Understanding and Meeting the Cybersecurity Requirements of the NIS2 Directive and IT Security Act 2.0

**Executive summary:** This solution brief explains the EU's NIS2 Directive and Germany's updated IT-Sicherheitsgesetz 2.0, highlighting expanded scope, stricter requirements and potential fines, and advises organisations—especially those with ICS/OT—to adopt five critical controls (ICS incident response planning, defensible architecture, network visibility and monitoring, secure remote access, and risk-based vulnerability management) to achieve compliance and improve cyber resilience.