Making NIS 2 reviews work in real life

Cybersecurity compliance is changing shape. Under the NIS 2 Directive, and through national implementations such as Italy’s ACN Determination 164179 (April 14, 2025), the focus shifts away from paperwork that looks good in a folder and toward security that keeps working when the environment changes. For many organizations, that difference is uncomfortable, because it turns compliance into an ongoing routine rather than a one-off project.

What makes this shift concrete is the expectation, reinforced by bodies such as the European Union Agency for Cybersecurity, that organizations can demonstrate continuous improvement rather than just document existence. In practice, that means revisiting policies, roles, and procedures on a schedule and also whenever real-world events force a rethink.

The cycle of resilience: why static compliance fails

For years, many compliance programs treated security documentation like a snapshot. A policy is written, signed, archived, and rarely read again. The problem is simple: the organization does not stay still. Threats evolve, systems change, suppliers come and go, and teams reorganize. A policy that made sense two years ago can quietly become misaligned with today’s risks, and misalignment is where incidents hide.

The ACN Determination explicitly tries to prevent that drift by requiring periodic reviews through two mechanisms. First, fixed deadlines establish recurring review cycles, such as annual reviews for security policies and biennial reviews for roles and responsibilities. Second, event-driven triggers require an immediate reassessment after significant incidents, regulatory changes, organizational shifts, or meaningful changes in threat exposure.

This two-track approach is meant to keep the program alive. Rather than treating compliance as a static framework, NIS 2 pushes organizations to build a system that can adapt when reality changes. The ACN points in the same direction by asking for reviews not only “because the calendar says so” but also when the security posture is shaken by a major incident or a structural change. In practical terms, that means turning “review” into a normal operational habit, not an exceptional event.

Roles and responsibilities: command clarity through periodic assessment

One of the easiest places for security programs to fail is not technology, but clarity. NIS 2 places weight on the periodic review of roles and responsibilities in cybersecurity governance. In the ACN operational requirements (for sub-category GV.RR-02 of the National Framework), organizations are expected to revisit their cybersecurity decision structure at least every two years, and also after significant incidents, reorganizations, or shifts in threat exposure.

The logic is straightforward: when something goes wrong, uncertainty wastes time. During a ransomware event at 3 AM, it must be obvious who can authorize containment actions, who coordinates communications, and who owns the follow-up. Many organizations try to solve this informally, but frameworks like ISO/IEC 27001 exist precisely to help formalize responsibility and accountability so incident decisions are not improvised.

The biennial review has a very practical purpose. It keeps accountability current as people change roles and reporting lines shift. It also checks whether the org chart matches real behavior: after a serious incident, teams often discover gaps, overlaps, or bottlenecks in their response chain. Even the strongest CISO cannot compensate for unclear decision rights.

Most importantly, the mandatory review signals that governance is operational, not ceremonial. If leadership can be asked to show that roles were reviewed, updated, and tested against reality, cybersecurity stops being “an IT matter” and becomes a management responsibility. That shift is quietly transformative, and it is one of the most underestimated aspects of NIS 2.

Annual policy reviews: strategic alignment in a dynamic landscape

While roles are reviewed biennially, NIS 2 is stricter on policies. The operational requirements implementing sub-category GV.PO-02 require the general cybersecurity risk management policy, and the related security policies, to be reviewed at least annually. They also must be updated promptly after regulatory changes, significant incidents, organizational changes, or shifts in threat exposure.

The point of the annual review is not to rewrite text for the sake of it. A policy is a strategic choice that captures risk appetite, priorities, and maturity. It sets boundaries, it guides spending, and it tells teams what “good” looks like. If those choices are not revisited, the policy turns into a relic, and relics do not manage risk.

Take a regulated business that wrote its 2023 policy with a heavy focus on traditional malware. A year later, supply chain compromises and highly targeted phishing may dominate the threat picture. An annual review forces the uncomfortable but useful question: do our controls and investments reflect what we actually face now? The answer can change quickly, especially as the wider EU cybersecurity agenda evolves through initiatives captured on the European Commission’s digital strategy.

The European Cyber Crisis Liaison Organisation Network emphasizes that effective policy governance requires not just periodic review but a systematic process for integrating lessons learned from incidents. When a significant security event occurs, it often reveals assumptions that proved incorrect, controls that failed to perform as expected, or gaps that were not previously recognized. An immediate policy review following such events ensures that these hard-won lessons are incorporated into the organization’s strategic framework rather than forgotten.

The NIS scheduler: operational infrastructure for compliance

Running annual, biennial, and event-driven reviews across a real organization takes more than willpower. It needs infrastructure. That is where a NIS compliance scheduler becomes useful: a simple, traceable mechanism that makes reviews predictable and prevents them from being postponed indefinitely. Many teams already do this informally in GRC tools, but NIS 2 pushes it from “nice to have” into operational necessity.

An effective NIS scheduler does two things well. It plans mandatory reviews by tracking when policies, roles, and other elements are due, including the work around the meeting itself, such as gathering evidence and collecting approvals. It also tracks extraordinary updates after incidents or major changes, so event-driven reviews happen quickly and leave an audit trail.

It also provides audit evidence. Supervisory bodies will not only ask whether policies exist but whether they are current, reviewed, and updated in response to events. A scheduler that records dates, owners, approvals, and changes turns “we do this” into something you can demonstrate, aligning with the broader compliance-and-assurance mindset also reflected in the NIST Cybersecurity Framework.

Finally, it helps coordinate across functions. Cybersecurity touches the Chief Information Security Officer, the Data Protection Officer, internal audit, legal, and executive leadership. A single review record reduces duplicated effort and makes it clear which decisions were taken, when, and by whom.

If the scheduler is treated as a calendar, the organization misses the point. The real value is building a maturity register that shows how the program evolves: what changed, what was learned, and what was improved. Over time, this becomes a practical narrative of continuous improvement, not just an administrative record.

From static documents to organizational culture

The most interesting effect of NIS 2 is cultural. Periodic reviews nudge organizations away from “security as paperwork” and toward “security as routine.” That difference matters because routine creates consistency, and consistency is what holds up under pressure.

Organizations that take the cycle seriously become more agile, because updates are expected and scheduled. They also become more aware, because teams regularly check whether controls match reality. And they become more responsive, because the habit of reviewing makes it easier to mobilize quickly when something breaks.

Organizations that treat reviews as a chore often look compliant until they are tested. Then they discover policies that do not match operations, roles that are unclear, and assumptions that aged badly. They fail not because they lacked documents but because they failed to keep those documents connected to real behavior.

The National Institute of Standards and Technology has long framed cybersecurity as a cycle of identifying, protecting, detecting, responding, and recovering. NIS 2 turns the same idea into a governance obligation. It is not about punishment, it is about building adaptive capacity so security does not lag behind the threat landscape.

Building a resilient future through continuous assessment

The underlying message of NIS 2 is practical: security cannot be “done” once and filed away. It is a process. Periodic reviews of policies, roles, and responsibilities create a forcing function that reduces complacency and keeps decisions aligned with the actual risk picture.

For organizations working toward compliance, the most helpful mindset is to treat reviews as part of normal operations. Policies and roles matter, but the real test is whether they are revisited, improved, and kept current. The scheduler, however humble, becomes the operational heart of that effort.

Organizations that embrace this approach build resilience, because they get used to changing course before they are forced to. Organizations that resist often end up with brittle compliance, impressive on paper but fragile in practice. Over time, the difference shows up in incident outcomes, and that is why the review cycle matters.

Security as a static compliance artifact is fading fast. The direction set by the NIS 2 directive is toward living governance: regular reassessment, clear ownership, and updates driven by what actually happens in the business. The organizations that adopt that rhythm early will find compliance easier, and they will be better prepared when the next disruption arrives.