A ransomware attack rarely begins with a dramatic system failure. Often, a single stolen password, a forgotten update, or a vendor with excessive access is enough. That is precisely why the most important NIS2 obligations for companies are not just about technology. They are about governance, preparedness, and whether your organization can continue operating when something goes wrong.
NIS2 is the European directive on cybersecurity for essential and critical organizations. In the Netherlands, this directive is implemented through national legislation. Whether your company falls exactly under the rules depends on your sector, size, role in the supply chain, and the Dutch implementation. Even if you do not formally fall under NIS2, the measures often serve as a practical starting point for a more secure ICT environment.
For which companies is NIS2 intended?
NIS2 focuses on organizations in sectors such as energy, transport, healthcare, drinking water, digital infrastructure, wastewater, government, manufacturing, logistics, food, chemicals, and certain digital services, among others. Regarding the latter category, examples include cloud providers, data centers, managed service providers, and providers of online marketplaces.
The directive distinguishes between essential and important entities. As a general rule of thumb, medium-sized and large organizations in designated sectors come into play, often starting from 50 employees and a certain turnover or balance sheet total. However, that threshold is not the sole determining factor. Some organizations can remain relevant even at a smaller size due to their societal function, sector, or position in a supply chain.
An SME that does not fall under NIS2 itself may still be directly affected by it. Larger customers may request security measures, incident procedures, continuity plans, and agreements regarding access to systems. NIS2 therefore also impacts supplier relationships.
The most important NIS2 obligations for companies
The core is clear: you must demonstrably manage cyber risks. This does not mean that every organization needs exactly the same technical solution. An office with twenty employees requires something different than a healthcare institution with 24/7 systems. However, you must be able to explain what risks you face, what measures you have chosen, and how you verify whether they work.
The Board and Management bear responsibility
Under NIS2, cybersecurity is not a subject that can be entirely left to the IT department. Directors and the board of directors must approve measures, oversee their implementation, and build sufficient knowledge to assess risks. In cases of gross negligence, personal liability may play a role, depending on the final Dutch legislation and the situation.
This does not call for technical details in every board meeting. However, it does require consistent attention to topics such as risk analyses, incidents, suppliers, remediation tests, and investments. Document decisions. If questions arise later, you want to be able to demonstrate that security was discussed systematically, and not just after an incident.
Risk management is becoming an ongoing process
A one-off scan or a policy document in a folder is not enough. NIS2 expects an approach that you repeat and update regularly. New software, hybrid working, a company acquisition, or a new external IT partner can change the risk profile.
Start with an overview. Which systems are business-critical? Where are customer data, financial data, and business documents located? Who has access, including external access? And what happens if the internet, email, telephony, or the digital workplace is unavailable for a day?
From there, you determine appropriate measures. These can be technical measures, such as multifactor authentication, updates, backups, network segmentation, and encryption. However, organizational choices also count: clear access rights, a procedure for exiting the company, periodic checks, and agreements on who makes which decision in the event of an incident.
Incidents must be reported and controlled quickly
In the event of a serious cyber incident, a strict reporting process applies under NIS2. In general, an initial warning must be issued within 24 hours, followed by a more detailed report within 72 hours, after which a final report is expected. The precise reporting route and application are derived from Dutch regulations.
Not every phishing email or brief outage is immediately subject to a mandatory reporting requirement. It concerns significant incidents that, for example, seriously disrupt service delivery, cause major financial damage, or affect other parties. That is precisely why it is so important to determine in advance what you consider a serious incident.
Ensure you have an incident plan that is usable outside of office hours. It specifies who assesses the incident, who is authorized to isolate systems, who informs management, and who maintains contact with customers, suppliers, and relevant authorities. Test this plan at least periodically. A procedure that exists only on paper is of little help when pressure is high.
Continuity and recovery must be demonstrable
Having a backup is not the same as being able to restore. If files have been encrypted by ransomware, you need to know which backup is available, how long recovery takes, and whether the data is complete and usable. You cannot test that once the damage has already occurred.
NIS2 therefore calls for attention to business continuity, crisis management, and recovery after incidents. Clarify the maximum acceptable downtime for critical processes. For a webshop, this might be a few hours; for an administration office, perhaps longer. It depends on your clients, contractual agreements, and the consequences of downtime.
Also consider dependencies. Will your team still be able to work if Microsoft 365 is temporarily unavailable? Can you speak to customers if your VoIP telephony fails? Is there an alternative internet connection at a critical location? Not every provision needs to be redundant, but make conscious choices based on risk and cost.
Suppliers are part of your security policy
Many companies rely on software, hosting, cloud storage, telephony, and external administrators. As a result, your responsibility does not stop at a supplier's front door. NIS2 emphasizes security in the supply chain.
Therefore, do not evaluate a supplier solely on price and functionality. Also ask how access is secured, where data is stored, how incidents are reported, what backup arrangements are in place, and what happens if the collaboration ends. Document relevant agreements in contracts or data processing agreements.
That does not mean you have to subject every small supplier to an extensive audit program. The audit must match the risk. A party with management rights to your entire network naturally deserves more attention than a supplier of a non-critical online tool.
Employees remain a crucial link
Many incidents arise from human error, deception, or overly broad privileges. Therefore, training is not a mandatory annual presentation that employees quickly click away. Short, recognizable instructions work better: how do you recognize a suspicious login page, what do you do in the event of an unexpected payment order, and who do you report your doubts to?
Combine awareness with technology. A well-trained employee might still click on a convincing phishing email. With multifactor authentication, limited rights, and good monitoring, you can limit the damage. Conversely, technology offers no full protection if employees do not dare to report an error.
Here is how to prepare practically
Workable preparation begins with a baseline assessment. Map out systems, accounts, devices, data, and external parties. Next, check the basics: updates, access control, multifactor authentication, backups, endpoint security, and log recording. Then, look at processes: risk assessment, incident response, recovery, and vendor management.
Make the outcomes concrete. Select a limited number of improvement actions, assign an owner to each action, and include a realistic schedule. For many SMEs, it is wise to first the biggest risks , such as unused accounts, local administrator rights, untested backups, and missing agreements with external parties.
Also retain evidence of your actions. Consider risk analyses, minutes of management meetings, backup test results, incident logs, and agreements with suppliers. This documentation aids in oversight, but is particularly useful for maintaining control when responsibilities shift or your organization grows.
NIS2 requires more than ticking off a checklist. View it as a reason to get your digital foundation in order: knowing what you have, mitigating risks proactively, and being able to act calmly when continuity is under pressure. Your organization benefits from this every workday, even without an incident.