5 steps to get started with the Cybersecurity Act (NIS2 Guide)
Part 3 of our NIS2 and cybersecurity law guide: Five steps to get started with the cybersecurity law in a manageable and sustainable way.
The Cybersecurity Act introduces new and clearer requirements for how organizations must approach security. For many, it feels both extensive and difficult to translate into practical action. Where should you start? What needs to be in place immediately, and what can come later?
The law doesn't require perfection from day one, but it does require direction, structure, and the ability to demonstrate how the work is conducted and monitored. Here are five steps to help you get started in a way that's both manageable and sustainable.
1. Create a shared understanding of responsibility
Challenge:
A common obstacle is viewing cybersecurity as an IT issue. When responsibility, authority, and ownership are unclear, the work becomes fragmented and dependent on specific individuals.
Approach:
Start by clarifying who is responsible for what – in the business, in IT, and in leadership. This isn't about shifting responsibility, but about making it visible. Who owns the risks? Who makes decisions when something happens? And who ensures that measures are actually implemented? When responsibility is clear, it also creates better conditions for dialogue between the business and IT, where security becomes a shared concern rather than a technical support function.
Here's everything in one shareable PDF.
2. Start with risk, not checklists
Challenge:
Many try to interpret the law by checking off requirements or comparing themselves to others. This often leads to misplaced priorities and unnecessary complexity.
Approach:
Start with your own business and its reality. Which systems are most business-critical? What happens if they go down? What dependencies exist – internally and externally? When the risk picture becomes clear, it's also easier to prioritize the right measures and explain why certain efforts are more important than others.
3. Focus on capability, not just documentation
Challenge:
Policies and guidelines are created but not used. They exist on paper but don't help when something actually happens.
Approach:
Make sure your processes work in practice. This means simple, familiar, and relevant procedures that people understand and can follow, even under stress. Test them, discuss them, and adjust them as needed. Documentation should support action, not replace it.
4. Build the ability to detect and handle incidents
Challenge:
Organizations discover incidents too late, or are uncertain about who should act when something occurs. This leads to valuable time lost in uncertainty.
Approach:
Create clarity around how deviations are captured, who assesses severity, and how escalation should occur. Knowledge of how to respond needs to exist with the right people, not be concentrated among a few. When roles, contact paths, and decision-making authority are clear, you can act quickly and in a coordinated manner, even under pressure.
5. Start where you are – and build from there
Challenge:
The ambition to "do everything right" risks becoming an obstacle. Work gets postponed while waiting for the perfect approach.
Approach:
Accept your current state and take the next reasonable step. Cybersecurity is continuous work, not a project with an end date. What matters is being able to demonstrate awareness, direction, and improvement over time.