Find out if NIS2 applies to you and what to arrange

A client sends you a questionnaire about NIS2 and wants answers within two weeks. Or you read in the trade press that the Cyberbeveiligingswet, the Dutch implementation of NIS2, covers your sector, and nobody in your organization knows if that is true. The legal text does not help much. It talks about essential and important entities, appropriate measures, and reporting deadlines. It says nothing about your network, your suppliers, and your people. We turn NIS2 compliance into a list of things you can arrange this month.

Does NIS2 apply to your organization

This is the first question, and often the hardest. NIS2 is the EU directive on network and information security, and the Cyberbeveiligingswet is its Dutch implementation. Whether you fall under it depends on your sector, your headcount and revenue, and sometimes on whether you provide a service another organization needs to operate. Energy, drinking water, transport, waste management, healthcare, digital infrastructure, and the manufacture of certain goods are on the list. A wholesaler that supplies only a hospital has a different question than a software company that manages systems for a grid operator.

We work that out before we change anything in your systems. You get a short written assessment that says why you are or are not covered, and in which category. You can also send that assessment to a client or an insurer. If your organization is not covered, we say so, and that is the end of it. It is still worth knowing where your data lives and who can reach it.

The duty of care in practice

The duty of care comes down to a handful of measures that you choose yourself and must be able to justify. You analyze the risks of your most important processes. You arrange backups and recovery, access management, encryption, and the handling of vulnerabilities. That sounds heavy, but in most companies we visit, the same four or five things are missing, and all of them can be fixed within a few weeks.

We start with what you already run. Logging is often switched on, but nobody reads it. Backups exist, but nobody remembers the last time one was restored. Accounts of former employees are still open. We set up monitoring with an agreed escalation path, test a recovery on a real server, and clean up the permissions. If you want to know whether an attacker could actually get through, penetration testing is the logical next step.

Reporting within 24 hours

The reporting duty is the part of NIS2 that surprises organizations most often. After a significant incident, you send an early warning within 24 hours and a fuller notification within 72 hours, with what you know at that point. That is short. On a Friday evening, with half the management on vacation, it is too short to start working out who calls and where.

So we write that procedure in advance and keep it to one page. Who decides that something is an incident. Who calls. Which email address, which portal, which phone number. What the first notification says, as a ready-made text where only the details need filling in. Then we rehearse it once with your team, because a procedure nobody has ever used is one you only find out about at the wrong moment. Our monitoring alerts the contact person you name, automatically.

Your suppliers and your board

NIS2 looks well beyond your own server room. You are also responsible for security in your supply chain: your hosting provider, your software vendors, and the company that maintains your machines remotely. We make an overview of those parties, of what exactly they can access, and of the agreements that are missing. We manage the chain behind our own managed environments, so we know how those conversations go and what you can reasonably ask for.

The second difference from earlier rules is that the board is now directly responsible. Management must approve the measures and oversee them, and can be held accountable. In practice, this mostly means putting a half-hour slot in the agenda twice a year to go through the risks and the open items. We supply the overview for it. If the question is about personal data and processors, it connects directly to GDPR compliance.