NIS2: what companies should prepare now

Why NIS2 changes the picture

The directive asks organisations to better control risks, suppliers, incidents and continuity. For SMEs and Belgian organisations, the challenge is to move from reactive security to structured governance.

First actions to launch

• Identify critical services and digital dependencies.
• Clarify responsibilities between management, IT, business teams and suppliers.
• Document existing measures: backups, access, monitoring and incident management.
• Prioritise gaps that really expose the business.

Turn compliance into steering

A useful approach is to create a short roadmap: current-state review, quick wins, 90-day plan and recurring governance. Compliance then becomes a resilience lever rather than an administrative file.

For a long time, cybersecurity was perceived as a purely technical or regulatory matter. With the NIS2 Directive, this approach is fundamentally changing.

Compliance is no longer just about “checking boxes.” It has become a real lever for governance, resilience, and strategic management within organizations.

NIS2: A Directive That Changes the Scale

The European NIS2 Directive significantly expands the scope of affected organizations.

It now imposes stronger requirements in terms of:

• risk management;
• information systems security;
• incident management;
• business continuity;
• governance and executive accountability.

Beyond regulatory obligations, NIS2 encourages organizations to better understand their information systems and critical dependencies.

And this is precisely where compliance can become a management tool.

Moving from a Compliance Logic to a Control Logic

Many organizations still approach NIS2 as a documentation exercise:

• writing policies;
• producing procedures;
• preparing audits.

However, purely theoretical compliance does not truly protect the organization.

The goal is not only to demonstrate that measures exist, but also to ensure that they are effective, measurable, and integrated into daily operations.

A mature organization uses NIS2 to:

• map critical assets;
• identify sensitive dependencies;
• prioritize risks;
• improve visibility across the information system;
• strengthen response capabilities.

Compliance then becomes a structured framework for continuously managing cybersecurity.

Visibility: The Real Challenge

You cannot protect what you do not know.

In many organizations, IT assets remain poorly identified:

• forgotten servers;
• undocumented applications;
• unknown dependencies;
• unmonitored equipment.

This lack of visibility complicates:

• incident management;
• impact analysis;
• business continuity planning;
• vulnerability management.

NIS2 forces organizations to regain control over their digital environment.

This is why tools such as CMDBs, automated inventories, and monitoring solutions are becoming strategically important.

Governance and Accountability: A Cultural Shift

One of the major evolutions introduced by NIS2 concerns executive accountability.

Cybersecurity is no longer solely the responsibility of IT departments or technical teams. It is becoming a corporate governance issue.

This requires:

• stronger management involvement;
• clear and understandable indicators;
• risk-oriented dashboards;
• better coordination between IT, security, business teams, and leadership.

Organizations that successfully transform are those that create a shared culture around digital resilience.

Automation and Continuous Improvement

NIS2 compliance cannot rely solely on manual tasks.

Automation becomes essential to:

• keep inventories up to date;
• detect anomalies;
• track changes;
• centralize security events;
• accelerate impact analysis.

The most advanced organizations already use:

• automated discovery tools;
• ITSM platforms;
• SIEM solutions;
• AI-assisted analysis mechanisms.

The objective is not to multiply tools, but to build consistent and sustainable governance.

What Selection ICT Brings in Practice

At Selection ICT, we support organizations in their NIS2 compliance journey with a pragmatic and operational approach.

Our objective is to:

• transform regulatory requirements into concrete actions;
• improve visibility across the information system;
• structure IT and security processes;
• strengthen governance and operational resilience.

Because effective compliance should not be perceived as an administrative burden, but as an opportunity to sustainably improve the organization.

Conclusion

NIS2 marks a significant evolution in the way cybersecurity is approached.

Organizations that limit their approach to regulatory compliance alone will miss the bigger picture.

Those that use NIS2 as a management tool will gain:

• greater visibility;
• stronger resilience;
• better anticipation capabilities;
• higher operational maturity.

Compliance therefore becomes not an end goal, but a driver for continuous improvement and strategic governance.

Gustav Ahadji