NIS2 Regulation and Risk Assessment

The European regulation NIS2 requires risk assessments. How do businesses carry out risk assessments of IT, and to what degree do they? What kind of challenges do they face? Do they regard the assessments as useful? To what degree do the risk assessments actually contribute to better risk mitigation? The master's thesis investigates how risks are handled in organizations and prioritized by management.