NIS2 introduces strict reporting timelines, including early warning notifications within 24 hours, initial reports within 72 hours, and full reports within a month. Organisations must be prepared to gather, validate, and communicate information quickly under pressure.

Organisations need to confirm whether they are in scope, understand their classification (important vs essential entity), and align with national guidance. Immediate focus areas include supply chain management, documentation, and ensuring incident notification processes are defined, tested, and understood.

Supply chain security is one of the most complex areas under NIS2. Organisations must ensure that supplier controls align with their own and that contracts support incident response. Gaps in visibility, access to logs, and unclear responsibilities can significantly delay response and containment.

A major challenge under NIS2 is securing Operational Technology environments. Many organisations lack visibility and control over OT, and the integration with IT introduces new risks. Understanding connection points, governance, and incident response across both environments is now essential.

Many organisations assume they are prepared because they have backups, but untested recovery plans and unmanaged devices can lead to reinfection and prolonged disruption. At the same time, delayed reporting of incidents or mistakes increases impact. True resilience comes from regularly testing recovery processes and building a culture where employees report issues early, supported by awareness of both traditional and AI-driven threats.