NIS2 and security culture: Why measuring culture is now mandatory

Regulatory pressure as a driver of professionalization

Long-term data from the Security Awareness Radar (SAR) impressively confirms this correlation. During the 2019–2025period—precisely the phase in which NIS2, DORA, and related regulations gained traction—the proportion of insufficient security cultures dropped to just 13%, compared to 40% during the pioneering phase of 2004–2012.

The three eras of security culture identified in the SAR study illustrate this transformation:

TABLE

What NIS2 specifically requires

NIS2 sets forth explicit requirements for organizations in critical infrastructure sectors and beyond. These include, among other things:

• Training and awareness programs for all employees (Art. 21 of the NIS2 Directive)
• Evidence of incident management processes and reporting capabilities
• Governance structures that embed security at the executive level
• Regular review and evaluation of the effectiveness of security measures

Each of these requirements corresponds to one or more domains of the Security Awareness Radar: training, communication, organizational structure, leadership, and problem management. NIS2 is therefore not merely a technical set of rules—it is an implicit call for a measurable security culture.

Why measuring culture is now strategic

The key insight: What is not measured cannot be demonstrated. And what cannot be demonstrated does not count in the context of compliance. Measuring culture is the bridge between day-to-day security practices and regulatory compliance.

A standardized measurement tool like the Security Awareness Radar fulfills several functions at once:

• Assessment: Where does our organization stand today?
• Tracking progress: Are we moving in the right direction?
• Prioritization: Which areas require targeted interventions?
• Compliance evidence: Can we provide regulatory authorities and boards with reliable data?

From risk to control variable

The shift that NIS2 and related regulations are driving is ultimately a cultural one: security must evolve from reactive risk avoidance to an active control metric. This is precisely what the Security Culture Code describes—and for which data from 20 years of research provides the empirical foundation.

For decision-makers, this means that anyone who wants to be NIS2-compliant must not only embody a security culture but also be able to demonstrate it. Measurement is not the goal—it is the starting point for informed management.

You can request the full report on 20 years of SAR and the insights it provides HERE free of charge.