What was the NIS?

The NIS (Network and Information Systems Directive) was introduced in 2016 to strengthen digital resilience across Europe. Its goal: to ensure that vital sectors properly secure their IT systems against cyber threats. At the time, the directive primarily applied to a small group of organizations, such as energy companies, telecom providers, and water boards. For many other sectors, the NIS had little direct impact.

In practice, this approach proved too limited. Cyberattacks affected not only critical infrastructure but also municipalities, healthcare institutions, suppliers, and SMEs. This led to a revision: NIS2.

What changes with NIS2?

The NIS2 directive significantly expands these obligations. Not only vital organizations, but also essential and important entities must demonstrate that their information security is in good order. The key differences at a glance:

‍

‍

A directive is not a law in itself. NIS2 is a mandate from the EU to its member states to transpose its content into national legislation. In the Netherlands, this is the Cybersecurity Act (Cbw), which replaces the Wbni. The act will officially take effect on August 15, 2026.

NIS2 and ISO 27001: how do they relate to each other?

NIS2 and ISO 27001 have many commonalities. ISO 27001 provides a structured framework (ISMS) to implement and safeguard NIS2 security measures. With a well-structured ISMS, you already meet a large portion of the NIS2 requirements. It is not a one-to-one replacement, but it helps your organization demonstrably comply with requirements regarding risk management, documentation, and periodic evaluations. Many organizations therefore use ISO 27001 as the foundation for their NIS2 implementation. From that base, you can specifically add the directive's requirements—for example, regarding governance and supply chain management.

‍

{{LINKCARD}}

‍

What does NIS2/the Cyber Security Act mean for your organization?

There is a good chance that your organization falls under NIS2, even if that was not the case under the old NIS. Consider:

‍

• Municipalities and government organizations
• ICT service providers
• Healthcare institutions (in addition to NEN 7510)
• Suppliers of vital or essential services
• SMEs that are part of a supply chain

‍

In this context, not only technical security is important, but also policy, risk management, and awareness within the organization. Furthermore, executives are given explicit responsibility. They must be able to demonstrate that they have taken measures and have knowledge of the risks.

Where do you start with NIS2?

The first step is insight. With a free NIS2 check you get a clear picture of where your organization currently stands and what steps are still needed to achieve compliance. From there, we guide organizations through NIS2 implementation, conducting internal audits, and setting up processes that meet the directive's requirements. Want to take it a step further? Then the NIS2 Supply Chain certificate (NIS2 SC) is a valuable quality mark that allows suppliers to demonstrate that they meet the requirements set by NIS2 organizations for their partners.

Demonstrable NIS2 compliance

The transition from NIS to NIS2 requires more than just technical measures. It is about demonstrable accountability, risk management, and collaboration throughout the entire supply chain. By starting now with a baseline assessment or NIS2 check, you avoid having to act under time pressure later. And with the right guidance, you ensure that your organization is not only compliant but also truly operates more securely.

Schedule a free, no-obligation 45-minute consultation or start the free NIS2 check immediately to discover where your organization stands.

‍