From IT challenge to business-critical issue

In a short space of time, cyber security has moved from being seen as a technical support function to becoming one of the most business-critical issues at leadership level. Cyber is no longer just an IT problem but a strategic matter that affects trust, business and relationships across the entire value chain.

NIS2 reinforces this development. The directive’s requirements emphasise the responsibility of the leadership to understand, approve and follow up on cyber security measures. It is not just about delegating security to IT, but about making cyber security an integrated part of governance, risk and compliance. For many organisations, this is exactly where the real challenge begins. Policies and documents can often be put in place relatively quickly, but turning them into a living operational capability demands more.

SOC as a practical bridge between requirements and day-to-day operations

A modern Security Operations Centre, SOC, is in practice the bridge that connects NIS2 requirements with day-to-day operations. An SOC is not a single product, but a way of orchestrating how threats are detected, analysed and handled.

Rather than starting with the technology stack, it is more effective to begin with three fundamental questions. What level of detection and response is required, based on the organisation’s risk profile and interpretation of NIS2. What resources already exist in-house in terms of time, competence and processes. And which parts need to be strengthened through collaboration with an external partner to close the gap between requirements and actual capability.

A key insight is that a genuine SOC capability in most cases only starts once the organisation has centralised logging and visibility across the entire environment, not just in individual endpoints. It is at that level that incident handling becomes systematic, traceable and possible to measure against the requirements for continuous monitoring and management in NIS2.

For many organisations, the next strategic question is how the SOC should be organised. Experience shows that it is rarely economically viable for organisations below a certain size to build their own 24/7 SOC with all the necessary expertise, particularly if they want to reach a higher level of maturity.

Nordic and European collaborations therefore gain an important role. By combining local advisory and technical competence with established European cyber defence capabilities, it becomes possible to reduce both risk and complexity through managed security services.

Start where you are – but build for maturity

A common reason why SOC initiatives drag on is that the ambition is too high from the outset. If the starting point is a large platform project with lengthy implementation plans, everything risks getting stuck in pre-studies and requirement lists, while the threat landscape continues to evolve.

There are other paths. In one concrete customer case, a large organisation had left an attractive offer from a global supplier in a drawer for a year. The need was obvious, but the time and resources required to deliver a major project were missing. By radically simplifying the set-up, the solution could be designed so that the customer only needed to set aside a few hours and still get an initial set of use cases into production.

This way of working points to a more sustainable model for NIS2-related security. A model where you start with the most important log sources and the most relevant scenarios, and choose a platform and a partner that can grow with your maturity. The focus shifts from designing the perfect end state to creating early value, establishing measurability and building from there.

Expectation management thus becomes a key issue. The organisation needs a shared answer to why it is investing in an SOC, what level of ambition is realistic initially, what internal effort is required during implementation and how the ongoing collaboration with a partner should work.

Awareness as an operational security capability

Many organisations already work with security training and phishing simulations. The key question is which purpose dominates. Is the programme mainly about fulfilling formal training requirements, or is it actively used to strengthen operational security capability.

In practice, most technical security solutions today are very good at generating logs that can strengthen a SIEM or SOC. The resource that is often overlooked is the employees themselves. Many forget that reports submitted by attentive users can become a highly valuable log source, provided they are captured and handled in the right way.

An effective awareness programme therefore needs to be seen as part of the incident chain rather than a standalone training initiative. Employees must have simple tools for reporting suspicious emails. There must be a function that quickly analyses and provides feedback, both to determine whether something is a real threat and to maintain the motivation to keep reporting. The organisation also needs to use reported phishing as input to strengthen detection rules and share concrete lessons back into the business.

When awareness is connected to the SOC in this way, a two-way flow emerges. The SOC strengthens its situational picture through human signals. Employees are strengthened in their role through rapid and clear feedback. In several Nordic environments, specialised phishing set-ups are used, where user reports are analysed, fed back and, when necessary, escalated to the security function or an external SOC partner.

The result is that awareness is no longer about producing polished training reports, but about building a concrete capability to see and handle attackers where many attacks in fact begin – in the inbox.

Test, exercise and make the value visible

To know whether your detection capability really holds up, you need more than dashboards. Organisations need to regularly test both the technical safeguards and the human processes. Penetration tests provide answers to where the layers of defence are weak and how attackers can get in. Practical exercises of incident flows show how quickly and how well-coordinated the organisation acts when something actually happens.

A positive side-effect of structured testing is that it becomes easier to demonstrate internally what the security investments actually deliver. When a CIO can show how an SOC detected and handled incidents in connection with a test, confidence in the work and the willingness to continue developing capability both increase. In the same way, the many everyday incidents that are stopped become proof that the organisation is not operating in ignorance, but handling threats at an early stage.

When tests, exercises and day-to-day incidents are woven into a continuous improvement cycle, NIS2 compliance becomes a natural consequence of how the organisation works, rather than a separate project.

European control and data sovereignty

Alongside the technical and procedural requirements of NIS2, another dimension is rapidly growing in importance. Questions about where data is stored, who has technical and legal control and which jurisdiction applies are becoming increasingly critical as geopolitical tensions rise and regulatory frameworks evolve.

Here, the choice of technology stack and partner is crucial. By building SOC and MDR solutions on European technology and with SOC operations based within the EU, it is possible to combine strong detection capability with robust data sovereignty. For organisations in sensitive sectors, solutions can also be deployed entirely on the customer’s premises, where the organisation itself owns the platform and the provider operates it as a managed service.

This offers the flexibility to meet both formal requirements and internal data policies, while taking advantage of the combined expertise of specialised SOC teams.

From compliance to continuous cyber capability

Ultimately, the most important shift in NIS2 work is about a change in perspective. Instead of seeing the directive as a checklist of obligations, it can be viewed as a framework for what a modern cyber capability should look like.

An SOC that ties together logging, monitoring, incident response and awareness.
Leadership that follows up on real capabilities rather than just documents.
A way of working where tests, incidents and lessons learnt are used to continuously develop detection and response capability.

With the right combination of technical solutions, clear governance and long-term partnerships, organisations can move from viewing NIS2 as a compliance problem to using the directive as a lever for building a robust, practical and sustainable cyber capability in day-to-day operations.

Ready to turn NIS2 requirements into practical cyber resilience? Let’s talk.