Over the past few months, NIS2 has gone from a distant idea to something many Belgian business owners lose sleep over. That is understandable, because the communication around it is full of jargon. In this article I explain in plain language what NIS2 is, whether it applies to you and how to get started in a practical way.
What is NIS2, exactly?
NIS2 is a European directive that requires organisations to have their cybersecurity demonstrably in order. Demonstrably is the key word. It is not enough to say you work securely. You also have to be able to show it, with policies, procedures and evidence. Belgium has transposed the directive into national law, and the Centre for Cybersecurity Belgium (CCB) supervises it.
Does NIS2 apply to my company?
That depends on two things: your sector and your size. NIS2 distinguishes between essential and important entities, in sectors such as energy, transport, healthcare, digital infrastructure, public administration, food, manufacturing and more. As a general rule, medium-sized and large organisations in one of those sectors usually fall under it. Medium-sized here means from around 50 employees or 10 million euros in turnover.
Be aware that even if you don't fall under NIS2 directly, it can still affect you indirectly. Large customers who do fall under NIS2 will question their suppliers about their security, and that may include you. That is how NIS2 trickles down the whole supply chain.
What exactly do you need to be able to show?
The directive does not prescribe specific products. It does require you to have a number of things in order. In practice it comes down to this:
- Risk management: you know which risks your organisation runs and you take appropriate measures.
- Access management: only the right people have access to the right systems, with strong authentication.
- Incident response: you have a plan for when something goes wrong, and you report serious incidents in time.
- Backups and continuity: your organisation can keep running after an incident.
- Awareness: your staff know how to work securely.
- Responsibility at board level: the board shares responsibility. Cybersecurity is no longer a matter for the IT department alone.
How do you start without bringing your operations to a halt?
The biggest pitfall I see is organisations panicking and buying expensive tools they never fully use. I take the opposite approach and look first at what you already have. If you work with Microsoft 365, a surprisingly large part of what NIS2 asks for is already in your existing licences: multi-factor authentication, access policies, logging and device security. The first gain then often lies in switching on what you already pay for.
A sensible path looks like this. First a sober review: where do you stand today against what NIS2 asks? Then a priority list: what delivers the most security for the least effort? And finally a phased roll-out that does not bring your day-to-day operations to a standstill.
Conclusion
NIS2 is no reason to panic, but it is a reason to act. The organisations that come out of it well are not the ones that spend the most money. They are the ones that work in a structured way and start from what they already have. Not sure whether NIS2 applies to you, or where you stand today? We can work that out together in one conversation.