Fractional For Reg Prep

NIS2 turned one client’s logging gap into a board-level problem inside a week.

It starts with a form. A large customer sends a security questionnaire with NIS2 in the subject line, and one question stops the room: can you show who accessed which dataset, and when.

The honest answer is often no. Logs exist in three systems, none of them joined, one quietly rotating every 14 days.

Then you spend a week deciding what has to be logged and where it lands, how long it stays, and who is allowed to read it. Those are architecture questions that happen to have a compliance deadline attached. Once they’re settled the pipeline work is ordinary.

The same logging work can support the questionnaire and improve the platform. That’s the version I push for. How much of it actually gets built usually depends on how close the deadline is.

The deadline belongs to your customer, which is what makes it real. In most of the companies I see, the questionnaire is the first time anyone tests whether the logs can answer the access question at all.

I do this as a fixed-scope Platform Review: current state, risks, 90-day plan. Book a call if that’s your quarter: https://app.cal.eu/thomasnys/30min?utm_source=linkedin&utm_content=2026-09-08-fractional-nis2-prep