A year ago, I found myself hiking toward Everest Base Camp. The landscape changed gradually as we climbed. The air thinned, the pace slowed and small decisions mattered more. What seemed manageable at lower altitude felt very different above 4,000 metres.
Altitude does not announce itself loudly, it reveals itself slowly. You can be fit, prepared and experienced and still find yourself recalibrating.
As I reflect on the current state of NIS2 readiness across Europe, I cannot help but see the same pattern.
Only 17.5% of organisations believe they are already compliant with NIS2. Many expect to get there within the next year. Expectation is comforting. Compliance and therefore trust, however, is earned.
NIS2 is no longer a distant regulatory summit on the horizon. For most EU member states, it is now transposed or imminent. The air is thinner. The terrain is steeper. The sense of a grace period has faded. And yet, many organisations are still adjusting to the altitude.
One of the most striking findings in the research is that many organisations still struggle with approaching cyber risk as mandatory rather than optional.
“Almost a third of organisations still need to get over the hurdle of viewing cyber-risk management as recommended rather than mandatory.”
That sentence alone says a great deal.
For years, cyber investment has often been framed as best practice. Sensible. Advisable. Important. NIS2 reframes it as accountable. That change can feel subtle on paper, but in practice it is profound. It moves responsibility upward, places governance at the centre and asks boards to engage not just with reports but with oversight.
More than half of organisations are seeking compliance across multiple countries. For financial services firms operating cross border, this is where the climb becomes more technical.
Each jurisdiction interprets and supervises through its own lens. Requirements vary in emphasis, reporting nuance, and documentation expectations. The challenge is not simply meeting the directive. It is harmonising control frameworks in a way that can withstand scrutiny from multiple angles. That requires planning and patience.
Security modernisation is accelerating. Cloud security, data protection and AI risk management are all front of mind. But technology is not governance.
Less than one in ten organisations say their security modernisation strategy is fully aligned with business goals. That alignment is where real resilience lives. NIS2 is not asking organisations to buy more tools. It is asking them to demonstrate clear risk ownership, structured board oversight, documented policies that operate in practice, disciplined incident reporting, and accountable supply chain management. These are not features of software. They are features of governance.
Another statistic stayed with me. Among organisations that rate their NIS2 partner support as very high, almost half say they are already compliant. Where support is low, that number drops significantly.
Guidance matters. Not in a reactive sense, and not in a “call us when something breaks” sense. It matters in a structured, proactive and governance aware way. Compliance is rarely achieved in isolation. It is built through alignment between legal, risk, IT and board leadership.
As organisations continue this journey, I often suggest stepping back and asking: Have we genuinely mapped our existing control framework against NIS2 requirements, or have we assumed overlap? Is accountability clearly allocated at senior management level? Do we understand how our multi country obligations interact? Are our third-party oversight processes defensible under scrutiny? Have we integrated the controls into the wider governance and risk management of the organisation? If asked today, could we evidence our readiness?
These are not alarmist questions. They are grounding ones.
NIS2 is often framed as a compliance deadline, but I believe it is something more. Done properly, it strengthens organisational clarity, accountability structures, operational resilience and institutional trust.
The research shows progress and it also shows that many are still climbing. That is entirely understandable. Compliance journeys, like personal ones, are rarely linear. They require adjustment, recalibration and humility. With the right structure and support, however, the summit becomes less intimidating.
NIS2 is now live. The question is not whether organisations will reach compliance. It is how intentionally they choose to climb.
