Expertise · Regulation
NIS2
The EU's updated cybersecurity directive expanded scope across 18 sectors, strict incident reporting, supply-chain security, and personal accountability for management.
What it is, and why it matters.
NIS2 is the EU's updated cybersecurity legislation, significantly expanding the scope and depth of obligations across member states. It replaces the original NIS Directive and reaches a much broader range of organisations including healthcare, energy, transport, digital infrastructure, public administration, manufacturing, and the food supply chain. It requires appropriate technical and organisational measures to manage cybersecurity risk, reporting of significant incidents within strict timelines, and secured supply chains. Critically, it introduces accountability for management bodies. Senior leadership can be held directly responsible for failures.
Who it affects.
NIS2 applies across 18 sectors, split into essential entities (high-criticality sectors like energy, transport, banking, health, digital infrastructure, public administration) and important entities (postal services, waste, chemicals, food, manufacturing, digital providers). It generally applies to medium-sized organisations and above, though some entities are in scope regardless of size.
Key dates
Adopted at EU level in 2022; being transposed into national law across the EU. In the Netherlands, NIS2 is implemented through the Cyberbeveiligingswet, in force since 15 August 2026. Reporting timelines once in scope: early warning within 24 hours, incident notification within 72 hours, final report within one month.
Key obligations.
Appropriate technical and organisational risk-management measures
Incident reporting within strict timelines (24h / 72h / 1 month)
Supply-chain and supplier security
Governance and management-body accountability
Registration with the relevant national authority (where required)
Sits under:
Compliance
NIS2 within your managed office.
NIS2 sits under Compliance and connects directly to Governance and Risk. We build it into your Managed Security & Risk Office as a natural part of the program — not a separate workstream — integrated alongside every other framework and regulation that applies to you.
How we help.
00
Scoping & applicability
Essential vs important, sector and supply-chain analysis to confirm if and how NIS2 applies to you.
00
Gap analysis
A clear read of where you stand against NIS2's requirements.
00
Governance & accountability
The structures and management oversight the directive demands.
00
Risk-management measures
The technical and organisational measures, designed and orchestrated.
00
Incident response & reporting
Processes that meet the 24h / 72h / one-month timelines.
00
Supply-chain security
Assessing and governing the suppliers in your scope.
00
Ongoing managed compliance
Run as part of your managed office, not a one-off project.
Related expertise.
ISO 27001
The international standard for information security management. We design, implement, and run the ISMS — and take you to certification and beyond.
Supply-Chain & Third-Party Risk
Your security is only as strong as your suppliers'. We help you assess, govern, and continuously manage third-party and supply-chain risk — now a direct requirement under NIS2 and DORA.
Organised Cybercrime
The most likely cause of serious disruption for most organisations. We help you understand your exposure, prioritise defences, and govern your response — calmly and proportionately.
TRUSTED BY ORGANISATIONS ACROSS EUROPE
