# What should a company do first to prepare for NIS2?

Find out whether and how you are in scope, then fix the gaps that would hurt most in a real incident. A practical order: confirm scope and category under your national law and register if required; name an owner at management level and brief the board on its duties; list your critical systems, data and suppliers; make sure you would notice an incident, through endpoint and network detection, and that someone receives the alerts; write a short incident-response and reporting procedure that meets the 24-hour, 72-hour and one-month stages of Article 23; test a restore from backups; switch on multi-factor authentication for e-mail, remote access and admin accounts; then work through the remaining Article 21 measures in a risk-based plan approved by management. NetSenX can cover the detection and deadline-tracking steps on every plan, Free included.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [NIS2 scope and duties](https://netsenx.com/en/faq/nis2) · https://netsenx.com/en/faq/what-should-a-company-do-first-to-prepare-for-nis2

## Read next

- https://netsenx.com/en/nis2-readiness
- https://netsenx.com/en/nis2-network-monitoring

## Related questions

- [How does a small or mid-sized company do a cyber risk assessment for NIS2?](https://netsenx.com/en/faq/how-do-smes-do-a-cyber-risk-assessment-for-nis2)
- [Has my country transposed NIS2 into national law yet?](https://netsenx.com/en/faq/has-my-country-transposed-nis2)
- [Does NIS2 require multi-factor authentication?](https://netsenx.com/en/faq/does-nis2-require-multi-factor-authentication)
- [Does NIS2 require encryption?](https://netsenx.com/en/faq/does-nis2-require-encryption)
- [Does NIS2 require backups and a business continuity plan?](https://netsenx.com/en/faq/does-nis2-require-backups-and-business-continuity)