Frequently asked questions – NIS2 directive cybersecurity

NIS2 is the second version of the European Network and Information Security directive, with the original directive dating from 2016. NIS2 requires organizations in essential and important sectors to strengthen their cybersecurity and digital resilience, with stricter requirements and stronger enforcement than the original directive.

NIS2 is a European directive, while the Cybersecurity Act (Cyberbeveiligingswet, Cbw) is the Dutch law that transposes this directive into national legislation. The Cbw is therefore the Dutch implementation of NIS2, with specific obligations for organizations in the Netherlands.

The EU concluded that the first NIS directive resulted in uneven levels of cyber resilience across member states and sectors. Due to increasing threats, stronger and more uniform rules were required.

NIS2 applies to essential and important entities, including energy, transport, healthcare, drinking water, digital infrastructure, postal services, waste management, food production and digital service providers. Suppliers within the supply chain are also subject to stricter requirements.

Member states provide scope tests and sector overviews. In the Netherlands, the NCSC publishes sector information and a referral decision tree.

By complying with NIS2, you demonstrate that your organization has structurally implemented cybersecurity in line with recognized European standards. Discover the key benefits of NIS2 compliance for your organization on our website.

• Implement risk management measures
• Report incidents within strict deadlines
• Establish and maintain security policies
• Set up business continuity and crisis management
• Allow supervision and audits
• Comply with registration obligations

• Early warning within 24 hours
• Incident notification within 72 hours
• Final report within one month

NIS2 requires, among other things, risk assessments, incident detection, backups, access control, supply chain security, encryption and training.

Organizations must actively manage supply chain risks. Suppliers may need to demonstrate that they meet minimum cybersecurity standards.

• Netherlands: NCSC
• Belgium: CCB
• Germany: BSI

The NIS2 directive, and soon the Dutch Cybersecurity Act (Cyberbeveiligingswet, Cbw), does not prescribe any official certification, certificate or label that organizations must obtain.

The NIS2 directive was adopted at the end of 2022. Member states are currently implementing it in national legislation. Organizations must be prepared in time. The main deadline for NIS2 in the Netherlands has been postponed. The Netherlands did not meet the original EU deadline of 17 October 2024. It is expected that NIS2, through the Cybersecurity Act (Cyberbeveiligingswet, Cbw), will enter into force in the Netherlands at the end of Q2 2026.

• Determine whether your organization falls under NIS2
• Perform a gap analysis
• Map risks and processes
• Establish baseline security measures
• Prepare incident response
• Assess suppliers
• Train management
• Increase awareness
• Set up documentation

ISO 27001 and or NEN 7510 certification helps significantly, but organizations do not automatically comply with NIS2. The diagram below shows which aspects are covered by ISO 27001 or NEN 7510 and which by NIS2.

Typically, this is the CISO or information security manager. This person has:

• Insight into risks, processes and security measures
• Knowledge of ISO 27001 and or NEN 7510, which have significant overlap with NIS2
• Experience with performing gap analyses
• Knowledge of both technical and organizational measures

Yes. Once the Dutch Cybersecurity Act (Cyberbeveiligingswet, Cbw) enters into force, expected in 2026, supervisory authorities can:

• Impose fines
• Issue binding instructions
• Enforce audits
• Hold directors personally liable

The fines are comparable to GDPR, but in some cases even stricter.

For essential entities, for example energy, healthcare, telecom and water:

• Up to €10 million, or
• 2% of global annual turnover, whichever is higher

For important entities, for example IT service providers, postal services, waste, food and digital services:

• Up to €7 million, or
• 4% of global annual turnover

Yes, this is one of the most significant changes in the new legislation. Directors can:

• Be held personally responsible for negligence
• Be required to follow cybersecurity training
• Be temporarily suspended in extreme cases

ISO standards do not include these types of legal obligations, NIS2 does.

Legally, yes. The Cybersecurity Act (Cyberbeveiligingswet, Cbw) does not include a transition period. This means that organizations are required to comply with all requirements from the date of entry into force.