6 October 2026 · armsec
NIS2: where should you start?
NIS2 broadens the scope of cybersecurity regulation in the EU. Here are the first five steps we recommend to every organisation.
NIS2 significantly expands which organisations are covered by EU cybersecurity rules, and it raises the bar for what is expected of them.
1. Find out if you are in scope
Start by mapping your sector, size and role in supply chains. Many organisations are indirectly affected through their customers.
2. Assign clear ownership
NIS2 makes management accountable. Make sure responsibility for cybersecurity is anchored at board level.
3. Perform a gap analysis
Compare your current controls against the requirements in Article 21 and prioritise based on risk.
4. Prepare for incident reporting
The reporting deadlines are short: an early warning within 24 hours. Make sure you have the processes and logging to meet them.
5. Secure your supply chain
Review your critical suppliers and the security requirements in your contracts.
Need help getting started? Get in touch.