NIS2 Advisory: Six Months In, What Are Entities Getting Wrong?

Several months into NIS2 enforcement, a consistent pattern has emerged across the essential and important entities we advise: most organisations understand the headline obligations but underestimate how much operational change NIS2 actually requires beneath them.

The most common gap is incident reporting readiness. NIS2’s early warning and reporting timelines are considerably tighter than most organisations’ existing incident response processes can meet. Entities that have not rehearsed the full reporting workflow are consistently caught out: it takes more than technical detection, it takes deciding, drafting and submitting the notification within hours, not days.

Supply chain risk management is the second recurring weakness. NIS2 explicitly extends accountability to an entity’s ICT supply chain, yet most third-party risk programmes we review were built for data protection compliance, not for the operational resilience and security assurance NIS2 expects from critical suppliers.

The third gap is governance accountability. NIS2 places direct responsibility on management bodies for cyber risk oversight, including personal accountability in some jurisdictions. Board and executive committees need to be able to demonstrate active oversight, not simply receive a report, which requires a different cadence and depth of reporting than most organisations currently have in place.

None of these gaps require starting from zero. Most entities have the underlying capability already; what is missing is the specific process, evidence and governance structure NIS2 expects to see. That is a matter of months to close with the right advisory support, not a multi-year transformation.