One audited project defined 52 performance indicators. Of seven projects due to report, three did, and two of those reported incorrectly. What separates a metric from a sentence with a number in it.

NIS2 gives you 24 hours for an early warning, 72 for a notification and a month for the final report - all counted from when you notice. That makes detection, not legal readiness, the binding constraint.