Security rules and standards explained
Choose a rule or standard to understand its purpose, who may be concerned and which records or actions it involves. The text and drawing explain the same points.
NIS2
Directive and national law · NIS2 — Directive (EU) 2022/2555
Cybersecurity duties for organisations within the applicable scope, including management responsibility, risk measures and significant-incident reporting.
Who is concerned
- Covered essential and important entities; sector, size and exceptions matter.
- Suppliers may face contract requirements without becoming directly covered on that basis alone.
Main requirements
- Assign management responsibility and proportionate risk measures.
- For a significant incident, report without undue delay; an early warning is generally due within 24 hours of awareness and notification within 72 hours, with specific exceptions.
- Keep evidence, recovery plans and the required registration and reporting arrangements.
Dates: Belgian implementation applies from 18 October 2024. Check the relevant sector rules and incident conditions.
Consequences: Authorities can supervise measures and impose sanctions under the applicable national rules.
Drawing
Related security topic: Cybersecurity rules for organisations (NIS2) →Official source ↗
GDPR
Regulation · GDPR — Regulation (EU) 2016/679
Rules for using and protecting information about identifiable people.
Who is concerned
- Controllers decide the purposes and means of processing; processors act on their behalf.
- Customers, staff and website visitors can all have personal information in your systems.
Main requirements
- Document why information is used, restrict access and set necessary retention.
- Apply security measures appropriate to risk and test recovery.
- Notify a breach where required; the 72-hour authority deadline runs from awareness, with the Article 33 risk exception. High-risk communication to people is a separate duty.
Dates: Applicable since 25 May 2018. Check the circumstances of each processing activity and breach.
Consequences: The authority can require corrective measures and impose fines; affected people may have a right to compensation.
Drawing
Related security topic: Protect personal information →Official source ↗
DORA
Regulation · DORA — Regulation (EU) 2022/2554
Digital operational resilience requirements for covered financial entities.
Who is concerned
- Covered financial entities, such as banks, insurers and payment firms.
- Technology suppliers have contract obligations; designated critical providers also face a separate oversight regime.
Main requirements
- Manage information and communication technology (ICT) risk and record responsibilities.
- Classify and report relevant incidents and test resilience.
- Manage supplier contracts, service records and exit arrangements.
Dates: Applicable since 17 January 2025. Requirements depend on entity type and the relevant provisions.
Consequences: Financial supervisors enforce the rules. Critical-provider oversight is distinct from a supplier’s ordinary contract duties.
Drawing
Related security topic: Digital resilience in finance →Official source ↗
CyberFundamentals
Security framework · CyberFundamentals — Centre for Cybersecurity Belgium
A practical framework for selecting and assessing cybersecurity measures.
Who is concerned
- Organisations seeking a structured security baseline or assurance level.
- The appropriate level depends on risk and scope, not simply company size.
Main requirements
- Use the CCB selection method to identify an appropriate assurance level.
- Assess controls, document gaps and plan improvements.
- Use the relevant verification or certification process when assurance is required.
Dates: Check the current CCB framework, assurance scheme and selection tools before assessment.
Consequences: A chosen label does not replace every legal or contractual duty; its scope and assurance requirements must match the intended use.
Drawing
ISO/IEC 27001 · 27002
Standards · ISO/IEC 27001:2022 and ISO/IEC 27002:2022
27001 sets requirements for managing information security. 27002 provides guidance on security controls.
Who is concerned
- Organisations of any size or sector establishing a security management system.
- Suppliers whose contracts or customers require independent certification.
Main requirements
- Assess risks and select controls with a statement of applicability.
- Assign responsibilities, review performance and improve the system.
- Certification is against 27001 within an agreed scope; using individual controls is not the same as certification.
Dates: 2022 editions; check applicable amendments and the certification scope.
Consequences: Certification is voluntary unless a contract or applicable requirement calls for it. An independent auditor assesses the management system.
Drawing
AI Act
Regulation · AI Act — Regulation (EU) 2024/1689
Risk-based duties for organisations that provide or use AI systems.
Who is concerned
- A provider develops or supplies a system; a deployer uses it under its authority.
- Other roles, exceptions and risk categories affect the duties that apply.
Main requirements
- Identify the role, intended use and risk category of the system.
- Build appropriate AI literacy among staff involved in the relevant use.
- Check prohibited practices, transparency and any high-risk requirements against the current rules.
Dates: Application is phased. Literacy and prohibited-practice rules apply from 2 February 2025; consult the current official timetable for other duties.
Consequences: Requirements and enforcement depend on the role, system and infringement. Local hosting does not remove them.
Drawing
Related security topic: Rules for using artificial intelligence at work →Official source ↗
Cyber Resilience Act
Regulation · Cyber Resilience Act — Regulation (EU) 2024/2847
Cybersecurity duties for covered products with digital elements.
Who is concerned
- Manufacturers of covered software or connected products.
- Importers, distributors and open-source stewards have distinct roles and conditions.
Main requirements
- Design and maintain the product securely during the applicable support period.
- Keep component and vulnerability-handling records; an inventory requirement does not itself mean public release to every buyer.
- Assess conformity and reporting duties for relevant actively exploited vulnerabilities and severe incidents.
Dates: Article 14 reporting applies from 11 September 2026; most product obligations apply from 11 December 2027.
Consequences: Authorities can require corrective action and apply the relevant sanctions, including restrictions on non-compliant products.
Drawing
Related security topic: Security of software products →Official source ↗
Scope and obligations depend on the organisation, activity and current rules. Sources checked on 9 November 2026; consult the linked official text for your assessment.
Security table → · Sovereign Stack →
Acronyms used here: NIS2, GDPR, DORA, CRA, ISO, IEC
- NIS2 — Network and Information Systems Directive 2
- An EU cybersecurity directive with requirements for organisations covered by its scope.
- GDPR — General Data Protection Regulation
- The EU regulation on personal-data protection. RGPD is the French name and AVG the Dutch name.
- DORA — Digital Operational Resilience Act
- EU rules on digital operational resilience in the financial sector.
- CRA — Cyber Resilience Act
- EU cybersecurity rules for products with digital elements, including certain software and connected devices.
- ISO — International Organization for Standardization
- The international standards organisation. ISO is its universal short name, rather than initials translated from one language.
- IEC — International Electrotechnical Commission
- The international organisation for electrotechnical standards; it publishes some standards jointly with ISO.