Original Coverage & Source Attribution: kpmg.com
NIS2 readiness is rarely a one-step exercise. In most organizations, it unfolds across two closely linked dimensions: a governance and compliance track, and an operational and technical track. While distinct in focus, both must evolve together to ensure that regulatory expectations translate into real resilience.
The journey usually starts with a scoping and applicability assessment. Organizations must determine whether they qualify as essential or important entities and define the precise perimeter in scope. This step is critical, as it sets the boundaries for accountability, reporting, and supervisory oversight.
Once the scope is clear, a structured maturity assessment is performed against NIS2 requirements and, in Belgium, often against the CyberFundamentals framework. CyFun is aligned with internationally recognized standards such as the NIST Cybersecurity Framework and is structured around six core functions: Govern, Identify, Protect, Detect, Respond, and Recover. This alignment ensures that compliance efforts are not isolated exercises, but part of a broader, risk-based cybersecurity strategy. The gap analysis highlights strengths, weaknesses, and documentation gaps across governance, risk management, incident response, business continuity, and supply chain security. The output includes a compliance score and a clear, prioritized, action plan.
The next phase focuses on roadmap development. Regulatory requirements are translated into concrete actions, with defined owners, timelines, and expected evidence. This often includes formalizing cybersecurity governance structures, clarifying roles and responsibilities, strengthening incident handling procedures, improving third-party risk management, enhancing asset and vulnerability management, and aligning business continuity measures with both NIS2 and recognized best practices, such as ISO 27001.
Finally, the implementation phase operationalizes the roadmap. Policies are approved, processes are embedded into daily operations, reporting mechanisms are established, and progress is monitored through structured governance forums and periodic control reviews. The objective is to build sustainable, measurable control mechanisms that withstand supervisory scrutiny and support long term cyber resilience.
At KPMG, this structured and framework aligned approach allows organizations to move from uncertainty to clarity. By combining regulatory expertise, governance design, and operational cybersecurity experience, we help clients build realistic roadmaps that are aligned with legal requirements, supervisory expectations, and business constraints.
