NIS2 in the boardroom: from compliance to resilience

Those questions are understandable. While the European NIS2 Directive sets the overall framework, organisations in the Netherlands will need to comply with its national implementation through the Dutch Cybersecurity Act (Cyberbeveiligingswet, CbW). For organisations within scope, this means that management bodies are required to approve cyber risk management measures and oversee their implementation. In practice, board members need to do more than review cyber security reports. They must also be able to assess which risks could threaten the continuity of the organisation.

For organisations that are still determining whether they fall within scope, or those looking for more insight into their governance responsibilities, we refer to our earlier articles on the scope of NIS2 and the implementation of the Dutch Cybersecurity Act.

The findings of our Cyber Security Report 2027 place these developments in a broader context. Organisations are becoming increasingly dependent on digital ecosystems that include cloud platforms, software providers and other third parties. At the same time, customers and supply chain partners are demanding greater assurance around cyber risk management. Digital trust is therefore no longer just a compliance issue. It has become a matter of business continuity, customer confidence and market position.

Challenges facing Dutch boards

Across Dutch NIS2 programmes, we see several recurring challenges. First, there is often no clear link between cyber risk and business operations. Board reports may contain figures on vulnerabilities, incidents and remediation actions, but they do not always explain which services could be affected or where management decisions are required.

Second, responsibilities are often spread across IT, information security, risk management, procurement, legal and business teams. Each function holds part of the picture, but no single team necessarily has the complete view. As a result, a green dashboard can create a greater sense of assurance than is justified in practice.

Third, many organisations have never tested their incident response capabilities at board level. A plan can define roles and responsibilities, but only an exercise will show whether decision-making, communications and recovery processes work under pressure.

The challenge in the Netherlands therefore goes beyond translating European regulation into policies and procedures. Organisations need to move from formal compliance to demonstrable control in day-to-day operations.

A common blind spot: third-party risk

Third-party risk is a good example of the gap between documentation and actual control. Consider an organisation with around 100 suppliers. Not every supplier processes sensitive information or supports a business-critical process. Yet many organisations send the same assessment questionnaire to every supplier. While this generates plenty of information, it does not necessarily provide meaningful insight into the suppliers that genuinely require board attention.

A supplier register shows who an organisation does business with. Effective third-party risk management should show which suppliers the organisation depends on, what the impact of disruption would be and what level of assurance is needed.

That assessment should start with the processes that must remain operational. From there, organisations can identify the systems, data and suppliers that support those processes. The depth of supplier due diligence should then reflect factors such as potential business impact, level of access and degree of dependency.

For financial entities, DORA raises similar questions around digital operational resilience and ICT service providers. While DORA and NIS2 differ in scope, both place digital dependencies much more firmly on the board agenda.

Four questions for the board agenda

Board members do not need to design technical controls themselves. They do, however, need to be able to oversee the risks that could affect business continuity, customer obligations and strategic objectives.

A useful board report should therefore answer four key questions:

• Which processes must continue to operate under all circumstances?
• Which systems and suppliers are those processes dependent on?
• Do our recovery capabilities and supplier arrangements align with the maximum downtime we can tolerate?
• Which residual risks are we prepared to accept, and where are additional measures required?

A green dashboard means very little if nobody understands which dependency could bring operations to a halt tomorrow.

These questions help shift the conversation away from technical detail and towards business impact and decision-making. They give boards greater visibility of where prioritisation, investment or explicit risk acceptance may be required.

From compliance requirement to board-level insight

The Dutch Cybersecurity Act gives organisations a reason to examine risks and dependencies that may have remained outside board reporting for years. The real value lies not in producing more documents, but in making better decisions about business continuity, incident response and risk acceptance.

Forvis Mazars supports organisations through NIS2 readiness assessments, third-party risk reviews and board workshops focused on cyber resilience. We also help financial entities assess DORA requirements and strengthen their digital operational resilience.

A practical first step does not require a major programme. For your next board meeting, identify the suppliers that support your most critical business processes and discuss a simple scenario: one of those suppliers fails tomorrow. Which services would be affected? How long could the organisation continue to operate? And what decisions would the board need to make? In our experience, that conversation often delivers more valuable insight than sending out another generic questionnaire.