The NIS2 Directive has become a major topic on the business agenda, introducing stricter cybersecurity requirements for organisations within its scope, from risk management and the protection of critical systems to incident response and business continuity.

But understanding the theory is the easy part. The real questions arise when it's time to put it into practice. Where do you start? Which systems need the most protection? Which vulnerabilities should be addressed first? Who is responsible for implementing each measure?

These are valid questions, and answering them requires an assessment of your organisation's current security posture and a clear action plan aligned with its risks and operational needs.

Start by identifying the gaps

Having firewalls, backups or monitoring tools in place does not automatically mean your organisation is prepared to meet NIS2 requirements.

You need to understand how these security measures work, which systems they protect and where vulnerabilities or weaknesses may still exist.

A cybersecurity gap analysishelps you assess your existing security measures against applicable NIS2 requirements, identify weaknesses and prioritise improvements.

For example, your organisation may perform daily backups but have never tested how long it would take to restore critical systems after a cyberattack. That gap could have serious consequences for business continuity.

Turn priorities into concrete actions

Once the main risks have been identified, the next step is to decide what needs to be done, who will be responsible and when each measure should be implemented.

Article 21 of the NIS2 Directive sets out key cybersecurity risk management requirements, including access control, incident management, supply chain security, business continuity and the assessment of security measures' effectiveness.

In practice, an NIS2 action plan should cover:

• Avaliação de riscos: identificar sistemas críticos, vulnerabilidades e dependências.
• Proteção e prevenção: reforçar acessos, atualizar sistemas e implementar medidas adequadas.
• Deteção e resposta: estabelecer mecanismos de monitorização e procedimentos de gestão de incidentes.
• Continuidade operacional: garantir a existência de planos de recuperação e testar a sua eficácia.
• Acompanhamento: definir responsáveis, prazos e mecanismos de avaliação.

These measures should reflect your organisation's specific risks and operational requirements.

Cybersecurity readiness requires continuous improvement

Implementing an action plan is an important starting point. However, new vulnerabilities, technological changes and evolving business operations mean cybersecurity risks must be regularly reassessed.

NIS2 also strengthens the accountability of management bodies, requiring them to approve and oversee cybersecurity risk management measures. This makes collaboration between technical teams and business leadership essential.