marks a clear shift toward executive accountability.

To meet these expectations, NIS2 is structured around several key obligation areas. Governance and accountability ensure that cybersecurity is embedded at board level with clear oversight and documented responsibilities. Risk management measures require organizations to implement appropriate and proportionate technical and organizational controls covering areas such as risk analysis, incident handling, business continuity, supply chain security, access control, encryption, and vulnerability management. Incident reporting obligations impose strict timelines, including early warning notifications within 24 hours for significant incidents. In Belgium, conformity assessments further reinforce accountability, with CyFun or ISO 27001 often used as structured pathways to demonstrate compliance.

Together, these elements create a comprehensive framework designed for both regulatory compliance and measurable, sustainable cyber resilience. In practice, this is where structured guidance becomes essential: translating regulatory language into actionable roadmaps and operational improvements.

NIS2 readiness is rarely a one-step exercise. In most organizations, it unfolds across two closely linked dimensions: a governance and compliance track, and an operational and technical track. While distinct in focus, both must evolve together to ensure that regulatory expectations translate into real resilience.

The journey usually starts with a scoping and applicability assessment. Organizations must determine whether they qualify as essential or important entities and define the precise perimeter in scope. This step is critical, as it sets the boundaries for accountability, reporting, and supervisory oversight.

Once the scope is clear, a structured maturity assessment is performed against NIS2 requirements and, in Belgium, often against the CyberFundamentals framework. CyFun is aligned with internationally recognized standards such as the NIST Cybersecurity Framework and is structured around six core functions: Govern, Identify, Protect, Detect, Respond, and Recover. This alignment ensures that compliance efforts are not isolated exercises, but part of a broader, risk-based cybersecurity strategy. The gap analysis highlights strengths, weaknesses, and documentation gaps across governance, risk management, incident response, business continuity, and supply chain security. The output includes a compliance score and a clear, prioritized, action plan.

The next phase focuses on roadmap development. Regulatory requirements are translated into concrete actions, with defined owners, timelines, and expected evidence. This often includes formalizing cybersecurity governance structures, clarifying roles and responsibilities, strengthening incident handling procedures, improving third-party risk management, enhancing asset and vulnerability management, and aligning business continuity measures with both NIS2 and recognized best practices, such as ISO 27001.

Finally, the implementation phase operationalizes the roadmap. Policies are approved, processes are embedded into daily operations, reporting mechanisms are established, and progress is monitored through structured governance forums and periodic control reviews. The objective is to build sustainable, measurable control mechanisms that withstand supervisory scrutiny and support long term cyber resilience.

At KPMG, this structured and framework aligned approach allows organizations to move from uncertainty to clarity. By combining regulatory expertise, governance design, and operational cybersecurity experience, we help clients build realistic roadmaps that are aligned with legal requirements, supervisory expectations, and business constraints.

As NIS2 programs transition from assessment to execution, the real complexity begins to surface. What initially appears to be a structured regulatory framework often reveals fragmented governance models, overlapping responsibilities, undocumented controls, and inconsistent practices across business units. Aligning these elements requires more than updating policies. It demands cross functional coordination between executive leadership, IT, security, legal, procurement, risk management, and operational teams.

One of the most challenging aspects of NIS2 readiness is ensuring that regulatory expectations translate into operational capability. For example, incident reporting timelines are not theoretical. Organizations must be able to detect, assess, escalate, and communicate significant incidents within strict deadlines. This requires well-defined escalation paths, rehearsed crisis management procedures, reliable logging and monitoring mechanisms, and clear communication channels with national authorities. Testing these mechanisms frequently uncovers gaps between documented procedures and real-world execution.

Supply chain security introduces additional complexity. Modern organizations operate within interconnected ecosystems of suppliers, managed service providers, and cloud platforms. NIS2 requires structured third-party risk management processes that extend beyond initial questionnaires. It involves defining minimum security requirements, embedding cybersecurity clauses into contracts, performing risk-based assessments, and establishing ongoing monitoring mechanisms. Achieving consistency across procurement and vendor management processes often requires organizational change and clear governance ownership.

Leadership accountability also represents a significant shift. Under NIS2, management bodies are expected not only to approve cybersecurity measures but to oversee their effectiveness and understand the risks faced by the organization. This requires structured reporting dashboards, defined KPIs, periodic control reviews, and documented decision-making processes. Moving from informal oversight to formal governance is frequently one of the most transformative aspects of the journey.

As governance structures mature and operational controls are strengthened, the organization gradually shifts from reactive compliance to structured cyber resilience. Controls become measurable. Responsibilities become clear. Evidence becomes traceable. Most importantly, cybersecurity becomes embedded into day-to-day decision making rather than treated as an isolated technical concern.

When governance design, risk management processes, and technical safeguards finally converge, the organization does not simply prepare for supervisory scrutiny. It builds a resilient cybersecurity framework aligned with NIS2 expectations, industry best practices such as NIST and ISO 27001, and its own business objectives.