Wat is NIS2?
NIS2 (Network and Information Systems Directive 2) is the successor to the original NIS directive and imposes mandatory cybersecurity requirements on a much broader group of organisations in Europe. The directive has been transposed into national legislation in the Netherlands via the Dutch Cybersecurity Act, expected in 2026.NIS2 applies to organisations in 18 sectors, divided into essential entities (energy, transport, finance, healthcare) and important entities (post, waste management, digital infrastructure, manufacturing). Medium-sized and large organisations almost always fall under the directive.
Wat vereist NIS2?
NIS2 imposes four main obligations:
- Risk management measures: Organisations must implement appropriate technical, operational and organisational security measures — including incident response, supply chain security, access control and encryption.
- Notification obligation: Significant incidents must be reported within 24 hours to the competent authority (initial notification), followed by a comprehensive report within 72 hours.
- Director liability: Executives are personally liable for NIS2 compliance. Fines can amount to €10 million or 2% of global annual turnover.
- Supply chain security: Organisations must also manage the cybersecurity risks of their suppliers and service providers.
Overlap with ISO 27001
NIS2 and ISO 27001 have a large overlap: an ISMS that complies with ISO 27001:2022 covers a substantial part of the NIS2 requirements. We help you maximise the overlap so that with one engagement you achieve both certification and legal compliance.Our NIS2 approach
- Scope determination: Assessment of whether and how your organisation falls under NIS2
- Gap analysis: Comparison of your current security with the NIS2 requirements
- Implementation: Establish security measures, procedures and notification processes
- Evidence & documentation: Demonstrable compliance via our GRC Platform