Start with scope and applicability
The first question is whether the organisation, entity type and activities fall within the relevant national implementation of NIS2. Scope determines which duties apply, which entities must register and what governance needs to be demonstrable.
Management accountability is operational
Management should be able to approve, challenge and monitor cyber risk measures. Useful governance means knowing the major exposures, who owns them, what evidence supports the current position and what decisions require escalation.
Article 21 requires a control system, not isolated measures
Risk analysis, incident handling, business continuity, supply-chain security, vulnerability handling, access control and other measures need to work as one operating model. Control ownership and evidence should be explicit.
Incident reporting needs a prepared decision chain
Reporting deadlines are only manageable when the organisation has already defined what constitutes a significant incident, who assesses severity, who can escalate and who owns external communication. The reporting process should be rehearsed before an incident occurs.
Suppliers are part of the governance model
NIS2 places emphasis on supply-chain security. Organisations need a proportionate way to identify critical suppliers, define requirements, collect evidence, monitor material changes and escalate unacceptable exposure.