NIS2 Directive

5 Months on from the NIS2 Directive: What has changed?

March 5, 2025

The introduction of the NIS2 Directive in October 2024 was a significant shift in Europe’s quest to strengthen its cybersecurity resilience. Designed to address the growing threats to critical infrastructure and essential services, the directive brought stricter compliance obligations and expanded the scope of organisations required to adhere to these rules.

Here are the key developments:

1. Increased Compliance Pressure

The directive has introduced new levels of accountability for organisations deemed critical to Europe’s economy and society. Businesses across sectors such as energy, healthcare, transport, and digital infrastructure are under significant pressure to meet tight deadlines and adhere to higher standards of cybersecurity.

This has been a wake-up call for many companies, particularly those previously outside the scope of such regulations. The challenge lies not only in understanding the directive but also in implementing measures to comply effectively. For some, this has meant overhauling their existing security protocols, while others have had to start from scratch.

2. The Growing Talent Gap

As organisations scramble to align with NIS2 requirements, the demand for skilled cybersecurity professionals has surged. The directive has highlighted a glaring issue in the industry: the cybersecurity talent gap. Many businesses are finding it increasingly difficult to source and retain professionals with the expertise needed to meet these new demands.

This talent shortage isn’t new, but the heightened urgency created by NIS2 has brought it into sharper focus. Companies are competing more fiercely than ever for top-tier talent, and the need for innovative solutions to bridge this gap has become critical.

3. Shifting Strategic Priorities

NIS2 has forced organisations to reassess their risk management strategies. Businesses are now placing greater emphasis on proactive measures, such as:

Conducting thorough risk assessments to identify vulnerabilities.
Investing in advanced technologies to detect and mitigate threats.
Building incident response plans to ensure rapid recovery from cyberattacks.

For many, these shifts have required significant investment—both in terms of resources and mindset. The directive has underscored the importance of treating cybersecurity not as a cost centre but as a core business priority.

Looking Ahead: The Road to Resilience

While progress has been made in the past 5 months, the journey is far from over. The full impact of the NIS2 Directive will unfold over the coming years as businesses continue to adapt and regulators begin enforcing compliance more rigorously.

For organisations, staying ahead in this evolving landscape means focusing on three critical areas:

Talent acquisition and retention: Finding the right people to drive cybersecurity initiatives.
Technological investment: Leveraging tools and platforms that enhance threat detection and response.
Cultural change: Embedding cybersecurity into the fabric of the organisation’s operations.