 | If the original NIS Directive was the opening act, NIS2 is the blockbuster sequel - with higher stakes, a broader perspective and a much bigger role for business leaders. |
Adopted in July 2016, the first NIS Directive introduced a common European approach to cybersecurity for certain operators of essential services and digital service providers. In December 2022, NIS2 raised the bar. It expanded the scope of covered entities, strengthened cybersecurity risk-management and incident-reporting requirements, and reinforced accountability at the highest levels of organisations. But its impact goes beyond adding new security measures: it challenges organizations to rethink how cybersecurity risks are understood, prioritised and addressed. In this sequel, cybersecurity is no longer just a technical concern - it is a strategic business priority.
From protecting critical assets to protecting what matters most to the business.
Organisations have traditionally approached cybersecurity by identifying and protecting IT assets, applications and infrastructure, assessing their vulnerabilities and implementing controls to reduce risk. This remains essential. However, NIS2 reinforces the importance of connecting this technical view to a broader understanding of business processes, the services organisations provide and the consequences a cyber incident could have on their operations.
In our discussions with organisations, we often hear two recurring challenges: identifying which business processes are truly critical, and understanding how a cyber incident affecting them could disrupt operations. By connecting technical risks to their potential business impacts, rather than discussing controls in isolation, organisations can make the stakes clearer and cybersecurity priorities more meaningful to decision-makers. We have repeatedly received positive feedback from business leaders on this business-oriented approach. Ultimately, it helps organisations build a cybersecurity strategy driven by business risk, with priorities and measures validated by top management.
But are decision-makers ready to take the lead?
The stakes associated with NIS2 are not always fully understood at management level: the potential operational and financial consequences of a cyber incident, reputational damage, disruption to essential services, regulatory exposure and the need to make difficult decisions under pressure. How much cybersecurity risk is the organisation willing to accept? Which decisions should be escalated to top management?
This is precisely why NIS2 requires members of management bodies to undergo cybersecurity training. At Sopra Steria, our experts support top management in understanding these challenges, assessing the implications of cyber risks and strengthening their ability to make informed decisions. The goal is not to turn executives into cybersecurity specialists, but to equip them to challenge assumptions, set priorities, approve appropriate measures and steer a strategy aligned with the organisation’s risk exposure.
And speaking of decisions, do you know what the word “crisis” originally meant?
Derived from the ancient Greek krísis, meaning judgment or decision, the word was used in medicine to describe a critical turning point in the course of an illness - a moment when a decision could make all the difference. A crisis is therefore not simply a moment of danger; it is a moment when decisions can no longer wait and inaction can make things worse.
Imagine a ransomware attack that forces an organisation to shut down critical systems. Management may need to decide which services to restore first, how to balance operational urgency with security checks, and when to communicate with affected stakeholders. These decisions show why crisis preparedness goes beyond technical response plans: it also depends on clear responsibilities, agreed priorities and the ability to act under pressure.
So, where should organisations start?
First, identify and prioritise critical business processes, including the services and dependencies they rely on. Then connect technical risk assessments to potential business impacts so that investment and risk-treatment decisions reflect what matters most. Finally, clarify decision-making and escalation responsibilities, and help management prepare through appropriate cybersecurity training and crisis exercises.
At Sopra Steria, we help organisations assess their NIS2 maturity, develop risk-driven cybersecurity strategies and prepare management to make informed decisions. Because the real test of a cybersecurity strategy is not only how well an organisation prevents incidents, but how effectively it responds when a major incident strikes despite its best efforts.