Guide
NIS2: from obligation to resilient architecture
How requirements are translated into concrete technical controls and auditable documentation.
Marc Iridon · Updated · 7 min read
In brief
NIS2 obliges significantly more companies than before to maintain demonstrable information security risk management. What matters is not the amount of documentation, but that measures are technically effective and traceably evidenced.
Am I affected?
Whether a company falls under NIS2 depends mainly on sector, size and revenue. The binding assessment should be based on national implementation and, where appropriate, legal advice. Companies not directly affected often feel the requirements through their customers and supply chains.
From requirements to controls
The directive describes topic areas, not specific products. Translating them into your own environment is the real work.
- Access control and multi-factor authentication → Entra ID, Conditional Access, PIM
- Incident handling → Defender XDR, Sentinel, defined reporting channels
- Data protection and cryptography → Purview, encryption, classification
- Business continuity → backup concepts, recovery tests
- Supply chain security → assessing and controlling service provider access
A realistic roadmap
A risk-based approach has proven itself: first a gap analysis against the requirements, then prioritisation by risk and effort, then implementation in manageable packages. Each measure is documented so it can be explained to management, auditors and authorities.
The role of management
NIS2 explicitly holds leadership accountable. Understandable reporting on risks, progress and open items is therefore not optional but part of a viable implementation.