On this page
Secure, report and make the board accountable
Under NIS2, medium-sized and large organisations in critical sectors must secure their systems, report serious incidents within 24 hours and make their management accountable. NIS stands for network and information security. The 2 marks the second version: it replaces the first NIS Directive of 2016, which reached only a narrow group of operators.
NIS2 is not about personal data; that is the GDPR, which also sets the rules for your privacy policy. NIS2 is about keeping services running: does the water keep flowing, the post keep moving, the factory keep producing when an attacker gets in? What a supplier may do with your customers' personal data goes into a data processing agreement; how well your systems withstand an attack is NIS2.
Adopted in 2022, national laws from 2024
The European Parliament and the Council adopted the directive on 14 December 2022. Member states had to transpose it by 17 October 2024 and apply it from 18 October 2024. Because it is a directive, every country writes its own law and names its own authority, so the details differ per country. Belgium passed its law on 26 April 2024, in force since 18 October 2024, with the Centre for Cybersecurity Belgium (CCB) as supervisor and incident desk. Organisations in scope registered on the Safeonweb@Work platform: most by 18 March 2025, digital providers such as cloud, data centres and managed IT services by 18 December 2024. Belgium is a useful reference because its CyberFundamentals framework gives suppliers a concrete bar to aim for.
Who is in scope: sector and size
Two questions decide. Do you provide a service listed in Annex I or II? And are you at least medium-sized? Annex I lists the highly critical sectors: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, business-to-business ICT service management, public administration and space. Annex II lists other critical sectors: postal and courier services, waste management, chemicals, food, a large part of manufacturing, digital providers such as online marketplaces, and research. Medium-sized means from 50 full-time employees, or over 10 million euros in turnover and balance sheet. A few kinds of organisation are covered whatever their size, such as DNS providers and trust service providers.
Sector, size and the reporting clock
Sector times size
Important entity
From 50 FTE, or over 10 million euros turnover and balance sheet. Supervised after the fact, following an incident or a signal.
Important entity
Other critical sector: postal, waste, chemicals, food, manufacturing, digital providers, research.
In principle not
But through your customer: a NIS2 entity must secure its supply chain and writes that into your contract.
After a significant incident
- Within 24 hoursEarly warningTo the national CSIRT, once you know of the incident.
- Within 72 hoursIncident notificationFirst assessment: severity, impact, indicators.
- On requestIntermediate reportWhen the CSIRT or authority asks for one.
Exceptions exist: DNS providers, trust services and critical entities are covered whatever their size.
Essential or important
The duties are largely the same. The difference lies in supervision and fines. The figures below are Belgium's; other member states set their own within the same EU maximums.
| Essential entity | Important entity | |
|---|---|---|
| Who | Annex I and large, plus some types whatever their size | The rest of Annex I and II from medium-sized |
| Supervision | Before and after the fact, with mandatory regular conformity assessment | After the fact: following an incident or a signal |
| Proof in Belgium | CyFun verification or ISO 27001, certified by 18 April 2027 | An assessment is optional and gives a presumption of conformity |
| Fine in Belgium | 500 euros to 10 million euros or 2 percent of worldwide turnover | 500 euros to 7 million euros or 1.4 percent |
| Repeat offence | Doubled within three years | Doubled within three years |
What the 2026 and 2027 milestones ask of essential entities in Belgium is set out in our news piece on the April 2027 NIS2 deadline.
Ten measures and a reporting clock
Article 21 lists the minimum measures: a policy for risk analysis, incident handling, backups and a plan for when things go wrong, supply chain security, secure development and maintenance of systems, training, cryptography and encryption, access control and, where appropriate, multi-factor authentication. Management approves these measures, oversees them, takes training itself and is liable when it fails. In Belgium the CCB recommends doing this through the CyberFundamentals framework, CyFun for short, with four levels: Small, Basic, Important and Essential. It draws on NIST CSF, ISO 27001 and the CIS Controls, so it maps onto what auditors elsewhere already know.
Dates under the Belgian law
- 18 October 2024The law appliesThe Belgian NIS2 law of 26 April 2024 enters into force.
- 18 December 2024Digital providers registerCloud, data centres, DNS, managed IT services and online marketplaces sign up on Safeonweb@Work.
- 18 March 2025Everyone else registersEssential and important entities are registered with the CCB.
- 18 April 2026First proofEssential entities show a CyFun verification at Basic or Important, or their ISO 27001 scope.
- 18 April 2027CertificateEssential entities hold CyFun Essential or an ISO 27001 certificate.
A small supplier to a large customer
Most small companies are not covered by NIS2 themselves. Many still run into it, through their customers. Article 21 requires a NIS2 entity to secure its supply chain, including its relationship with every direct supplier and service provider. The Belgian CCB is blunt about it: a NIS2 entity can impose a CyFun level on its direct suppliers, and it advises every organisation in such a chain to meet at least CyFun Basic.
Say a software company of eight people maintains the ordering portal of a food processor with 140 employees. Food is in Annex II and the processor is medium-sized, so it is an important entity. At contract renewal a questionnaire arrives: do you use multi-factor authentication on every admin login? Who can reach our server, and how do you revoke that when someone leaves? How fast will we hear about an incident? The processor has 24 hours to report itself, so it asks to hear within a few hours. The software company is not covered by the law, but if it cannot answer, it loses the customer. If you work with SaaS tools on your customers' behalf, expect to ask those vendors the same questions.
The same goes when you hire outside developers. If you bring in a nearshore team or extra people through staff augmentation to build software for a NIS2 entity, those people sit inside your supply chain and need the same logins, rules and reporting lines as your own staff.
What it costs: the CCB's CyFun tools, a selection tool and an Excel self-assessment, are free. A verification or certificate comes from an assessment body the CCB recognises, priced on quote. Most of the effort is your own time: putting measures in place, keeping them up and being able to show them. Software vendors also face the Cyber Resilience Act and new product liability rules for software.
Your customer's questionnaire: what to have ready
- Multi-factor authentication on every admin login, including hosting and email.
- A list of who can access which system, and how you revoke access.
- Backups you actually restore, with the date of the last test.
- Updates to software and plugins within a fixed number of days.
- Encryption of traffic (https) and of sensitive data.
- A log of who did what in your customer's systems.
- A named contact and a deadline for reporting incidents to your customer.
- A self-assessment against CyFun Basic, even before anyone asks.
Four questions from smaller companies
Does NIS2 apply to my company?
Only if you provide a service from Annex I or II and have at least 50 full-time employees or over 10 million euros in turnover and balance sheet, or if you belong to one of the exceptions such as DNS services. Most small companies are not covered but meet it through their customers.
What is the difference between NIS2 and GDPR?
GDPR protects personal data: who holds it and what they do with it. NIS2 protects the operation of services: systems that keep running and incidents reported fast. A data breach can fall under both, each with its own report.
Is NIS2 a directive or a regulation?
A directive. It sets the rules and the maximum fines, and each member state writes them into its own law with its own authority. That is why the registration platform, deadlines and recommended framework differ per country.
What is CyberFundamentals?
The Belgian framework of the CCB for building up and testing your cybersecurity, with the levels Small, Basic, Important and Essential. Basic is what the CCB advises at minimum for suppliers of NIS2 entities. Outside Belgium it is still a practical checklist to work from.