Resilience Has Become
a Governability Question

The first five newsletter issues looked at what happens when trust fails, when a critical vendor becomes unsafe, when the first hour is still waiting for permission, when detection does not become action quickly enough and when accumulated exposure quietly enlarges the blast radius before the incident begins.

This issue opens the next S10 Group newsletter arc:

‍THE GOVERNABLE ORGANISATION

This series poses a sharper operational question:
when prevention is bypassed, certainty is incomplete and pressure is already moving, can the organisation still stop the cascade, protect data, preserve virtual environments and remain in control?

Against the background of NIS2, DORA, SEC disclosure pressure and growing supply-chain assurance demands, this newsletter argues that resilience is no longer only a prevention or recovery question.

It has become a governability question

Many leadership teams face the same uncomfortable risk: mistaking evidence of preparation for evidence of control.
A signed policy can show that a topic has been recognised. An audit can show that a requirement has been reviewed. Insurance can transfer part of the financial consequence. A recovery plan can describe how systems should return.

All of that matters. But none of it proves that the organisation can still steer the incident while pressure is active, facts are incomplete and trust is changing.
That distinction is becoming harder to avoid. Investors, regulators, customers and supply-chain partners increasingly want more than evidence that cyber risk has been documented. They want confidence that leadership can act when something is already moving: restrict unsafe trust, interrupt movement, preserve essential operation and explain why the chosen control was proportionate.

This is not a local compliance debate. It is a broader shift in how cyber resilience is being judged—and right now, Europe is driving the front edge of this global movement.

NIS2 is one signal. It is not the whole story.

Across regulated, listed and supply-chain-dependent organisations, the direction is becoming clearer: cyber risk is no longer treated only as a technical security problem. It is becoming a governance, reporting, resilience and supply-chain accountability question.

In Europe, that shift appears through NIS2 and DORA. In the United States, public companies face cybersecurity incident and governance disclosure requirements under the SEC framework. Across international supply chains, customers and partners are asking for evidence that critical suppliers can manage cyber risk, report incidents and maintain operational continuity when something goes wrong.

The legal regimes differ. The operational pressure is converging.

NIS2 is one of the clearest European examples. The directive entered into force in January 2023, and Member States were required to transpose it into national law by October 2024. But the important change now is practical: NIS2 is moving from directive language into national implementation, supervision, enforcement pressure and supply-chain expectations.

The Netherlands now provides a visible marker in that movement. On 15 August 2026, the Cyberbeveiligingswet—the Dutch implementation of NIS2—entered into force. It introduces new obligations for more than 8,000 organisations providing essential or important services across 18 sectors, subject to the statutory scope criteria.

Organisations within scope must register, manage cybersecurity risks, report significant incidents and demonstrate appropriate governance. Boards hold final responsibility for cyber-risk management and must be able to assess both the risks and the measures taken to address them.

These are no longer future expectations. They are now part of the operating environment. Yet the larger point remains: regulation can assign responsibility, require evidence and compress reporting timelines, but it cannot perform the operational move when an incident is already active.

For international executives, the point is not whether NIS2 applies directly to every entity in every jurisdiction.

The point is that the governance expectation is changing.

Boards, regulators, investors, customers and supply-chain partners increasingly want to know not only whether cyber risk is documented, but whether the organisation can still act while an incident is moving.

This requires executives to look beyond policy signatures and focus on real-time operational response. That is why this newsletter is not a NIS2 compliance note.

NIS2 makes the timing visible. The larger issue is governability.

The regulatory push is clear. Frameworks can demand management attention, compress timelines, and force cyber risk onto the leadership agenda. But legal obligations cannot perform the operational move when a crisis hits — they cannot isolate a compromised identity, interrupt lateral movement, throttle a supplier tunnel, or protect a virtual environment. Those capabilities have to exist before the pressure arrives.

For years, the cyber conversation has been pulled towards two reassuring poles: prevent the incident, or recover from the incident.

Both remain essential.

Prevention investment matters. Recovery capability matters. Backups, monitoring, training, policies, suppliers, audits and exercises all have a place.

But the leadership question begins earlier than recovery and later than prevention.

It begins when something has slipped through, certainty is incomplete and the organisation must decide what it can still narrow, interrupt, contain or explain.

The shift can be seen as a simple inversion. The old question was whether the organisation was secure enough to avoid disruption. The sharper question is whether the organisation remains governable when disruption, uncertainty and external pressure arrive together.

The clearest recent examples are not useful because they are dramatic. They are useful because they show how quickly a cyber incident becomes an operating question the board cannot reduce to IT status.

Change Healthcare is the dependency case. The American Hospital Association described the 2024 cyberattack as one of the most significant and consequential cyberattacks on the US health care system, affecting eligibility verification, pharmacy operations, claims transmission and payments through a provider that processes 15 billion health care transactions annually. Its survey of nearly 1,000 hospitals found patient-care impact, financial impact and costly workarounds across the provider ecosystem.

That is the governability lesson. A compromised pathway did not only affect one technical environment. It forced hospitals, practices and pharmacies into manual workarounds, cash-flow stress and operational uncertainty. The question became larger than restoration: how much of the wider ecosystem can still function when one critical dependency becomes unsafe?

Medibank shows a different form of lost governability. Here, the organisation did not need to be visibly paralysed for the crisis to escape executive control. Once sensitive personal and health information was accessed and released, the pressure moved into privacy harm, regulator scrutiny, public trust and legal exposure. APRA imposed an additional AUD 250 million capital requirement reflecting weaknesses in Medibank’s information security environment, while the OAIC later alleged serious interference with the privacy of 9.7 million Australians.

That case matters because availability and control are not the same thing. A system can remain technically available while the organisation loses control over data, narrative, public confidence and future legal consequence.

Norsk Hydro remains useful as a contrast because it shows that governability does not mean the organisation avoids disruption. It means the organisation can still act, isolate, operate and communicate while disruption is real.

In March 2019, Hydro reported that it had been subject to an extensive cyberattack affecting several business areas. The company said it had isolated plants and operations and was switching to manual operations and procedures as far as possible. It also reported that some production areas were running as normal, with a higher degree of manual operation, while other parts faced production challenges and temporary stoppages.

That is not a story of perfect prevention. It is a story of retained control. The organisation did not pretend there was no impact. It separated what could continue from what had to be constrained. It moved into manual or degraded operation where possible. It communicated openly before every fact was known.

In that sense, Norsk Hydro is the positive side of the governability question: not “can we avoid every incident?”, but “can we still decide, isolate and operate when the incident has already arrived?”

A governable organisation is not one that claims certainty during the first hours. It is one that has already prepared the moves that make uncertainty smaller and consequence narrower.

• Narrow trust: reduce which identities, suppliers, service accounts and integrations remain trusted when behaviour becomes unsafe.
• Restrict compromised identity paths: stop valid-looking access from becoming unrestricted movement.
• Interrupt lateral movement: prevent one compromised area from becoming the whole organisation.
• Throttle unsafe supplier routes: constrain a dependency without defaulting to full operational paralysis.
• Contain data exposure: reduce which repositories, exports and outbound paths remain reachable during the live phase.
• Operate in controlled degradation: preserve what can still run safely while unsafe areas are isolated.
• Evidence decisions: keep a defensible record of what was seen, what was stopped, what remained active and why.

NIS2, DORA, cyber-disclosure requirements and supply-chain assurance create different but increasingly convergent expectations: organisations must show that cyber risk is not only documented, but can also be governed when pressure arrives. That governance becomes credible when leadership retains an executable means of control.

Our platform is designed for the moment when prevention has been bypassed and detection alone is no longer enough. It adds an operational containment layer that can help interrupt lateral movement, constrain unsafe paths and protect virtual environments while the organisation preserves as much safe operation as possible.

Our aim is not to promise that infrastructure incidents will disappear or that one layer can protect every dependency. The strategic value is more practical: leadership gains an operational move between observing the incident and defaulting to broad shutdown or recovery.

We believe this capability should be tested with the organisation’s existing security controls enabled. Credible governance rests on demonstrated control, not on an unconditional product claim.

That is why S10 Group belongs in the compliance and governance discussion.

Frameworks such as NIS2, DORA and the SEC cyber disclosure rules increase the need for management oversight, incident evidence, reporting discipline, supplier assurance and operational resilience. S10 strengthens the operational layer behind those obligations: the ability to demonstrate that the organisation can detect movement, stop spread, protect data, preserve critical infrastructure and keep control under pressure.

The value is not only that leadership can say cyber risk is being managed. The value is that the organisation has a concrete control capability when something slips through: stop the cascade, limit what the attacker can still reach, protect the virtual estate, reduce the chance of data theft and preserve a stronger basis for reporting, explanation and recovery.

That is the difference between documented governance and executable control. And it is why governability is no longer only a board concept.

It is an operational capability.

Choose one trusted path that would matter tonight: an identity route, supplier tunnel, data exchange, virtual environment, care-critical platform, privileged service account or backup-administration path.
Then ask five questions.

1. What would tell us this path had become unsafe before we had full root-cause certainty?
2. Who has authority to restrict it before the next formal crisis meeting?
3. What would break if we narrowed it, and what could continue in controlled degradation?
4. What evidence would we preserve to explain the decision later?
5. Which control could we actually exercise in minutes, not after a full investigation?

If the answer is unclear, the organisation may still be secure in many ways. But it is not yet fully governable under pressure.

That is the shift NIS2 makes visible. It is also the shift modern incidents have been proving for years. Accountability may be mandated, but governability has to be engineered, authorised and tested before pressure arrives.

If this question is relevant for your team, you can contact me at: