# NIS2 Is Not an IT Project: Why Businesses Need to Rethink Cybersecurity

> SwissGRC erklärt in diesem Artikel, warum NIS2 nicht mit der DSGVO vergleichbar ist und kein reines IT-Projekt darstellt. Er richtet sich an Organisationen im Anwendungsbereich der Richtlinie und zeigt, wie sie Cyberresilienz als Managementaufgabe verankern.

- URL: https://swissgrc.com/ar/nis2-is-not-an-it-project-why-businesses-need-to-rethink-cybersecurity/
- الناشر: SwissGRC®
- تاريخ النشر: 2026-05-06
- آخر تحديث: 2026-09-17

## معلومات أساسية

- The NIS2 Directive shifts the focus from documentation and evidence to effectiveness, resilience and operational stability.
- Under NIS2, senior management must approve security measures, oversee their execution and receive regular updates on the organisation's security posture, according to BSI guidance cited in the article.
- An estimated 30,000 companies in Germany alone fall under the new NIS2 requirements, far more than were previously regulated under KRITIS.
- NIS2 explicitly requires the management of supply chain risks, so organisations that are not directly regulated can also come under pressure from customers, partners and principals.
- The directive requires structured risk management, incident reporting processes, incident response capabilities, business continuity planning and supply chain risk consideration.
- SwissGRC argues that spreadsheets and isolated tools cannot keep up with dynamic risks and reporting obligations, and recommends integrated Governance, Risk and Compliance structures.

**When people talk about NIS2 today, one comparison comes up repeatedly: “This will be the GDPR of cybersecurity.” The comparison sounds logical, but it is misleading and pushes many organizations in the wrong direction.**

The [NIS2 Directive](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022L2555) is not simply a compliance regulation. It fundamentally changes how organisations must approach digital risk — shifting the focus away from documentation and towards resilience, operational stability, and accountability at the management level.

Many organisations underestimate precisely this distinction — and in doing so, risk not only regulatory consequences, but operational disruptions, reputational damage, and significant financial exposure. For a broader perspective on how this shift affects day-to-day governance work, see our article [When GRC Stopped Being Periodic and Became Everyday Work](https://swissgrc.com/en/when-grc-stopped-being-periodic-and-became-everyday-work/).

## Why the GDPR Comparison Falls Short

GDPR has established a well-worn playbook in many organisations — and that thinking runs deep:

| Criterion | GDPR Approach | NIS2 Requirement |
| --- | --- | --- |
| Focus | Documentation & evidence | Effectiveness & resilience |
| Goal | Pass the audit | Remain operational under attack |
| Accountability | Data Protection Officer | Senior management directly |
| Nature | Static documentation | Dynamic risk management |
| Response | React to requests | Actively report & manage incidents |

The focus shifts from "compliance" to "cyber resilience" — and that is not a gradual evolution, but a fundamental change of direction.

## NIS2 Makes Cybersecurity a Management Responsibility

One of the most significant changes introduced by NIS2 concerns the executive level. Cybersecurity can no longer be treated as the sole responsibility of the IT department. According to [BSI guidance on NIS2 implementation](https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/NIS2/NIS2_node.html), senior management must approve security measures, oversee their execution, and receive regular updates on the organisation's security posture.

This fundamentally reshapes [governance structures](https://swissgrc.com/en/risk-management-software/) across many organisations:

**Corporate Governance** Cyber risks become part of the strategic management agenda

**Strategic Relevance** Security decisions escalate to board level

**Personal Liability** Legal exposure for executives moves sharply into focus

**Budget & Priorities** Security investments are reassessed and reprioritised

**Resilience as a Competitive Advantage** Cyber strength becomes a measurable differentiator in the market

Cybersecurity is evolving from a technical discipline into a question of sound corporate governance.

## Mid-Market Companies Face Particular Pressure

Many organisations still assume that NIS2 applies exclusively to operators of critical infrastructure. The reality is considerably broader:

30,000

**companies in Germany alone** are estimated to fall under the new NIS2 requirements — far more than were previously regulated under KRITIS.
[Source: ENISA – NIS2 Overview](https://www.enisa.europa.eu/topics/cybersecurity-policy/nis-directive-new)

Affected organisations span a wide range of sectors:

Industry & Manufacturing Healthcare Logistics & Transport IT & Cloud Services Food Industry Energy Supply Digital Services

The Supply Chain Effect

Even organisations not directly regulated are coming under increasing pressure — because their customers, partners, and principals demand higher security standards. NIS2 explicitly requires the [management of supply chain risks](https://swissgrc.com/en/tprm-software/), extending its reach well beyond directly regulated entities. For a deeper look: [Rethinking Vendor Risk Management →](https://swissgrc.com/en/when-risk-enters-through-the-front-door-rethinking-vendor-risk-management/)

## The Real Problem: Lack of Visibility

In many organisations, IT infrastructure has grown organically over the years. Cloud solutions, external service providers, hybrid working models, and complex system landscapes create new dependencies — while a complete overview of the following is often absent:

- Which systems are business-critical?
- Where are the greatest risks and vulnerabilities?
- Who is responsible for what?
- Which third parties have access to sensitive data?
- What happens in an emergency — and who runs the response?

This is precisely where NIS2 intervenes. The directive demands organisational transformation — not merely the addition of individual security measures.

Concretely, the directive requires structured [risk management](https://swissgrc.com/en/risk-management-software/), incident reporting processes, incident response capabilities, business continuity planning, and supply chain risk consideration. The [BSI provides concrete implementation guidance](https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/NIS2/NIS2_node.html) to support organisations through this process.

---

## Why Spreadsheets and Siloed Tools Are Not Enough

Many organisations are still attempting to address NIS2 with spreadsheets, shared document folders, and isolated tools. The fundamental problem with this approach:

The Core Problem

Cyber resilience is **dynamic**. Risks shift continuously. Suppliers change. Vulnerabilities emerge daily. Reporting obligations demand speed and transparency — neither of which static documentation can deliver.

Organisations need [integrated Governance, Risk and Compliance structures](https://swissgrc.com/en/solutions/) that bring risks, measures, controls, processes, and accountabilities together in one place. Only then is it possible to:

- Continuously prioritise and manage risks
- Implement and track measures effectively
- Produce evidence at any time and in full
- Manage incidents efficiently and within required timeframes
- Meet regulatory requirements on an ongoing basis

## NIS2 Changes the Way Organisations Think About Cybersecurity

Perhaps the most important point is consistently overlooked in the debate: **NIS2 is not simply a regulatory burden.** The directive compels organisations to take a structured, honest look at their digital resilience — and that, in the long run, is precisely where the strategic advantage lies.

Organisations with strong cyber resilience benefit from:

- More stable operations
- Reduced risk of outages
- Greater trust from customers and partners
- Better insurability
- Stronger competitive positioning
- Higher regulatory certainty

According to the [ENISA Threat Landscape 2024](https://www.enisa.europa.eu/publications/enisa-threat-landscape-2024), the frequency and sophistication of cyberattacks targeting European organisations continue to rise. Cybersecurity is becoming an increasingly decisive factor in long-term enterprise value and future viability.

---

## Now Is the Right Time to Act

Many organisations are still waiting for full clarity on national transposition laws or specific regulatory guidance. That is a risky stance: the threat landscape evolves faster than regulatory processes — and the expectations of customers, partners, insurers, and supervisory authorities are rising continuously.

Rather than waiting for regulatory pressure to force action, organisations should move proactively. A practical starting point is the [NIS2 Readiness Check](https://nis2compliant.app) — it shows where your organisation stands in just a few minutes. Or speak directly with our experts in a [Discovery Call](https://swissgrc.com/en/discoverycall/):

1. Assess applicability — are you directly or indirectly regulated?
2. Define governance structures — who owns accountability internally?
3. Systematically evaluate risks — where are the critical gaps?
4. Establish processes — reporting channels, incident response, BCM
5. Clarify responsibilities — up to and including senior management
6. Anchor resilience strategically — as a permanent organisational objective

Because ultimately, NIS2 is not just about compliance. It is about an organisation's ability to remain operational — even under active digital attack.

## الأسئلة الشائعة

### Is NIS2 the GDPR of cybersecurity?

According to the article, the comparison is misleading. GDPR centres on documentation and evidence, while NIS2 requires effectiveness and resilience, which means remaining operational under attack and managing incidents actively.

### Who is responsible for NIS2 compliance in a company?

Senior management carries direct accountability. It must approve security measures, oversee their execution and receive regular updates on the security posture, so cybersecurity is no longer only an IT department matter.

### Does NIS2 only apply to operators of critical infrastructure?

No. The article states that the scope is considerably broader. In Germany alone an estimated 30,000 companies fall under NIS2, across sectors such as industry and manufacturing, healthcare, logistics, IT and cloud services, food, energy and digital services.

### Why are spreadsheets not enough for NIS2?

Cyber resilience is dynamic: risks shift, suppliers change and vulnerabilities emerge daily. Static documentation cannot deliver the speed and transparency that reporting obligations demand.

### What are the first steps to prepare for NIS2?

The article lists six steps: assess applicability, define governance structures, evaluate risks systematically, establish processes such as reporting channels, incident response and BCM, clarify responsibilities up to senior management, and anchor resilience strategically. A NIS2 Readiness Check is suggested as a starting point.