In brief: An Eco survey shows that eight months after NIS2 came into force, documentation obligations, reporting deadlines and risk management are the main factors slowing companies’ implementation efforts.
Eight months after the NIS2 Directive took effect, many companies are still struggling with its practical implementation. A survey by industry association Eco identifies documentation obligations, reporting processes and risk management as the biggest operational hurdles.
The Eco association surveyed companies on the status of their NIS2 implementation and found that significant practical difficulties persist eight months after the directive came into force. Respondents named three areas as particularly demanding: evidence and documentation requirements, compliance with reporting deadlines for security incidents, and the establishment of functioning risk management.
For CISOs, this sharpens a familiar tension: NIS2 requires not only technical protective measures but also robust, auditable processes. Anyone who fails to meet incident reporting deadlines or cannot fully document evidence risks regulatory consequences, regardless of whether the actual security posture of the organisation is adequate. The survey results suggest that many organisations are failing at the organisational and documentary level of implementation, not primarily due to a lack of technical competence.
In practice, this means priority should not be placed solely on new security tools, but on clearly defined, repeatable processes for reporting channels, evidence documentation and risk assessment. CISOs should check whether their existing incident response procedures can realistically meet the required reporting deadlines and whether documentation is structured so that it can be presented during an audit without significant additional effort.
Source: www.security-insider.de · Published 19 August 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.