Practitioner notes on how NIS2 actually lands — written against the text of the directive, with the article references in them.
Most incident response plans lose the first day of an article 23 deadline deciding whether the deadline has started. The directive is clearer than the confusion suggests — and the fix is a decision rule, not a faster escalation path.
7 min read
The organisations most exposed to NIS2 enforcement are not the ones with weak controls. They are the ones with strong controls that no management body has ever formally approved.
6 min read
Article 21(2)(d) reaches your direct suppliers, not the whole chain. The scope is narrower than most programmes assume, and the depth required within it is considerably greater.
8 min read
The security baseline of NIS2 is genuinely common across the Union. Almost everything you have to do administratively is not. Knowing which is which stops multinational programmes from being rebuilt 27 times.
7 min read