Cybersecurity rules for organisations (NIS2)
Short label: NIS2
Meaning
NIS2 sets cybersecurity requirements for organisations within its scope. Belgian implementation and sector-specific rules determine the applicable duties.
Why it matters
Organisations directly covered and suppliers affected through contracts have different questions to answer.
What you can do
Check whether you are in scope, assign responsibilities and document risk measures. Assess significant-incident reporting obligations using the official requirements.
Services that can help
Device Shield, Web App Shield and Workshops support specific controls and evidence. They do not by themselves establish full NIS2 compliance.
Official reference — NIS2 Art. 21
1. Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or for the provision of their services, and to prevent or minimise the impact of incidents on recipients of their services and on other services.
— Directive (EU) 2022/2555 (NIS2), Art. 21(1)
The core duty: an organisation covered by NIS2 must take measures, proportionate to its risk, that protect its systems and limit the damage of an incident — and be able to show it.
Read the article on EUR-Lex → · Official text, quoted from the Official Journal of the EU
Acronyms used here: NIS2, GDPR, DORA, CRA
- NIS2 — Network and Information Systems Directive 2
- An EU cybersecurity directive with requirements for organisations covered by its scope.
- GDPR — General Data Protection Regulation
- The EU regulation on personal-data protection. RGPD is the French name and AVG the Dutch name.
- DORA — Digital Operational Resilience Act
- EU rules on digital operational resilience in the financial sector.
- CRA — Cyber Resilience Act
- EU cybersecurity rules for products with digital elements, including certain software and connected devices.