Explain it to me like I'm 5: Why does NIS2 matter?

Yet it affects many of the services we use every day, from electricity and public transport to hospitals and cloud services. 

To understand NIS2, think about all the things society depends on to keep running smoothly. If a cyberattack were to disrupt a hospital's systems, knock an energy provider offline or take down a major digital service, the impact would be felt by thousands, sometimes millions, of people. 

NIS2 is designed to reduce that risk. 

As a Governance, Risk & Compliance (GRC) Consultant at Sopra Steria, Arne Putzeys works on NIS2 projects helping organisations understand what NIS2 means in practice and how they can strengthen their cybersecurity to meet its requirements. 

Arne is a GRC consultant within the Cybersecurity Business Line. He is currently part of a project team delivering NIS2 expertise for a large public entity. 

"We look at where an organisation stands today, identify gaps and then create a roadmap that helps them improve their maturity over time," says Arne. 

Through workshops and stakeholder discussions, Arne helps the organisation understand its current cybersecurity maturity, identify areas for improvement and prioritise actions. By assessing existing controls, risk management practices and operating processes against NIS2 requirements and industry best practices, the team develops a pragmatic roadmap to strengthen resilience over time. 

One of the key principles behind NIS2 is continuous improvement. "NIS2 is not a one-time project with a fixed end date. Organisations need to continuously assess risks, adapt to new threats and keep improving their cybersecurity capabilities."