# Rethinking cyber resilience through the lens of NIS2 > This Swiss GRC article explains how NIS2 moves cybersecurity from a compliance question to a resilience and governance question for organizations in Europe and Switzerland. It covers the 24-hour incident reporting duty, Swiss maturity data and the role of the GRC Toolbox. - URL: https://swissgrc.com/en/rethinking-cyber-resilience-through-the-lens-of-nis2/ - Publisher: SwissGRC® - Published: 2025-11-06 - Last updated: 2026-09-17 ## Key facts - NIS2 sets obligations for risk management, supply chain oversight and incident reporting within 24 hours of detection. - NIS1 was introduced in 2016 as the European Union's first attempt to harmonize network and information security standards. - In Switzerland, comparable reporting duties took effect on April 1, 2025, under the revised Information Security Act. - Organizations that fail to report major cyber incidents to the Federal Office for Cybersecurity (BACS) risk fines of up to CHF 100,000. - The Kessler study Cyber Message 2025 gives Swiss industrial firms a resilience score of 2.71 and service providers such as IT and financial institutions 2.91 on a four-point scale, both above EU averages. - The GRC Toolbox from Swiss GRC brings governance, risk and compliance together in one environment to document controls, track incidents and demonstrate regulatory alignment. **As the NIS2 Directive continues to shape Europe’s digital security landscape, the conversation around cybersecurity is evolving. What began with NIS1 in 2016, the European Union’s first attempt to harmonize network and information security standards, has now matured into a far more comprehensive framework.** With NIS2, the EU has not only expanded the scope of its regulation but also raised expectations for governance, accountability, and resilience. What started as a policy response to fragmented cybersecurity practices has become a driving force for cultural and structural change, pushing organizations to link digital risk with leadership and long-term sustainability. A continental shift in cyber governance The rollout of [NIS2](https://digital-strategy.ec.europa.eu/en/policies/nis2-directive) across the European Union has redefined what it means to operate securely in a connected world. It sets clear obligations for risk management, supply chain oversight, and incident reporting—within just 24 hours of detection. That benchmark now resonates beyond the EU. In [Switzerland](https://www.handelszeitung.ch/insurance/neue-meldepflichten-setzen-schweizer-unternehmen-unter-druck-877416), comparable reporting duties came into effect on April 1, 2025, under the revised Information Security Act. Organizations failing to report major cyber incidents to the Federal Office for Cybersecurity (BACS) risk fines of up to CHF 100,000. As *Handelszeitung’s* [HZ Insurance](https://www.handelszeitung.ch/insurance/neue-meldepflichten-setzen-schweizer-unternehmen-unter-druck-877416) recently noted, Switzerland’s move reflects a wider European alignment. Cyber threats know no border, and neither can the frameworks designed to manage them. Whether through NIS2 or national equivalents, Europe is converging on a shared model of cyber accountability where resilience is a collective responsibility. Measuring maturity and closing the gaps A new study by **Kessler**, *Cyber Message 2025*, provides a timely snapshot of cyber maturity. Swiss organizations continue to perform well: industrial firms achieved a resilience score of **2.71**, while service providers such as IT and financial institutions reached **2.91** on a four-point scale—both above EU averages. Yet the data also highlight persistent gaps. Many companies still rely on manual reporting processes, fragmented governance, and inconsistent incident response protocols. The 24-hour reporting rule, central to both NIS2 and Swiss law, has become a real-world test of coordination and operational readiness. NIS2’s significance lies not in the regulatory text itself but in the shift it represents. Cybersecurity has moved from the server room to the boardroom. The question has changed from *“Are we compliant?”* to *“Are we resilient?”* Across Europe, forward-thinking organizations are taking this moment to connect cybersecurity with governance, enterprise risk, and business continuity. Rather than treating NIS2 as a compliance checklist, they view it as a catalyst for stronger processes, clearer accountability, and greater trust with stakeholders. Technology as an enabler, not a shortcut Meeting these expectations requires structure and visibility. The [**GRC Toolbox**](https://swissgrc.com/en/network-information-security-directive-nis2/) supports organizations in operationalizing the principles of NIS2 and comparable frameworks such as Switzerland’s Information Security Act. It brings governance, risk, and compliance together in one environment, helping companies document controls, track incidents, and demonstrate regulatory alignment efficiently. Technology alone cannot create resilience, but it can make it achievable. In a landscape where cyberattacks unfold across sectors and borders within hours, the ability to respond quickly and coherently is what defines real strength. From **NIS1 to NIS2**, Europe’s cybersecurity evolution tells a clear story: resilience is not built through technology alone, but through shared responsibility and leadership. The next phase will be defined not by who complies first, but by who leads best. The organizations that turn frameworks like NIS2 into everyday governance, anticipate risk, and recover stronger when disruptions occur. 👉 [Learn more about achieving NIS2 compliance with the GRC Toolbox](https://swissgrc.com/en/network-information-security-directive-nis2/) ## Frequently asked questions ### Within what time must cyber incidents be reported under NIS2? NIS2 requires incident reporting within 24 hours of detection. The article calls this rule central to both NIS2 and Swiss law. ### Does Switzerland have reporting duties similar to NIS2? Yes. Comparable reporting duties came into effect on April 1, 2025, under the revised Information Security Act. Major cyber incidents must be reported to the Federal Office for Cybersecurity (BACS). ### What fine applies in Switzerland for not reporting a cyber incident? Organizations that fail to report major cyber incidents to the BACS risk fines of up to CHF 100,000. ### Which weaknesses do many companies still show in cyber resilience? According to the article, many companies still rely on manual reporting processes, fragmented governance and inconsistent incident response protocols. ### How does the GRC Toolbox support NIS2 compliance? The GRC Toolbox helps organizations put NIS2 principles and comparable frameworks such as Switzerland's Information Security Act into practice. It helps document controls, track incidents and demonstrate regulatory alignment in one environment.