If your organization falls within the scope of the NIS2 legislation, you need to implement the required cybersecurity measures and be prepared for compliance inspections.
In this blog post, we will share with you a step-by-step implementation roadmap with practical recommendations to embark on your NIS2 compliance journey.
How to successfully meet NIS2 standards
When the competent authority comes to audit your organization under NIS2 compliance, they will be expecting you to fulfill a few main objectives:
- Risk management, which includes your processes to properly identify the risks your business runs and demonstrate that management complied with its obligation to be in control and take ownership of this risk assessment.
- Protection against cyberattacks, which consists of the measures you have implemented to limit your exposure to the risks identified and safeguard the cybersecurity of your IT and OT assets and networks.
- Detection of cybersecurity events, which concerns the measures you have implemented to monitor access to your systems – such as user authentication, access management, users’ privileges, audit logs, and so on – and discover potential incidents.
- Minimization of cybersecurity events, which refers to your processes for responding to cybersecurity events, notifying the authorities, and recovering from cyber incidents.
Below is a 10-step process to set yourself up for success in your NIS2 compliance program.
1. Scope assessment
Evaluate whether you fall within the scope of the NIS2 Directive and whether you qualify as an essential or important entity.
2. Asset audit and threat modeling
Gain a comprehensive understanding of your IT and OT environments, including the assets essential for delivering critical services to society.
An assets audit will give you a better idea of what systems you have, where they are located, who has access to them, and how they are protected. This inventory will provide you with the knowledge needed to assess the current state of your business’s cybersecurity and identify the risks to its assets, taking into account the unique threats specific to your business.
Only then can you proceed with threat modeling that best suits your situation. Threat modeling is the process of identifying potential cyberattacks that are likely to occur and understanding how hackers might attack you if they were to do so.
Where could cybercriminals infiltrate? What would they steal? And finally, how can you prevent it?
Ensure that all other resources and devices connected to your network, whose potential infiltration could spread and compromise assets that provide critical services, are also identified.
3. Risk Assessment
Evaluate your risk level. Your asset inventory will provide an initial picture of your cybersecurity status, based on which you can identify areas for improvement and determine the best approach to address gaps in your defenses.
Identifying your company’s specific risks will serve as your baseline for planning your cybersecurity journey.
When assessing your risks, consider your tolerance level for downtime and map out your priorities for maintaining operations and systems. These considerations will be the foundation for your business continuity, crisis management, and disaster recovery plans (detailed in step 5).
The Directive does not specify who should be responsible for performing the risk assessment in your company. It is up to you to identify the person or persons best suited for the job – your cybersecurity team, compliance department, system owners, or similar. What matters (and what the Directive explicitly requires) is that the risk assessment is signed off by management – as management needs to take ownership of the company’s risk analysis and risk appetite.
3.1 Supply chain due diligence
Include your supply chain in your risk assessment. For each of your suppliers and service providers, collect information on their security, taking into account the vulnerabilities specific to each related to their products and services.
This is especially important if you rely on critical ICT services, systems, or products, for which it’s recommended to use suppliers certified under European cybersecurity certification schemes.
Generally, the NIS2 Directive requires you to familiarize yourself with the security of your suppliers by conducting due diligence activities.
These activities can help you identify the critical assets your essential services depend on, the cybersecurity processes and practices they have in place, and how they manage vulnerabilities.
Based on these insights, you can assess whether your suppliers can be qualified as NIS2-compliant vendors and classify them based on the quality and resilience of the products they provide.
All this third-party information should then be fed into your risk assessment so that you can also describe how to handle the risks entailed and involve management, as they are the ones who need to approve such risk scenarios.
4. Cybersecurity measures implementation
Implement the required cybersecurity measures to prevent identified risks, protect your IT and OT assets from cybersecurity threats, and detect incidents if they occur.
When implementing cybersecurity measures, document the reasons behind your choices.
The Directive requires you to implement cryptography (and, where appropriate, encryption), HR security, access control policies, asset management, multi-factor authentication, etc. However, if you receive a visit from the authorities to inspect your organization, they won’t ask you if you configured firewalls and how; they won’t look for specific tools and features you have set up in your organization.
They will be looking for indicators of good practice, and they’ll be expecting you to let them in on your line of thinking, to be transparent, and to have reasonable explanations for each decision you have made in setting up your defense mechanisms.
So, you should be able to demonstrate your reasoning regarding the controls and measures you have (or have not) implemented.
5. Response plans creation
Establish response modalities to face attacks and minimize the impact of cybersecurity incidents.
Additionally, implement processes to minimize potential damage and recover affected operations to ensure business continuity.
To this end, you should begin with an impact analysis: determine which operations are mission-critical or time-sensitive and identify the potential impact a disaster could have on them.
This will enable you to properly prioritize the risks and define the order in which the operations should be re-established.
Restoration priorities should be based on criticality; business processes and vital functions with the highest financial and operational impact should be recovered first.
Moreover, you should identify the resources – including both technology and people – that support those mission-critical areas, as well as the resources and stakeholders whose support you’ll need to recover operations.
During a cyber incident, it is essential to know what assets are necessary to keep operations running smoothly (people, technology, records, utilities, and products), how long it will likely take to restore operations, and who will be in charge.
Your crisis plan should involve a coordinated response and utilize the skills of multiple relevant stakeholders across the business (not only your IT and OT teams, but also legal, customer service, operations, and anyone who will have to play a role in responding to the incident).
Establish a clear chain of command with well-defined processes and responsibilities to minimize the time from when a disaster occurs until the recovery process begins.
6. Reporting modalities setup
Set up procedures to fulfill your reporting obligations promptly so that, should a cyber incident occur, you can notify the authorities within 24 hours.
Additionally, if necessary, inform your customers (the recipients of the affected services) and, if appropriate, provide them with information on the cyber threat and the measures or remedies they can take to respond to it.
7. Staff training
Train your employees to identify risks, detect threats, protect assets, and respond to incidents.
Ensure that all relevant stakeholders are on board and aware of their responsibilities, the actions to perform at each stage, and where to find the answers needed.
8. Testing
Test the effectiveness of your responding modalities.
A plan cannot be considered complete and in place until there is proof that it will work as expected.
Roles and priorities need to be tested so that you can be confident in the plan when the time comes.
You should ensure that your employees are aware of their responsibilities and that the measures you have implemented are working as intended.
To this end, it’s recommended to conduct simulated disaster exercises to ensure the effectiveness of the plan and the employees’ readiness.
9. Periodic review
Ensure your response plans and your overall cybersecurity strategy are up to date.
Running tests periodically, at least once a year, will let you validate your recovery strategies and use lessons learned to make changes or updates as needed.
Additionally, you should ensure that you have taken into account multiple possible incident scenarios, as well as how potential changes in your resources (both technology and people) will impact the effectiveness of your crisis management plan.
10. Documentation and safe storage
Document all security measures, controls, and processes within policies on risk analysis and network and information systems security (acquisition, development, and maintenance), as well as plans for incident response, business continuity, backup management, crisis management, and disaster recovery.
Also, ensure their appropriate storage so that they are accessible in times of need.
For instance, consider the risk that the storage location of your recovery plans gets infected. How will you access them, then? Did you do a backup in an alternative cloud?
You could also consider printing them out, which would provide physical safeguards in case your entire IT infrastructure were affected.
Tips and easy wins
Regardless of whether you are new to the scope of the Directive, as a manufacturing organization, there might be some low-hanging fruit you can pick.
You will likely already have some of the required policies, processes, and measures in place.
So, a good starting point could be to review your existing setup with your compliance, QA, and security teams – i.e., analyze your current security program, incident response plan, safety measures, quality assurance program – and, more in general, the existing controls you have been using so far – to identify the potential gaps and assess how to move forward.
Besides, you might have been audited before to get an official certification of compliance with international standards such as the ISO 9000 family on quality management and assurance, the ISO 27000 series for your Information security management system (ISMS), or IEC 62443 for OT cybersecurity in automation and ICS.
Nothing stops you from reusing those existing attestations as a basis for your NIS2 compliance work.
Many of the controls and measures included in the mentioned standards can be adapted to the context of the new requirements and used to demonstrate how you ensure cybersecurity in your IT, OT, and IIoT systems and networks.
Again, as stated earlier, there is no right or wrong framework to use, nor will the authorities ask you to specify a particular one.
What they will want to know is why you have picked a certain control framework over another one, and you should be able to explain the reason behind your choices.
How Secomea helps you achieve NIS2 compiance
If you use Secomea for your secure remote access needs, you are already off to a great start when it comes to implementing technical cybersecurity measures.
If the authorities ask you how you protect your OT environments, for instance, you can mention that you chose to implement Secomea precisely because it is purpose-built for OT networks and devices, and list all the security features it offers.
To help you navigate the NIS2 legislation and prepare for NIS2 inspections, we have compiled this comprehensive whitepaper.
All you need to know to ensure NIS2 compliance
Download it now for free!
Is NIS2 already in effect in my country?
Although EU member states were required to implement the NIS2 Directive by 17 October 2024, progress has been uneven across the EU and EEA.
The whitepaper below provides a practical update on each country’s status as of mid-2025.
Can I follow these 10 steps to achieve compliance with the national NIS2 law adopted in my country?
Yes. Download the whitepaper to find out what your national law requirea, how obligations differ, and what industrial companies must do to comply.
NIS2 implementation progress across Europe
Download it now for free!
Frequently asked questions (FAQ)
How do you prepare for NIS2 compliance?
If your company falls under NIS2, you must implement cybersecurity measures and prepare for possible audits. Authorities will expect you to demonstrate:
Risk assessment and management ownership
Cyber protection for IT/OT infrastructure
Incident detection and response processes
Timely reporting and documentation
Follow our 10-step roadmap to build your compliance program.
How do you determine if NIS2 applies to you?
Start with a scope assessment:
Are you an essential or important entity?
Do you operate in a critical sector (Annex I or II)?
Do you meet the size or exception criteria?
Learn more in our article.
How do you audit assets and perform threat modeling?
Start by building a detailed inventory of your IT and OT assets – including where they are, who can access them, and how they interact. Then use that visibility to identify likely attack paths and critical vulnerabilities.
Make sure to include any connected systems that could act as gateways to core infrastructure.
How do you conduct an effective risk assessment?
Use your asset inventory to assess exposure, tolerance for downtime, and gaps in protection. This assessment becomes your baseline for compliance planning.
Ensure management reviews and approves the risk posture and any risk scenarios you identify.
How do you manage supply chain risks?
Include suppliers and service providers in your risk assessment.
Evaluate:
Their security posture and certifications
How critical they are to your services
How vulnerabilities in their products could impact your operations
Get leadership approval for how these third-party risks are categorized and handled.
How do you implement cybersecurity controls under NIS2?
You’ll need a mix of:
Technical controls (e.g. firewalls, MFA, secure remote access like Secomea)
Operational processes (e.g. detection, response, recovery)
Organizational measures (e.g. training, policies, governance)
Document your decisions and be ready to explain your rationale during audits.
How do you develop response and recovery plans?
Build your plans around business impact. Identify which operations must be restored first, who’s responsible, and what resources are needed.
Define a clear chain of command and include all relevant departments – not just IT and OT, but legal, comms, and operations.
What reporting processes should you have in place?
To meet NIS2 requirements:
Be ready to notify national CSIRTs within 24 hours of a major incident
Send an update within 72 hours
Submit a final report within 1 month
Inform affected customers if necessary
Set up internal processes now to act quickly when something happens.
How do you train staff for NIS2 compliance?
Everyone who plays a role in your cybersecurity program must be equipped to identify risks, follow procedures, and respond effectively.
Start by:
Defining who needs training (IT, OT, management, support staff)
Aligning training content with actual responsibilities
Including simulations or walk-throughs of potential incidents
Making training a recurring activity – not a one-off exercise
For leadership, training should cover risk ownership and strategic oversight. For technical staff, focus on real-world incident handling and detection.
Why should you test your incident response plan?
Testing your plans is the only way to know they’ll work under pressure. NIS2 expects you to move from theory to practice.
How can you test and validate your response capabilities?
Testing your plans is the only way to know they’ll work under pressure. NIS2 expects you to move from theory to practice.
Run simulated cyber incidents that:
Involve all relevant departments – not just IT
Follow the same timelines you’d face in a real event (24/72-hour reports)
Highlight weak points in coordination or communication
Use the results to refine responsibilities and close gaps
After each test, conduct a lessons-learned review and update your plans accordingly. Effective testing builds confidence – and proves to auditors that you’re prepared.
How often should you review and update your plans?
Review your response strategy at least once a year.
Revisit plans after:
Staff changes
Tech upgrades
New risk scenarios
Update documents as needed to keep them relevant and usable.
What documentation do you need, and where should it live?
Document everything:
Security policies
Risk assessments
Incident response and recovery plans
Store securely, with backups in case of system outages – even consider offline copies.
