The NIS2 Directive: A Complete Guide for Dutch SMEs

The NIS2 Directive: A Complete Guide for Dutch SMEs

The European Union has put digital resilience firmly at the top of the agenda. With the NIS2 Directive (Network and Information Systems Directive 2), cybersecurity requirements for businesses are being tightened considerably. For many Dutch small and mid-sized businesses, that means new obligations, stricter oversight and a real need to take cybersecurity seriously. In this guide we explain exactly what NIS2 involves, who it applies to and how to get your organisation ready in time.

Key points (TL;DR)

• NIS2 is expected to take effect in the Netherlands in Q2 2026 through the Cybersecurity Act (Cyberbeveiligingswet)
• Fines of up to €10 million or 2% of global turnover for non-compliance
• 18 sectors fall under NIS2, from energy to manufacturing and IT service providers
• Supply chain effect: SMEs that supply NIS2 organisations must also demonstrate compliance
• 10 mandatory measures: from risk analysis to incident response and MFA
• Start preparing now - compliance takes time and the deadline is approaching

What is the NIS2 Directive?

NIS2 is the successor to the original NIS Directive from 2016. Where the first version focused mainly on large companies in critical sectors, NIS2 widens the scope considerably. The directive is designed to strengthen the European Union's digital resilience against the growing threat of cyberattacks.

In the Netherlands, NIS2 is being implemented through the Cybersecurity Act (Cyberbeveiligingswet, or Cbw). The law is expected to come into force in the second quarter of 2026, but organisations would be wise to start preparing now. It doesn't only apply to large enterprises; many SMEs fall under the new rules too.

Core principles of NIS2

The directive rests on three pillars that together form a robust cybersecurity framework:

Who falls under NIS2?

One of the biggest changes compared with the original directive is the expansion of the sectors and organisations it covers. NIS2 distinguishes between essential and important entities.

Essential entities

These are organisations in sectors that are crucial to the functioning of society:

• Energy (electricity, oil, gas, hydrogen)
• Transport (aviation, rail, water, road)
• Banking and financial markets
• Healthcare
• Drinking water and wastewater
• Digital infrastructure and ICT service providers
• Public administration

Important entities

These include businesses in additional sectors:

• Postal and courier services
• Waste management
• Chemicals and food production
• Manufacturing
• Digital service providers
• Research and education

Thresholds

Not every business in these sectors automatically falls under NIS2. The following thresholds apply:

• Medium-sized: 50-250 employees or €10-50 million turnover
• Large: more than 250 employees or more than €50 million turnover

But be aware: smaller businesses can also be caught if they provide critical services to organisations that do fall under NIS2. This is known as the supply chain effect.

The supply chain effect: why your SME is affected too

This is an important nuance. Even if your business isn't directly covered by NIS2, you can still be affected indirectly. Organisations that do fall under the directive are required to safeguard cybersecurity across their entire supply chain.

Do you provide IT services, software, cloud solutions or other digital services to businesses covered by NIS2? Then they will set requirements for your level of security. If you can't show that your cybersecurity is in order, you risk losing those customers.

As a result, many SMEs that are technically outside the scope of NIS2 will still need to step up their IT security to stay commercially relevant.

The ten mandatory security measures

NIS2 prescribes at least ten categories of security measures. Together they form the foundation of a sound cybersecurity policy:

1. Risk analysis and security policy

Organisations need an up-to-date overview of all cyber risks and a policy describing how those risks are addressed. This isn't a one-off exercise but an ongoing process.

2. Incident handling

You need a procedure for detecting, reporting and handling security incidents. A Security Operations Center (SOC) or a Managed Detection & Response service can help here.

3. Business continuity and crisis management

What do you do if you're hit by ransomware? Backup management, disaster recovery and crisis plans must be in place so you can recover quickly.

4. Supply chain security

As mentioned above: you're responsible for security across your entire chain. That requires contractual agreements and checks on your suppliers.

5. Security in acquisition, development and maintenance

Systems must be procured, developed and maintained securely. This includes vulnerability management and patching.

6. Assessing effectiveness

Test regularly whether your measures actually work, for example through penetration tests and security audits.

7. Cyber hygiene and training

Employees are often the weakest link. Training and awareness programmes are mandatory.

8. Cryptography and encryption

Sensitive data must be encrypted, both at rest and in transit.

9. Access control

Who has access to what? Multi-factor authentication and the principle of least privilege are essential.

10. Secure communication

Use secure communication tools, particularly in emergencies.

Reporting obligation: report within 24 hours

One of the most far-reaching obligations is the duty to report. In the event of a significant cyber incident, you must submit an initial notification within 24 hours to the National Cyber Security Centre (NCSC) or your sector regulator. A more detailed report with analysis and an impact assessment follows within 72 hours.

What counts as a significant incident?

• Serious operational disruption
• Financial loss
• Considerable material or non-material damage to others

This means you need 24/7 monitoring and detection capabilities; otherwise you may not even notice the incident within those 24 hours.

Sanctions and personal liability

NIS2 has teeth. The sanctions are considerably heavier than under the previous directive:

Even more striking is the personal liability for directors. As a director or board member, you can be held personally liable if your organisation fails to meet its cybersecurity obligations. That makes NIS2 compliance a boardroom issue.

Step-by-step plan: how to prepare your SME

Waiting until the law takes effect is not an option. Building a robust cybersecurity programme takes time. Here's a practical step-by-step plan:

Step 1: Determine whether NIS2 applies to you

Use the Dutch government's NIS2 self-assessment tool at regelhulpenvoorbedrijven.nl. Also check whether you supply organisations that do fall under NIS2.

Step 2: Carry out a baseline assessment

Where do you stand today? Which of the ten measures have you already (partly) implemented? A security assessment gives you insight into your current situation.

Step 3: Identify the gaps

Compare your current situation with the NIS2 requirements. Where are the biggest gaps? Prioritise based on risk and impact.

Step 4: Draw up an implementation plan

Define concrete actions, owners and deadlines. Start with the basics: multi-factor authentication, endpoint protection and backups.

Step 5: Implement and document

Put the measures in place and make sure they're properly documented. NIS2 requires you to be able to demonstrate that you're compliant.

Step 6: Train your employees

Invest in security awareness training. Phishing remains the most widely used attack vector.

Step 7: Test and evaluate

Run tests regularly, such as penetration tests and tabletop exercises. Adjust your measures based on the results.

Outsource or do it yourself?

For many SMEs the question is: can we do this ourselves, or do we need help? The answer depends on your size, complexity and the expertise you have available.

Benefits of outsourcing to an MSSP

A Managed Security Service Provider can cover many of the NIS2 requirements for you:

• 24/7 monitoring and incident response
• Expertise that's hard to find in-house
• Predictable monthly costs
• Faster implementation of measures
• Support with compliance documentation

What do you keep in-house?

Even when you outsource, your organisation remains responsible. Internally you need:

• A security officer or point of contact
• Ownership of the security policy
• Buy-in from management
• Budget and a mandate for measures

How NIS2 relates to other regulations

NIS2 doesn't stand alone. It overlaps and connects with other regulations:

• GDPR: Privacy and security go hand in hand. A data breach is often a security incident as well.
• DORA: Financial institutions are subject to the Digital Operational Resilience Act.
• ISO 27001: The information security certification aligns well with the NIS2 requirements.

Organisations that are already ISO 27001 certified have a head start, as many of the measures overlap.

Start today

The NIS2 Directive is no paper tiger. With substantial fines, personal liability and strict supervisory powers, the European Union is forcing organisations to take cybersecurity seriously.

For Dutch SMEs, that means taking action. Whether you fall directly under the directive or are affected through the supply chain, professional managed IT and solid cybersecurity are no longer a luxury but a necessity.

Want to know where your organisation stands? Get in touch for a no-obligation conversation about NIS2 compliance and how best to prepare. Call +31 85 303 5869 or request a free security scan.

Frequently asked questions about NIS2

When does NIS2 take effect in the Netherlands?

The Dutch Cybersecurity Act (Cyberbeveiligingswet) is expected to come into force in the second quarter of 2026. Start preparing now so you're compliant in time.

Does my SME fall under NIS2?

That depends on your sector, your size and whether you provide services to organisations that do fall under NIS2. Use the self-assessment tool or ask for advice.

What happens if I'm not compliant?

You risk fines of up to €10 million or 2% of your turnover. On top of that, directors can be held personally liable.

Can I outsource NIS2 compliance?

You can outsource the implementation of the measures to an MSSP. Ultimate responsibility, however, stays with your organisation.

How does NIS2 relate to ISO 27001?

There's a lot of overlap. ISO 27001 certification is a good foundation for NIS2 compliance, although it doesn't cover every requirement.