NIS2: What impact will the new directive have on companies?

Who does NIS2 apply to?

The directive now covers a much broader range of organizations than before. Typically, these include:

• medium and large companies in selected sectors
• organizations with a key role in the supply chain
• companies working with sensitive data or critical infrastructure

In practice, this means it may also apply to companies that have not previously addressed cybersecurity in a structured way.

What changes can companies expect?

NIS2 introduces specific requirements for security and operational management. Key areas include:

• risk management and security measures
• access and identity management
• incident monitoring and response
• business continuity

The focus is on a systematic, company-wide approach rather than isolated technical solutions.

What does this mean in practice?

From a day-to-day perspective, this is not just about IT.

NIS2 affects everyday business operations, including:

• who has access to what
• how changes are managed
• where and how data is created and stored
• how quickly the company can respond to incidents

What this means for your company (quick summary)

In reality, companies most often struggle with:

• fragmented data across multiple systems
• unclear access rights and permissions
• missing or insufficient audit trails
• lack of real visibility into operations

 These are exactly the areas NIS2 focuses on.

What are the risks of non-compliance?

The directive also introduces penalties for failing to meet requirements.

This is not only about fines. Risks also include operational disruption, reputational damage, and management liability.

How to prepare for NIS2

The first step is understanding your current situation and identifying weak points.

Recommended approach:

1. assess whether NIS2 applies to your company
2. map processes and data flows
3. evaluate risks
4. define access control and responsibilities

How Essence can help

In practice, a key factor is how companies work with data and how accessible it is in real time.

ERP systems such as Microsoft Dynamics 365 Business Central enable:

• centralized data management
• controlled access and permissions
• process tracking and visibility
• full audit trail

These capabilities directly support NIS2 requirements in practice.

What we recommend as a next step

If you are evaluating your readiness for NIS2, start with a quick assessment of your current state and risks.