The European NIS2 directive significantly broadens the number of organisations subject to cybersecurity obligations, including mid-sized companies in many sectors.
The main obligations
- Implement appropriate risk management measures.
- Report significant incidents within short deadlines.
- Involve management, which becomes accountable for cybersecurity.
- Assess the security of suppliers.
Where to start?
First check whether your company is in scope, then carry out a review of your security. An audit helps prioritise actions and document your approach.
The precise requirements depend on how each country transposes the directive: get support to keep track of changes.