5 Steps to Control and Accountability (NIS2 Guide)
Part 1 of our NIS2 and Cybersecurity Act guide: Five steps to take control of your cybersecurity work, simplify governance, and clarify responsibilities.
The Cybersecurity Act establishes clearer requirements for how organizations must approach cybersecurity. For many, these requirements feel both extensive and difficult to translate into day-to-day operations. What actually needs to be in place, and where do you start?
This guide addresses the most common challenges and outlines five steps to gain better control over your cybersecurity efforts.
1. Clarify accountability
Challenge:
Many organizations work on cybersecurity without clearly defining who owns the overall responsibility. These issues often fall to IT, and the business assumes security is therefore handled. But when responsibility, authority, and decision-making paths don't align, security work becomes fragmented, and the gaps that emerge create major problems when quick decisions are needed.
Solution:
The Cybersecurity Act requires that responsibility is clearly anchored in the organization. A first step is to clarify who owns the systems, who has the authority to make decisions, and who is accountable when something happens. When responsibility is clear, it becomes possible to work systematically and strategically on security.
Here's your complete guide in a shareable PDF.
2. Understand where you stand
Challenge:
A common difficulty is not knowing where the organization actually stands. Many know there are gaps but find security work complex and difficult to grasp. The result is fumbling between different measures without a shared understanding of the current state.
Solution:
Rather than trying to fix everything at once, start by creating an honest assessment of where you are. This isn't about identifying everything that's missing, but about understanding which assets are most critical, which risks are real, and what's already working. A shared understanding of the current state makes it possible to prioritize effectively.
3. Focus on what matters most
Challenge:
When the threat landscape feels extensive and constantly changing, it's easy for everything to seem equally important. This can create a sense of paralysis about what actually needs to be done. It often leads to reactive decisions, where measures are taken without clear connection to the organization's actual risks and needs.
Solution:
The Cybersecurity Act is built on a risk-based approach. This means measures should be proportionate and justified based on the organization's circumstances. By working risk-based, you can focus resources where they make the greatest impact, rather than trying to do everything at once.
4. From point initiatives to capability
Challenge:
Security work is often driven through projects or point initiatives. New tools are implemented, procedures are developed, and initiatives are launched, but after a while the work loses momentum and structure. Security becomes something done occasionally, rather than part of everyday operations.
Solution:
The law requires a continuous approach. Rather than thinking in projects, security needs to be seen as a capability built over time. This means the work is monitored, adjusted, and developed as the organization changes. Capability beats initiative – every time.
5. Start where you are
Challenge:
Many find the requirements in the Cybersecurity Act substantial and difficult to tackle. The ambition exists, but the scope can create stress and inaction. When everything feels overwhelming, the risk is not getting started at all.
Solution:
The Cybersecurity Act doesn't require perfection, but it does require direction and progress. The most important step is often to start where you are today. With the right structure, you can build security work step by step, without creating unnecessary burden on the organization.