NIS2

NIS2 (Network and Information Security Directive 2) is the European directive for the security of network and information systems and the successor to the first NIS directive. The directive obliges organizations in vital and socially important sectors to demonstrably ensure their cyber resilience: from risk management and supply chain security to the rapid reporting of incidents. Each EU member state transposes the directive into national legislation; in the Netherlands, this is done via the Cyber Security Act.

The Cyber Security Act (Cbw) is the Dutch implementation of NIS2 and replaces the Security of Network and Information Systems Act (Wbni). The House of Representatives adopted the legislative proposal on April 15, 2026, and the Senate on July 7, 2026. The act enters into force on August 15, 2026. From that moment on, the duty of care, reporting obligation, and registration obligation will apply directly to more than 8,000 Dutch organizations.

That depends on your sector and your size. The law applies to medium-sized or large organizations in eighteen sectors—ranging from energy, healthcare, and transport to digital infrastructure, chemicals, and food—with 50 or more employees, or an annual turnover and balance sheet total above €10 million. Some organizations, such as providers of DNS services and trust service providers, are subject to the law regardless of their size. Are you in doubt? Our free NIS2 Quickscan provides quick clarity.

Both categories must comply with virtually the same duty of care and reporting requirements; the main difference lies in oversight and penalties. Essential entities—typically large organizations in highly critical sectors such as energy, healthcare, and digital infrastructure—are subject to proactive oversight and face fines of up to €10 million or 2% of global annual revenue. Significant entities are subject to reactive oversight, with fines of up to €7 million or 1.4% of annual revenue.

In addition to fines of up to €10 million or 2% of global annual revenue, the regulator may issue binding instructions and enforce measures. A new development is the emphasis on the board of directors: directors must approve security measures, oversee compliance, and complete cybersecurity training themselves. In cases of demonstrable negligence, they may be held personally liable, and in the case of critical entities, a temporary ban on managerial duties may be imposed in extreme cases. Moreover, the reputational damage and operational disruption following a major incident often far exceed the fines.

You report significant incidents in three steps via the NCSC reporting portal: an early warning within 24 hours of noticing the incident, a full incident report with an initial assessment within 72 hours, and a final report within one month. These deadlines are only achievable if your organization can quickly detect, assess, and escalate incidents. Setting up and practicing this process is therefore a standard part of our trajectory.

Not automatically, but you do have a significant head start. The management system, risk analysis, and many measures from ISO 27001 overlap strongly with the duty of care under the Cyber Security Act. In addition, the law sets its own requirements that are not automatically included in ISO 27001: the strict reporting deadlines, the registration obligation with the NCSC, and the explicit role and training obligation of the management board. We will map out precisely which additions you need.

Then you will probably have to deal with it after all. Organizations that fall under the law are required to manage the risks in their supply chain, and therefore impose security requirements on their suppliers, for example in contracts and tenders. If you cannot demonstrate your security, you risk losing contracts. We help you meet those customer requirements, on a scale that suits your organization.