First: are you in scope of NIS2?
NIS2 is a European directive that requires organisations in critical and important sectors to organise their cybersecurity in a demonstrable way. Belgium implemented it through the NIS2 Act, the Netherlands through the Cyberbeveiligingswet. Whether you are in scope depends mainly on your sector and size. If so, you are classed as an essential or an important entity, each with its own level of supervision.
So start with that question and document your reasoning. Even if you are not in scope, this is worthwhile: customers who fall under NIS2 increasingly impose requirements on their suppliers.
Five steps to get started
- Determine your position. Check whether and how the law applies to your organisation, and what obligations come with it, such as registering with the competent authority.
- Identify what matters most. Which processes, data and systems are critical? Which suppliers do you depend on? This is the foundation for every next step.
- Measure where you stand. Carry out a baseline assessment against a recognised framework. In Belgium, many organisations use the CyberFundamentals (CyFun) or ISO/IEC 27001.
- Involve the board. NIS2 explicitly makes the board responsible. It must approve the measures, oversee them and undergo training.
- Draw up a roadmap. Turn the findings into priorities, with an owner and a deadline for each action. Don’t forget the reporting obligation: serious incidents must be reported quickly and in stages, which requires an agreed procedure.
Don’t start with documents
A common mistake is to start writing policies straight away. Policies that don’t reflect your actual situation stay on paper. Start by understanding your risks and current measures, and build your policies, procedures and technical improvements from there.
How Cyberwise helps
With the Cyberwise Baseline we assess where you stand and which actions come first, with a gap analysis against the framework that applies to you. We then guide the improvements and help keep your security level on track. You can read more about the law itself on our pages about the Belgian NIS2 Act and the Dutch Cybersecurity Act (Cbw).
This article is a general introduction, not legal advice. Your exact obligations depend on your situation.