Step 6. The goal must be to build an organization capable of continuing to evolve, not just complying with NIS2
During the previous steps, we have traveled a path that many organizations try to follow in a different order. First, we built governance; then we understood industrial operations; later, we developed capabilities to protect, detect, and respond; next, we learned to manage the risk introduced by the supply chain; and finally, we incorporated a model to objectively measure our evolution and decide where to improve.
Up to this point, we might think that the work is complete; however, all those capabilities share the same problem: over time, they degrade. People change roles, processes evolve, new technologies are introduced, suppliers change, and the organization grows as new threats emerge.
Decisions that were correct three years ago may no longer be correct today; that is why the challenge should not be to improve capabilities, but rather to ensure that the organization continues to develop them over the next ten years.
Complying with a regulation does not transform an organization
Many organizations approach NIS2 as a project with a budget, a schedule, and an end date. That approach may serve to pass an audit, but it will prove insufficient to protect industrial operations whose evolution never stops.
Resilience cannot depend on a project; instead, it must become part of an organization’s normal operation, because transformation does not end when implementation finishes—it actually begins on that day.
A management system is not documentation
There is another widespread idea that deserves to be re-examined: thinking that a management system is a collection of policies, procedures, and records. That merely describes the system; it is not the system itself.
A true management system is a mechanism capable of making the organization take better decisions every time its environment changes. If a new threat appears tomorrow, the system learns. If technology changes, the system adapts. If a new regulation emerges, the system evolves; and if an incident occurs, the system improves.
Documentation merely preserves knowledge, whereas a governance and management system, such as SG2CI, transforms that knowledge into decisions.
SG2CI integrates all capabilities into a single model
That is precisely the purpose of SG2CI: not to provide a collection of controls, a catalog of best practices, or an additional methodology.
Its objective is to integrate all the capabilities an organization needs to govern industrial cybersecurity within a single coherent system where governance guides decision-making.
The CCI Suite accelerates this transformation
To facilitate this process, SG2CI relies on the CCI Suite, where each platform develops a specific part of the system:
-
-
RECIN helps understand industrial architecture and design protection capabilities.
-
ESCIM enables training in detection, response, and recovery through cyber-incident scenarios.
-
CCI Catalog facilitates the management of the industrial ecosystem and the supply chain.
-
MACIN provides an objective evaluation of maturity and guides improvement priorities.
-
Together, these four platforms turn SG2CI into a living system capable of accompanying the organization’s evolution throughout its entire lifecycle, helping it learn faster.
How do you know if this sixth step has been achieved?
The answer is much simpler than it seems: it does not consist of having implemented all controls, obtaining a certification, or even passing an audit.
This sixth step will be achieved when the organization is capable of continuing to improve even if the consultant who implemented the project is gone, when capabilities continue to evolve, when Management remains involved, when decisions are adopted using the same criteria, and when every incident generates learning and every technological change strengthens the system instead of weakening it.
A final reflection
Approximately one and a half million years ago, our ancestors began making bifaces (hand axes). The extraordinary thing was not that first tool; what was truly astonishing was that humanity continued perfecting it for hundreds of thousands of years. Each generation learned from the previous one, each improvement was incorporated into collective knowledge, and each innovation became the starting point for the next.
That is how technological evolution was born, and industrial cybersecurity faces the exact same challenge today. It is not about implementing a technology or complying with a regulation; it is about building organizations capable of learning, adapting, and continuously transmitting that knowledge.
Resilience is not the outcome of a project; it is truly the consequence of building an organization that never stops evolving. NIS2 is the reason why many organizations will begin this journey, and resilience will be the reason why they will never stop traveling it.