The NIS2 Directive introduces new cybersecurity requirements for organisations within its scope. From risk assessments and security measures to incident management and management accountability, organisations may face challenges in determining how to structure their compliance efforts and prioritise the next steps.

In our previous articles, we explored “NIS2: What changes for decision-makers?", and the implications for management accountability. Now, it is time to focus on the next steps towards NIS2 compliance.

So, which decisions should be prioritised? And how can organisations ensure their cybersecurity investments address their actual risks?

1. Identify your cybersecurity priorities

The first step is to identify which systems, services and business processes are most exposed to cybersecurity risks.

An organisation may already have several cybersecurity measures in place and still face vulnerabilities that could compromise its operations.

For example, are there critical systems without adequate monitoring? Are privileged access accounts properly secured? Are backups regularly tested?

These questions help organisations identify security vulnerabilities and determine which areas require the most urgent attention.

2. Establish cybersecurity priorities and responsibilities

Once the main cybersecurity risks have been identified, the next step is to translate these findings into concrete actions and informed decisions.

Article 21 of the NIS2 Directive requires organisations within its scope to implement technical, operational and organisational measures proportionate to the risks they face. These measures cover areas such as incident management, supply chain security, access control and business continuity.

In practice, organisations should be able to answer three key questions:

• What needs to be done? Identify the cybersecurity measures required to mitigate risks.

• Who is responsible? Define who will approve, implement and monitor each measure.

• When should it be completed? Establish clear priorities and realistic deadlines.

Without a structured approach, organisations risk investing in new cybersecurity tools while critical vulnerabilities remain unaddressed.

3. Test your incident response and recovery capabilities

Imagine a cybersecurity incident tomorrow that compromises one of your organisation's most critical systems.

How long would it take to detect the incident? Who would make the initial decisions? And how long would it take to restore normal operations?

The NIS2 Directive reinforces the importance of incident management and business continuity. Organisations should therefore establish incident response procedures, threat detection mechanisms, recovery plans and regular testing to assess their effectiveness.

Having a documented incident response plan is essential, but its real value depends on the organisation's ability to execute it effectively when an incident occurs.

4. Monitor the implementation of cybersecurity measures

Cybersecurity risks continue to evolve as new threats, technologies and operational dependencies emerge.

For this reason, implemented security measures should be regularly assessed and adjusted to remain effective.

Ongoing monitoring should help organisations identify which vulnerabilities have been addressed, which risks remain unresolved and whether their protection and recovery mechanisms are still adequate.

At this stage, management involvement is also essential to ensure the allocation of appropriate resources, monitor progress and make informed decisions about future cybersecurity priorities.