NIS2 in plain English
NIS2 is a European directive meant to make organisations more digitally resilient. In the Netherlands it is being introduced through the Cyberbeveiligingswet (Cbw, the Cybersecurity Act). Many organisations do not yet know whether it applies to them, or what they have to do if it does. Below we explain it, without legal jargon.
Does NIS2 apply to you?
NIS2 applies to organisations in sectors that matter to society. Think of energy, transport, healthcare, drinking water, digital infrastructure, government, waste management, food and parts of manufacturing.
In most sectors it concerns medium-sized and large organisations: from 50 employees or more than 10 million euros in turnover. Some organisations are always covered, regardless of size.
Does your organisation not fall under it? Stay alert anyway. If you supply an organisation that does fall under NIS2, the requirements often reach you through the contract.
The four duties
- Duty of care. You take appropriate measures to protect your systems and data.
- Duty to report. You report a serious incident quickly: an early warning within 24 hours and a notification within 72 hours.
- Duty to register. You register your organisation with the government.
- Management is responsible. Directors must approve the measures and have enough knowledge themselves.
Fines can be high: up to 10 million euros or 2 percent of worldwide turnover.
What are appropriate measures?
In plain terms it comes down to this:
- know which systems and devices you have;
- map your risks;
- arrange access properly, with a second factor when logging in;
- make backups and test whether you can restore them;
- install updates on time;
- encrypt sensitive data;
- have a plan ready for when things go wrong;
- check your suppliers;
- train your staff.
Doing it and proving it
Taking measures is one thing. You also have to be able to show that you took them. For laptops, Sextant helps: it provides evidence per control for ISO 27001 and NIS2.
Where do you start?
An NIS2 gap analysis shows where you stand and what is still needed. Take a look at our Architecture & custom development service or get in touch.