5 practical steps to setting up NIS2 processes

The NIS2 Directive significantly raises the bar for cybersecurity and operational resilience across the EU. However, for many organizations, the challenge is not understanding what NIS2 requires but how to translate regulatory obligations into concrete processes, systems, and responsibilities. We have developed a process blueprint with 5 key steps essential for operating in a regulated sector.

Step 1: Assessment and Gap Analysis

Every NIS2 journey starts with clarity. The first step is a structured assessment of your current information security posture and a Gap analysis against NIS2 requirements.

This phase should answer three critical questions:

Where do we already meet NIS2 expectations?
Where are the gaps in governance, documentation, or technical controls?
Which risks could realistically disrupt our operations?

Without this baseline, investments in tools or controls risk misalignment or ineffectiveness.

Step 2: Risk-Based Prioritization

NIS2 explicitly promotes a risk-based approach. Not every system, process, or asset carries the same level of risk. Organizations should prioritize measures based on:

threats to network and information systems,
impact on essential or important services,
and potential consequences for customers, partners, and regulators.

This prioritization ensures that limited resources are focused where they reduce risk the most — a core principle of both NIS2 and modern cybersecurity governance.

Step 3: Selecting Tools and Processes

Technology alone does not create compliance. NIS2 requires security measures to be embedded into clear processes and responsibilities. At this stage, organizations select and align security technologies. For each, they should define clear rules and ownership. Policies, procedures, and training programs ensure that all relevant team members are onboarded and provided with the information they need. The key is coordination: tools must support processes, and processes must be understood and practiced by people.

Step 4: Implementation and Audit-Proof Documentation
Implementation should follow a structured, step-by-step approach. NIS2 places strong emphasis on documentation, not as mere bureaucracy, but as evidence of control and accountability. In the event of an incident, companies will benefit from having implemented policies and guidelines, as well as clear incident management and response plans. All documentation should be audit-ready, transparent, and consistently maintained.

Step 5: Reporting and Continuous Testing

NIS2 introduces strict incident reporting obligations and deadlines. Compliance, therefore, requires tested reporting chains, not just documented ones. This shift transforms reporting from a theoretical requirement into an operational capability.

Regular activities should include:

Conducting incident simulations and emergency drills
Testing escalation and decision paths
Ensuring reporting deadlines can be met under pressure

This concludes our five exemplary milestones toward NIS2 compliance. In our next blog post, we will dive deeper into an infrastructure setup that every company in a regulated sector should use as a basis for IT security and compliance. Stay tuned!

If you want to read more about the topic and dive deep into the NIS2 regulation's direct requirements, you can download our free whitepaper with a self-assessment checklist here.

Customer success stories

Customer success stories

5 practical steps to setting up NIS2 processes

Step 1: Assessment and Gap Analysis

Step 2: Risk-Based Prioritization

Step 3: Selecting Tools and Processes

Step 5: Reporting and Continuous Testing

Latest Blog Posts

5 practical steps to setting up NIS2...

NIS2 basics: 7 questions every...

5 Digital Trust and identification...

FAQ EU Digital Product Passport (DPP)