Pause your NIS2 project, if management does not own it

We see it repeatedly, that NIS2 work gets handed to IT or information security departments while management becomes a stakeholder instead of an owner, if even represented in the project. That’s the wrong foundation. 

In many organizations, the people responsible for delivering the project are not the people responsible for making the relevant decisions that determine whether it will succeed or not. 

NIS2 is not just an IT compliance exercise. The directive requires management bodies to be sufficiently trained in order to gain sufficient knowledge and skills to identify risks and assess cybersecurity risk-management, as well as approving the relevant cybersecurity risk-management measures and oversee their implementation. In Denmark, the NIS2 Act reflects the same principle. Management can no longer simply delegate responsibility to IT and expect a project team to secure compliance. Management bodies can be held liable for infringements of NIS2 directive. 

IT and security can identify gaps, assess risks, propose controls, and drive implementation, but they cannot do is make cybersecurity a business priority. They cannot decide how much risk the organization will accept, which initiatives deserve priority, or whether sufficient resources should be allocated. Those are management responsibilities and subsequently decisions to make. 

Every organization has priorities, and NIS2 is competing with them 

This tension surfaces when a NIS2 program competes with normal operations. A gap assessment might reveal that supplier management needs strengthening, incident response requires testing, access controls need improvement, or business continuity must be formalized. None of these are free. They demand people, time, and funding in budgets. 

When resources fall short, the instinct is to quietly reduce scope or let deadlines slip. Resist that temptation. Escalate the issue and make it explicit: here are the identified risks, here are the required actions, and here’s what the organization can realistically deliver with current resources. Management then decides. 

NIS2 programs rarely fail because the security team lacks competence. More often, they fail because the organization has not made a genuine decision to prioritize the work. If everyone is busy with five other strategic initiatives, cybersecurity will inevitably struggle for attention. That is not a project issue. It is a management decision. 

That decision might be to allocate more resources, accept a slower remediation timeline, accept specific residual risks where legally defensible, or reprioritize other work. What should never happen is leaving the NIS2 team holding accountability without the authority and resources to needed to deliver. 

Don’t confuse activity with progress 

Sometimes, pausing the program is actually the more responsible choice, not because NIS2 can be ignored, but because a pause forces a governance decision and exposes the lack of mandate or resources. It forces an honest conversation about priorities, ownership, and resource allocation. Continuing to produce policies, spreadsheets, and status reports while cyber risk management stays unchanged creates the illusion of progress. It builds very little actual resilience. 

A successful NIS2 journey therefore starts with a few straightforward questions, that we always ask: Does management actively own the risks, priorities, and decisions? Are management bodies represented or in any way involved in the sponsorship and steering committee of the NIS2 work? 

If the answer is no, that’s the first gap to close.