NIS2 Readiness: A Practical Guide for Dutch Organisations

NIS2 replaced the original NIS Directive with a much wider net. Where the first version mostly touched large operators of essential services, NIS2 pulls in a significant range of mid-sized organisations across sectors that previously had no formal cybersecurity obligations at all.

Who it actually applies to

NIS2 splits covered organisations into "essential" and "important" entities, generally based on sector and size. Sectors include energy, transport, banking, health, digital infrastructure, public administration, and, significantly for mid-market companies, digital providers, manufacturing, postal services, and waste management, among others. Size thresholds generally bring in medium and large enterprises, though some entities are in scope regardless of size due to their role.

The practical takeaway: don't assume you're out of scope because you weren't under the original NIS Directive. If you sit in a covered sector and meet the size threshold, you're likely in scope, and exact transposition details vary by member state, so this is worth confirming for your specific situation rather than assuming.

What NIS2 actually requires

At a high level, in-scope organisations need to:

• Implement risk-management measures covering incident handling, business continuity, supply chain security, and vulnerability management.
• Report significant incidents within tight timelines: commonly an early warning within 24 hours, a fuller notification within 72 hours, and a final report within a month.
• Make senior management accountable for cybersecurity risk management, with training obligations for leadership.
• Assess and manage security risk in their supply chain, not just their own environment.

Penalties for non-compliance can be significant, and, notably, management bodies can be held personally accountable in some circumstances, which is a meaningful shift from how cybersecurity risk was typically governed before.

Does NIS2 require training?

Yes, specifically for management. Article 20 requires management bodies to follow training so they have sufficient knowledge and skills to identify and assess cybersecurity risks and the measures taken to manage them, and to approve, and oversee the implementation of, the organisation's risk-management measures. It's a genuine legal obligation, not a general recommendation to run security-awareness sessions for staff (that's good practice too, but a separate thing).

In practice, this obligation is usually met as part of the same governance work that sets up accountability and reporting lines in the first place. Briefing the board on what NIS2 actually requires of them is a natural, evidenced part of that, rather than a standalone training product. See our Governance, Risk & Compliance service for how we structure that.

A realistic readiness sequence

Rather than trying to do everything at once, a workable sequence looks like:

• Confirm scope. Determine whether you're in scope, and whether you're classified as essential or important: this affects specific obligations and oversight.
• Gap assessment. Compare current risk-management measures, incident response capability, and supply-chain oversight against NIS2's requirements.
• Governance first. Get management accountability and reporting lines defined before spending on tooling: this is where personal liability sits, and it's usually the fastest gap to close.
• Incident response readiness. Make sure you can actually meet the 24-hour early warning requirement: that means having a defined process before an incident happens, not figuring it out during one.
• Supply chain review. Start assessing the security posture of key suppliers, since NIS2 explicitly extends risk-management expectations to your supply chain.

A note on accuracy

For Dutch organisations specifically: NIS2 was transposed into national law as the Cyberbeveiligingswet, which entered into force on 15 August 2026, replacing the older Wet beveiliging netwerk- en informatiesystemen (Wbni). Transposition and enforcement details still vary by EU member state and continue to evolve elsewhere. This guide is general orientation, not legal advice. Confirm specific obligations for your sector and jurisdiction before making compliance decisions based on it, and see the sources below for the primary text and NCSC-NL's own guidance.