NIS2 and the documentation burden on critical infrastructure

NIS2 obliges essential and important entities to document cyber risk management, supply chain security and incident handling, and to prove it on demand, with management personally accountable.

NIS2 turns cyber security into an evidence discipline for critical infrastructure, with documented risk management, supply chain oversight and incident records that regulators can inspect. We explain the duties and the sovereign, on premise way to meet them.

---

Originally published on mickai.co.uk. This is a cross-post; the canonical version, with the full body, footnotes and references, lives on the mickai.co.uk article page.