From the Lawyer: NIS2 in practice – common questions in 2025
Following the Danish implementation of the NIS2 Directive in July 2025, many companies are facing new and very specific questions. This article brings together the most common NIS2 questions and provides practical answers and recommendations focused on management accountability, risk assessments, cloud services, and vendor management.
Get access
With Denmark’s implementation of the NIS2 Directive, which entered into force on 1 July 2025, cybersecurity and information security have moved even higher up the management agenda in both private and public sector organisations. Although the requirements have been known for several years, the practical implementation of NIS2 continues to raise a wide range of questions, particularly regarding its scope, management accountability, risk assessments, and the management of vendors and cloud services.
NIS2 introduces significantly stricter requirements for organisations providing services that are critical to society. As a result, many organisations must now determine how to translate these regulatory requirements into practical measures.
Although the rules have been known for several years, the practical application of NIS2 continues to raise a wide range of questions
In this article, “NIS2 in practice – common questions in 2025”, we follow up on previous analyses and compile the most common questions being asked by organizations after the new rules came into effect. The article provides legal perspectives, practical interpretations, and concrete recommendations on how companies should work with NIS2 in day-to-day operations, with a particular focus on management’s role, vendor management, and understanding the societal purpose of NIS2.