What should a company do first to prepare for NIS2?
Find out whether and how you are in scope, then fix the gaps that would hurt most in a real incident. A practical order: confirm scope and category under your national law and register if required; name an owner at management level and brief the board on its duties; list your critical systems, data and suppliers; make sure you would notice an incident, through endpoint and network detection, and that someone receives the alerts; write a short incident-response and reporting procedure that meets the 24-hour, 72-hour and one-month stages of Article 23; test a restore from backups; switch on multi-factor authentication for e-mail, remote access and admin accounts; then work through the remaining Article 21 measures in a risk-based plan approved by management. NetSenX can cover the detection and deadline-tracking steps on every plan, Free included.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.