What is NIS2?

Who does NIS2 apply to?

The Cybersecurity Act applies to organisations in sectors that are important to society and the economy, such as energy, transport, healthcare, drinking water, digital infrastructure, government, waste management, food, manufacturing of products such as machinery and electronics, and digital services. Depending on sector and size, an organisation is an essential or an important entity. In most sectors small businesses fall outside it, but for some types of organisation, such as public authorities and DNS service providers, the law applies regardless of size. Many organisations are covered by operation of law and must check this themselves.

What obligations come with it?

• Duty to register: since 15 August 2026, organisations register via MijnNCSC.
• Duty of care: mapping risks and taking appropriate technical and organisational measures, such as access management, two-step verification, backups, supply chain security and an incident plan.
• Duty to report: you report a serious incident with an early warning within 24 hours, an incident notification within 72 hours and a final report within a month.
• Directors approve the measures, oversee their implementation and must have completed training.

Essential entities are supervised proactively, important entities only when there are indications that something is wrong.

What if you are not covered?

Even then you will notice NIS2: organisations that are covered must assess their suppliers and set requirements for the security of software and services. A certificate such as ISO 27001 or, in healthcare, NEN 7510 helps to demonstrate this.