Having done several NIS 2 assessments in the last couple of months, ranging from governments in Belgium to organizations in the financial industry to international companies, one of the top three findings that always comes back is the lack of a documented Incident Response procedure