NIS2 and the Dutch Cybersecurity Act: what does this mean for your organisation?

What is the NIS2 Directive?

The European NIS2 Directive aims to raise the common level of cybersecurity across the European Union. It applies to more sectors than its predecessor and introduces more extensive requirements for cyber risk management, incident reporting, supervision and enforcement.

In the Netherlands, the NIS2 Directive has been implemented through the Dutch Cybersecurity Act. This Act replaces the Network and Information Systems Security Act and applies to organisations that provide essential or important services.

Which organisations are subject to NIS2?

The Dutch Cybersecurity Act applies to organisations across 18 sectors. It distinguishes between highly critical sectors and other critical sectors.

Highly critical sectors include energy, transport, banking, financial market infrastructures, healthcare, drinking water, wastewater, digital infrastructure, managed ICT services, public administration and space.

Other critical sectors include postal and courier services, waste management, the manufacture, production and distribution of chemicals, food production and distribution, digital providers and research.

Whether your organisation is subject to the Dutch Cybersecurity Act depends on its sector, the type of services it provides, its size, its place of establishment and any statutory exemptions. Some organisations are covered regardless of their size. Organisations are responsible for determining whether the Act applies to them. A targeted NIS2 scope and applicability assessment provides clarity.

What are the main NIS2 obligations?

Registration requirement

Organisations subject to the Dutch Cybersecurity Act must register in the national entity register maintained by the National Cyber Security Centre.

Duty of care

Organisations must take appropriate and proportionate technical, operational and organisational measures to manage cyber risks, prevent incidents and limit the impact of incidents.

Incident reporting requirement

Significant cyber incidents must be reported to the designated CSIRT and the competent authority within the statutory time limits. The applicable thresholds may vary by sector.

Management accountability

The management body is ultimately accountable for managing cyber risks. Management must approve security measures, oversee their implementation and have sufficient knowledge to assess risks and measures.

Supervision and enforcement

Competent supervisory authorities monitor whether organisations comply with the Dutch Cybersecurity Act. This requires not only appropriate measures, but also demonstrable governance, up-to-date documentation and ongoing monitoring.

1.1. Which measures should your organisation take?

An effective approach starts with a clear understanding of the current situation and the most significant risks. Relevant measures may include:

• conducting a NIS2 impact assessment or gap analysis;
• identifying and assessing cybersecurity risks;
• strengthening governance and management reporting lines;
• implementing and testing business continuity and recovery plans;
• establishing incident response and reporting procedures;
• managing supplier and supply chain risks;
• training management and employees;
• periodically testing and demonstrably improving the measures implemented.

How can Forvis Mazars support your NIS2 compliance?

We help organisations translate the requirements of the NIS2 Directive and the Dutch Cybersecurity Act into a practical, risk-based approach. We combine expertise in cybersecurity, risk management, governance and assurance, enabling you to work towards demonstrable compliance and sustainable digital resilience.

Depending on your circumstances, we can help you determine the scope and applicability of NIS2 and carry out impact assessments, gap analyses, cyber risk analyses and maturity assessments. We also assess governance, management accountability and risks relating to suppliers and the wider supply chain. Where necessary, we help establish incident response and reporting procedures, develop a feasible implementation roadmap and support the delivery of improvement measures. Independent readiness assessments and assurance help demonstrate progress. We also provide NIS2 training for management and employees.

A timely assessment helps prevent misplaced priorities and unnecessary costs. Based on the findings, we work with you to develop a feasible roadmap tailored to your risk profile, sector and existing control measures.

Frequently asked questions about NIS2

What is the difference between NIS2 and the Dutch Cybersecurity Act?

NIS2 is the European directive aimed at achieving a higher common level of cybersecurity. The Dutch Cybersecurity Act transposes this directive into Dutch law and sets out the obligations that organisations in the Netherlands must meet.

How do I know whether my organisation is subject to NIS2?

This depends on factors including your sector, services, size, place of establishment and any applicable exemptions. As the assessment is not always straightforward for complex organisations, a NIS2 applicability assessment can provide clarity.

What responsibilities does management have?

Management must approve the measures for managing cyber risks, oversee their implementation and acquire sufficient knowledge to assess risks and security measures.

What requirements apply to suppliers and the supply chain?

Organisations must manage relevant risks in their supply chains. This requires visibility of critical suppliers, appropriate security agreements, periodic assessments and follow-up of identified deficiencies.

How does NIS2 relate to ISO 27001?

ISO 27001 can provide a useful foundation for information security, but certification does not automatically mean that an organisation fully complies with the Dutch Cybersecurity Act. An additional assessment against the statutory requirements remains necessary.

Would you like to know whether your organisation is subject to NIS2?

Our NIS2 specialists are happy to conduct a targeted scope and impact assessment and translate the findings into a practical improvement plan. Contact us for a open discussion about NIS2 compliance and the Dutch Cybersecurity Act.