NIS2 Reality Check: Under Control or Still a Lot to Do?
The level of digital resilience in Europe—including that of organizations in the financial sector—had to be raised by 2024. This meant (yet another) stricter compliance requirement (NIS2) and, above all, a significant amount of additional work for board members, CISOs, risk managers, and IT officers. Unfortunately, it was—and still is—necessary. Undoubtedly, processes have recently been updated, policies tightened, and a professional incident reporting system established. Still, a reality check might be in order: after all, compliance with NIS2 is not a one-time event, but an ongoing process. Where will you stand in 2025?
A Brief Look Back at NIS2
NIS2 is the updated European directive on network and information security. Its goal? To strengthen the digital resilience of so-called essential organizations. These are organizations whose services are so critical to our society and economy that a cyberattack could cause immediate societal disruption.
This includes banks, insurance companies, and pension funds, as well as, for example, energy companies and water authorities. If they are affected, it affects us all. That is why, since 2024, stricter requirements have been in place for these sectors in the areas of risk management, incident reporting, supplier security, and corporate governance.
“Under NIS2, directors can be held personally liable in cases of demonstrable negligence. This is where it differs from previous directives, under which director involvement was expected but rarely explicitly enforced.”
Honest Questions by Topic
Before I get into that, I’d like to make a statement: “Organizations that aren’t required to comply with NIS2 should still want to.” Do you agree? I believe you should never cut corners when additional security measures can be taken. That’s why, for each of the five NIS2 themes, I’ve identified a few questions that, in my view, also apply to other organizations.
Risk Assessment and Documentation
Centralization of information, adaptability, clear procedures, and the ability to provide accurate answers during audits are important in this regard:
- Is there an up-to-date, centrally accessible overview of the risk analyses that have been conducted?
- Are these analyses periodically reviewed in light of changing threats or business activities?
- Have your incident response procedures been documented, tested, and communicated to the relevant departments?
- In the event of an audit or a report, can you demonstrate what you did and when?
Supplier Security
Your digital resilience can be compromised by third parties who may not be working in a sufficiently secure manner on your behalf. When it comes to cybersecurity, therefore, consider the entire chain:
- Do you have a clear understanding of which third parties have access to your (critical) systems or data?
- Are suppliers systematically evaluated based on their security level?
- Are cybersecurity agreements set forth in contracts or SLAs?
- What happens if a supplier no longer meets your standards?
Internal Awareness and Behavior
Focusing solely on technical cybersecurity measures is insufficient, even though some people may think otherwise.
- Are employees trained in their roles regarding digital security, or is this limited to the IT department?
- Is the security policy written in clear, easy-to-understand language and translated into practical rules of conduct?
- How often are employees still made aware of current risks such as phishing or social engineering?
Incident Response in Practice
Thinking ahead about what to do in a “what if” situation is what this is all about. I often call it “being prepared when speed is of the essence”:
- Do you have a formal, tested contingency plan in place in case of a cyberattack or data breach?
- Is it clear who is responsible for which action in the event of an incident?
- Are incidents systematically evaluated and used as learning opportunities?
Governance and Accountability
Cybersecurity is not just a technical or operational issue. It also requires leadership, ownership, and embedding at the highest levels of the organization:
- Is there explicit responsibility at the executive or board level* for cybersecurity and NIS2 compliance?
- Have his roles, responsibilities, and escalation procedures been formally documented and actually implemented?
- Are periodic reports submitted to the board regarding the status of security measures and risks?
- Are cybersecurity and compliance consistently on the agenda for executive management or board of directors meetings?
Risks When Answers Are Unclear
Sometimes it is simply a lack of clarity that causes problems for organizations. For example, if it is unclear who is responsible for what, or if procedures exist only on paper, this creates room for errors and delays, with all the consequences that entails. Under NIS2, executives can be held personally liable in cases of demonstrable negligence. In addition, regulators can impose hefty fines or sanctions if it turns out that compliance is lacking. And then there’s the reputational damage: in the financial sector, where trust is paramount, a single incident can seriously undermine the trust of customers and partners. Finally, the supply chain itself poses a risk. Even if you have everything properly organized internally, a vulnerable supplier or partner can still expose you to (cyber) threats.
How is your organization doing?
Under control or still a lot left to do? That’s the key question. At OneXillium, we help organizations in the financial sector with this every day. We do this not only through technical input and output solutions, but also through strategic advice, insights into compliance, and hands-on guidance. Thanks to the recent integration of BMConsultants and RedTeam across our entire range of services, we can now offer an even more comprehensive approach—from technical audits to governance issues—all while leveraging the expertise that makes each industry unique.
¹ OneXillium can provide explicit responsibility for cybersecurity and NIS2 by engaging an external CISO (Chief Information Security Officer), who can also draw on knowledge gained from other industries and practical experience.