Here is the mistake I still see with NIS2. Too many organisations treat it like a policy exercise for the security team. That misses the real shift.

‍

‍

NIS2 puts management and leadership accountability front and centre. In practice, boards and senior leadership need to be able to answer three things:

1. Are we in scope, and as what kind of entity?
2. Do we have documented reporting paths for a serious incident?
3. Have we actually rehearsed those decisions before a live event happens?

The hard part is not the controls. It is knowing who needs to act, who needs to be notified, and how fast those decisions can happen under pressure. That matters because NIS2 incident notification runs on tight timelines: 24 hours for an early warning, 72 hours for an initial report, and 30 days for the final submission. Those windows do not move. If your leadership team has never walked through that process before an incident happens, the first time they do it will be during one.

Under NIS2, management bodies can face personal sanctions for failures in oversight, including temporary bans from management roles. That is not a theoretical risk sitting in a legal footnote. It is a direct consequence of treating compliance as a security team problem rather than a leadership obligation.

The questions leadership should stop asking: "Are we compliant?"

The questions they should start asking: "Who owns the risk? Who signs off on the decisions? And have we tested the reporting process end to end?"

NIS2 is governance under pressure. Not paperwork on a shelf.

Smarttech247 supports leadership teams with NIS2 readiness, including board briefings, tabletop exercises, and incident reporting preparation. Talk to our team.