Enterprises with 50 or more employees must establish information security management systems under NIS2, report incidents to authorities, and provide documented evidence of their measures.