"Yet another new regulation. As if we had nothing better to do."

This is the most common reaction we hear when NIS2 or FINMA requirements come to the table. Understandable. More paperwork, more audits, more costs.

But here's the thing...

The requirements set by these regulations? You need them anyway. Identify critical processes. Prepare incident response. Manage supply chain risks. These are not compliance exercises – these are fundamentals of operational resilience.

The regulation just gives you the structure. And an external deadline.

The Change in Perspective

Old Perspective: Compliance = Costs. Effort. Bureaucracy. Satisfy the auditor. Check it off. Forget about it.

New Perspective: Compliance = Checklist for operational capabilities you need anyway. With the bonus: Legal certainty and competitive advantage.

The difference is not in the activities – they are often the same. The difference is in the mindset.

If you approach NIS2 as an "annoying duty," you get minimal compliance and no operational benefit. If you approach NIS2 as a "structure for resilience," you get both.

What NIS2 and FINMA Really Demand

Let's go through the essential requirements – and see what they mean for operational resilience.

NIS2: The Most Important Requirements

FINMA: Operational Resilience for the Financial Sector

Swiss KRITIS-G (from October 2025)

How to Turn Compliance Into Resilience

Here's the practical part: How do you map regulatory requirements onto your resilience framework?

Step 1: Create a Compliance Mapping

For each regulatory requirement, ask yourself:

• Which resilience dimension does it address?

• Have we already covered this?

• If yes: Where is the proof?

• If no: What do we need to do?

Example Compliance Mapping Matrix:

Step 2: Leverage Synergies

The beauty of this approach: many requirements overlap.

Example:

• NIS2 requires "Identification of Critical Services"

• FINMA requires "Identify Critical Functions"

• ISO 27001 requires "Asset Management with Protection Needs Assessment"

This is the same exercise three times. With a good Business Impact Analysis, you cover all three.

Instead of creating separate documentation for each regulator, create an integrated resilience framework – and map it to the various requirements.

Step 3: Build Proof Structure

Regulation also means: You must be able to prove what you do.

What you should document:

Tip: Keep the documentation up-to-date. An outdated BC plan is worse than none during an audit – because it shows you're not taking the topic seriously.

The Competitive Advantage

Compliance as a competitive advantage? Yes, really.

1. Customer Trust

If you can show an enterprise customer that you are NIS2-compliant and conduct regular BC tests, you are more credible than the competitor who cannot.

Especially in enterprise segment tenders, resilience proofs are increasingly requested.

2. Insurance Conditions

Cyber insurance is becoming more expensive and restrictive. But: Insurers offer better conditions for companies with demonstrable resilience measures.

We've seen cases where the premium savings exceed the costs of resilience implementation in the first year.

3. Supply Chain Qualification

Large companies are increasingly checking the cyber resilience of their suppliers. If you can prove that you have your risks under control, you qualify for contracts that others are denied.

4. M&A Due Diligence

In company sales or acquisitions, IT resilience is examined. Companies with clean compliance documentation achieve better valuations – because the risk for the buyer is lower.

The Pitfall: Compliance for Compliance's Sake

Here's the warning: There is also the wrong approach.

The Wrong Approach:

• Create minimal documentation to pass the audit

• Tick off checklists without operational implementation

• Separate "compliance documents" aside from real processes

• Create once, then forget

The Result:

• Compliance costs without operational benefit

• In a real incident: The documents don't help

• In the next audit: Start all over again

The Right Approach:

• Build resilience capabilities that work

• Compliance proofs as a byproduct of these capabilities

• Integrated documentation reflecting the real process

• Regular tests and continuous improvement

The Short Version

• Change of Perspective: Compliance is not bureaucracy – it's a checklist for what you need

• Leverage Synergies: NIS2, FINMA, ISO 27001 often require the same

• One Framework, Multiple Proofs: Integrated resilience framework instead of separate compliance documents

• Competitive Advantage: Customer trust, insurance conditions, supply chain qualification, M&A evaluation

• Avoid the Pitfall: No compliance for compliance's sake – but operational capabilities with compliance proof

What's Next?

Answer these questions for yourself:

1. What regulations apply to your company? (NIS2? FINMA? KRITIS-G? GDPR?)

2. Do you have an up-to-date Business Impact Analysis?

3. Could you demonstrate what you are doing for business continuity in an audit tomorrow?

If you are unsure about question 2 or 3, you have your starting point.

(And if you need support to sensibly integrate compliance and resilience – that's exactly what we're here for.)

Read More

• NIS2 Directive for Swiss Companies – The Ultimate Implementation Guide

• The 5 Dimensions of Operational Resilience – The Complete Framework

• Business Impact Analysis – Identify Critical Business Processes