NIS2

What is the NIS2 Directive?

NIS2 (Network and Information Security Directive 2, Directive (EU) 2022/2555) is the European directive that requires organisations in eighteen critical sectors to take appropriate cybersecurity measures, report significant incidents and make their management body accountable for digital resilience. It succeeds the original NIS Directive of 2016 and applies to both public and private organisations. NIS2 explicitly covers OT environments too, such as control systems in energy, drinking water, transport, chemicals and manufacturing. In the Netherlands, NIS2 has been transposed into the Cyberbeveiligingswet (Dutch Cybersecurity Act).

🎯 What is the aim of NIS2?

The first NIS Directive (2016/1148) led to widely diverging national rules: Member States designated “operators of essential services” themselves and applied different criteria. NIS2 is meant to fix that:

• Level playing field - one EU-wide rule determines who is in scope, instead of national designation
• Higher baseline - a fixed list of ten measures every organisation must address
• Faster reporting - staged reporting deadlines so authorities gain early visibility of attacks
• Management accountability - cybersecurity becomes a board responsibility, not just an IT task
• Supply chain security - explicit attention to supply chain risks and suppliers
• Cooperation - European exchange through the CSIRTs network, the NIS Cooperation Group and EU-CyCLONe

📅 When did NIS2 come into force?

NIS2 has been in force as a European directive since 16 January 2023. Because a directive does not apply directly, the obligations only bite through national legislation.

The Netherlands was therefore almost two years late. The Cyberbeveiligingswet has no general transition period: the duty of care, reporting obligation and registration obligation have applied in full since 15 August 2026. Only higher education institutions are given three years.

🧱 Who falls under NIS2?

Whether your organisation is in scope depends on two questions: are you in a sector listed in Annex I or II, and are you at least a medium-sized enterprise? Under the EU definition, medium-sized or larger means 50 or more employees, or an annual turnover and balance sheet total both above EUR 10 million. This is known as the size-cap rule.

Within those sectors, NIS2 distinguishes two categories. The difference lies not in the obligations but in the intensity of supervision and the level of fines.

Organisations designated as critical entities under the CER Directive, in the Netherlands through the Wwke, are always essential. In the Netherlands an estimated 8,000 to 10,000 organisations fall within scope.

🔐 Which obligations does NIS2 impose?

NIS2 has four core obligations: duty of care, incident reporting, registration and management accountability.

Duty of care: ten measures (Article 21)

Organisations must take appropriate and proportionate technical, operational and organisational measures based on an all-hazards approach and sound risk management. As a minimum:

1. Policies on risk analysis and information system security, often through an ISMS
2. Incident handling and incident response
3. Business continuity, including backup management, disaster recovery and crisis management
4. Supply chain security, including relationships with direct suppliers
5. Security in acquisition, development and maintenance of systems, including vulnerability handling and disclosure
6. Policies to assess the effectiveness of the measures
7. Basic cyber hygiene and cybersecurity training
8. Policies on cryptography and encryption
9. Human resources security, access control policies and asset management
10. Multi-factor authentication and secured voice, video, text and emergency communications

Reporting obligation (Article 23)

You report a significant incident in stages to the CSIRT and the supervisory authority. In the Netherlands this goes through the reporting portal of the NCSC; in healthcare, Z-CERT provides support.

Registration and management

Organisations must register themselves; in the Netherlands in the entity register through MijnNCSC. The management body must approve the measures, oversee their implementation, follow training demonstrably and can be held personally liable. That makes cybersecurity a fixed part of governance.

⚖️ How are supervision and sanctions organised?

Supervisory authorities can carry out audits, inspections and security scans, issue binding instructions and impose penalty payments and fines. For essential entities, a manager can even be temporarily prohibited from exercising managerial functions in the event of serious infringements. In the Netherlands supervision is split across eight sectoral supervisors, with the Dutch Authority for Digital Infrastructure (RDI) in a coordinating role. The RDI supervises energy, digital infrastructure and manufacturing, among others; the ILT covers transport, drinking water, waste water, waste management and chemicals; the IGJ covers healthcare and medical devices; the NVWA covers food; DNB and the AFM cover the financial sector.

🏭 How does NIS2 affect IT and OT environments?

NIS2 makes no distinction between IT and OT: the duty of care covers all network and information systems needed to provide the service. For many industrial organisations this means that SCADA systems in drinking water companies, PLCs in power stations and MES and Historian systems in manufacturing are in scope. That is exactly where patching, MFA and a complete asset overview are hard, because plants run for decades and availability comes first.

A practical approach for OT:

1. Determine scope - check sector, size and category, and register on time
2. Map your assets - an up-to-date asset inventory of controllers, networks and external connections
3. Analyse risks - for example with a business impact analysis and a risk assessment per zone
4. Separate the network - network segmentation following the zones and conduits model and defence in depth
5. Secure suppliers - set requirements for system integrators and vendor remote access
6. Detect and report - OT monitoring and a playbook that makes the 24-hour deadline achievable

For OT, IEC 62443 maps well onto the duty of care, while ISO 27001 and ISO 27002 support the organisation-wide approach. Certification is not mandatory, but it helps demonstrate that measures are appropriate.

🔄 How does NIS2 relate to other legislation?

• CER Directive and Wwke - focus on the physical and organisational resilience of critical entities; NIS2 covers the digital side
• Cyber Resilience Act - sets requirements for products with digital elements; NIS2 for the organisations that use them
• DORA - specific rules for the financial sector that take precedence over NIS2
• AVG (GDPR) - a personal data breach can also be a NIS2 incident, with a separate notification to the data protection authority

❓ Frequently asked questions

Is NIS2 the same as the Dutch Cyberbeveiligingswet?

NIS2 is the European directive; the Cyberbeveiligingswet is the Dutch law that implements NIS2. Organisations in the Netherlands must therefore comply with the Cyberbeveiligingswet, which has applied since 15 August 2026 and largely adopts the content of NIS2 one-to-one.

Does NIS2 apply to small organisations?

Small and micro enterprises are usually outside NIS2, because the directive only applies from medium size upwards. Exceptions include DNS service providers, top-level domain registries, qualified trust service providers and organisations designated as the sole provider of a critical service.

How quickly must you report an incident under NIS2?

Under NIS2 you submit an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. This applies only to significant incidents that can cause severe disruption or damage.

Is ISO 27001 certification mandatory under NIS2?

ISO 27001 certification is not mandatory under NIS2. An ISMS based on ISO 27001, complemented by IEC 62443 for OT, is however a common way to demonstrate that you meet the duty of care.

Does NIS2 apply to OT systems?

NIS2 applies to all network and information systems an organisation uses to deliver its services, so it also covers OT such as SCADA, PLCs and process control systems. A cyber incident that halts production or supply can therefore be a reportable NIS2 incident.

What do board members risk under NIS2?

Under NIS2, board members must approve the cybersecurity measures, oversee them and follow training. They can be held liable, and for essential entities a supervisor can temporarily suspend a manager in cases of serious negligence.

📌 In summary

NIS2 is the European directive that requires organisations in eighteen critical sectors to demonstrably secure their IT and OT, report significant incidents within 24 hours and make their management accountable for cybersecurity.

The directive entered into force on 16 January 2023 and should have been transposed by 17 October 2024. In the Netherlands this was done through the Cyberbeveiligingswet, which entered into force on 15 August 2026. If you know your sector and size, register, and implement the ten measures on a risk basis, you lay the foundation for compliance and for genuine resilience.