What is NIS2 compliance?

NIS2 compliance means an organisation can demonstrate that it meets the EU NIS2 directive, implemented in the Netherlands as the Cyberbeveiligingswet, which has applied since 15 August 2026. It covers risk analysis and security policy, incident handling with reporting deadlines, business continuity, supply chain security and ultimate board responsibility. For a significant incident, an early warning follows within 24 hours, an incident notification within 72 hours and a final report within one month.

Who falls under NIS2 in the Netherlands?

NIS2 covers organisations in eighteen sectors, as essential or important entities. Highly critical sectors include energy, transport, banking, healthcare, drinking water, digital infrastructure, ICT service management and public administration. Other critical sectors include postal services, waste management, chemicals, food, manufacturing, digital providers and research. In the Netherlands more than 8,000 organisations are in scope, and they must register with the NCSC themselves.

Which roles do you need to demonstrate NIS2 compliance?

Demonstrating NIS2 compliance usually takes five roles. A GRC consultant or NIS2 specialist runs the gap analysis and risk analysis, a CISO leads the programme and reports to the board, a security architect designs technical measures, SOC analysts provide detection and timely reporting and a DPO or privacy officer aligns NIS2 with the GDPR. In NIS2 programmes, talent is more often the bottleneck than technology or budget.

Demonstrating NIS2 compliance: checklist and talent

The Network and Information Security Directive 2 (NIS2) sets strict security requirements for organisations in eighteen sectors. In the Netherlands it has been transposed into the Dutch Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026. For essential entities the maximum fine is at least EUR 10 million or 2% of worldwide annual turnover, whichever is higher. To demonstrate compliance you will usually need five roles: a GRC or NIS2 specialist, a CISO, a security architect, SOC capacity and a privacy officer.

What is NIS2 and who is in scope?

NIS2 succeeds the 2016 NIS Directive and widens its scope considerably, from seven to eighteen sectors. Organisations fall under the law as either essential or important entities.

The sectors of high criticality include energy, transport, banking, financial market infrastructure, healthcare, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration and space. Other critical sectors are also covered, such as postal and courier services, waste management, chemicals, food production, manufacturing, digital providers and research organisations.

More than 8,000 organisations in the Netherlands fall under the Cybersecurity Act. Organisations must check for themselves whether they are in scope and register in the NCSC entity register. Because the law is so broad, it also reaches mid-sized organisations that were previously out of scope.

The key NIS2 requirements

The Cybersecurity Act sets a registration obligation, a duty of care and a reporting obligation. In practice that means:

A risk analysis and appropriate, proportionate measures to secure network and information systems, set out in a policy you review regularly.
Procedures to detect, report and handle incidents. For a significant incident, an early warning is due within 24 hours, an incident notification within 72 hours and a final report no later than one month after that.
Business continuity: a continuity plan that keeps services running through an outage or cyber attack and gets them back afterwards.
Supply chain security: attention to security at your suppliers and service providers. My advice is to set this out in contractual agreements and assess suppliers periodically. The questions to ask a TPRM specialist about this are in interview questions for a TPRM specialist.
Board involvement: the board carries final responsibility, approves the measures, oversees their implementation and has to take training. NIS2 also contains provisions on the liability of directors.

The talent shortage: the biggest challenge

In the NIS2 programmes I see, talent is more often the bottleneck than technology or budget. The market for experienced security professionals was already tight, and the Cybersecurity Act forces thousands of organisations to expand their capacity at the same time.

NIS2 needs several specialisms at once. GRC consultants run the risk analysis and write policy, SOC analysts monitor and handle incidents, and security architects design the technical controls. Few organisations can cover all of that in-house without a serious investment in people.

Which profiles do you need?

These are the five profiles I see at the core of a NIS2 programme (see also our GRC expertise):

A GRC consultant or NIS2 specialist for the gap analysis, risk analysis and policy. This is the person who turns legal requirements into concrete measures, and the backbone of the programme.
A CISO, interim or permanent, to lead the programme and keep the board informed on progress and risk. Where that role sits relative to risk management and audit is covered in the three lines of defence model.
A security architect to design the technical controls, such as network segmentation, encryption and monitoring.
SOC capacity for monitoring, detection and incident response, so incidents are spotted in time and reported within the deadlines.
A DPO or privacy officer, because NIS2 and the GDPR overlap, for example on incident reporting.

Demonstrating NIS2 compliance: a checklist

Demonstrating compliance comes down to evidence. Make sure you have documents and results ready on each of these points:

Scope and registration: a recorded decision on whether you are an essential or important entity, and registration with the NCSC.
Risk analysis and measures: a current risk analysis, kept up to date by someone in an IT risk management role, with appropriate measures, such as incident handling, business continuity, supply chain security, access control with MFA, and encryption.
Reporting process: a working process for significant incidents: early warning within 24 hours, notification within 72 hours and a final report within a month.
Board: evidence that the board has approved the measures, oversees them and has taken training.
Documentation: policies, procedures, test results and improvement actions in a single ISMS. ISO 27001 certification is not mandatory, but it makes demonstrating compliance a lot easier.

Building and maintaining that file is typical work for a GRC or compliance specialist. See hiring a GRC and compliance specialist.

Why you need to act now

The EU transposition deadline for NIS2 was 17 October 2024. The Dutch Cybersecurity Act has applied since 15 August 2026. If you have not started yet, you are exposed to fines and to awkward questions for the board, which carries final responsibility.

On top of that, many organisations are looking for capacity for the same law at the same time. Those who wait will be fishing in a smaller pond. For energy companies with OT environments, we set out the roles you need in OT security in the energy sector.

How MVPeople Group helps with NIS2 compliance

MVPeople Group supports organisations in several ways on their NIS2 compliance journey. Through MVProjects we deliver NIS2 gap analyses and roadmap programmes based on a Statement of Work, with a fixed project price and clear deliverables: a gap analysis against the NIS2 requirements, a prioritised roadmap and support with implementation.

In addition, MVPeople provides immediately available cybersecurity specialists through our freelance and interim services to strengthen your internal team. Whether you need an interim CISO to lead the NIS2 programme or SOC analysts to build your monitoring capability, we present the first candidate within 4 hours.

Want to know what the law requires of your organisation? Read our NIS2 page or call or email me to talk about your capacity needs.