What is NIS2?
What NIS2 entails, why the Cybersecurity Act exists, and what this means for your organization since August 15, 2026.
NIS2 (Network and Information Security Directive 2) is the revised European directive for cybersecurity. The Netherlands is implementing this via the NIS2, which obliges thousands of organizations in critical sectors to manage risks, report incidents, and assume executive liability.
Does your organization fall under NIS2?
- Your organization is established in the Netherlands, or offers services here
- You are active in a designated sector, such as energy, healthcare, transport, digital infrastructure, or IT management
- Your organization is medium-sized or large: at least 50 employees, or at least 10 million euros in turnover
Please note: some organizations always fall under NIS2, regardless of their size, such as DNS providers, trust service providers (eIDAS), and critical entities designated by the government.
The road to the Cybersecurity Act
Bill submitted
Passed by the House of Representatives
Passed by the Senate
Entry into force
Essential or important entity?
Rule of thumb: a large company in a sector with high criticality is usually essential; all other combinations are usually important.
Essential entity
Important entity
What must you do if you fall under NIS2?
- Implement risk management and appropriate cybersecurity measures
- Report significant incidents: initial report within 24 hours, full report within 72 hours
- Assume executive responsibility: the management board is personally liable
- Register your organization with the NCSC
Waiting costs more than preparing
Since August 15, 2026, the obligations apply from day one. Start with the basics now, and set up your NIS2 compliance with the NIS2 Management System.