NIS2 in practice: your first 30 days as the IT manager

Monday morning. Your director has read an article about NIS2 and forwards it with one line: "Can you pick this up?" Your calendar was already full. Where do you start?

This piece is a work list for the first thirty days. It is based on the Cybersecurity Act, the Dutch implementation of the NIS2 Directive, which has been in force since 15 August 2026 (rijksoverheid.nl, 15 August 2026). For the board side, there is a separate piece for directors.

Week 1: are you covered, and as what?

The act applies to organisations in 18 sectors, and you determine yourself whether you are covered. Look at your sector and your size. As a rule of thumb, the act applies from medium-sized: 50 employees or more, or an annual turnover and balance sheet total above 10 million euros.

In sectors such as energy, transport, healthcare, drinking water, digital infrastructure and government, a large organisation is usually an essential entity and a medium-sized one usually an important one. In sectors such as postal services, waste management, chemicals, food and manufacturing, a medium-sized or large organisation is an important entity.

Record your decision and the reasoning in a note of one page. If you are covered, register in the entity register of the NCSC.

Week 2: the gap analysis

The duty of care requires appropriate measures for risk management. Go through at least these topics and note for each topic what is there, what is missing and who the owner is:

• risk analysis and security policy
• incident handling
• backups, recovery and crisis management
• security of your suppliers
• encryption and access management, including MFA
• training of employees and the board

Do you already work with ISO 27001 or the BIO? Then do not start on a new framework. Put the NIS2 topics next to it and see where the gaps are.

Do not forget your suppliers. Ask the most important ones where they keep your data, which law they fall under and how they inform you in the event of an incident. Record those agreements in the contract.

A quick win that almost always counts: turn on MFA on all administrator accounts and on the mail. That takes an afternoon and removes a big risk.

Week 3: the reporting procedure

The reporting obligation is the part where it goes wrong in practice, because the clock starts running at the worst moment. You report a significant incident in three steps:

1. Within 24 hours, an early warning.
2. Within 72 hours, an incident notification with an initial assessment.
3. Within a month, a final report with cause and measures.

You report to your CSIRT and your competent authority, via the reporting portal of the NCSC. When an incident is significant is set out per sector in the ministerial regulations. Look up those thresholds now, not during the incident. Also check who has an account for the reporting portal, and whether that person still works there tomorrow.

Then agree who reports, who decides and who does it in the middle of the night and at the weekend. Put the phone numbers on paper. In a ransomware attack, your wiki may not work.

Week 4: record and practise

Document what you have done: the scope note, the gap analysis, the plan and the reporting procedure. A supervisory authority looks at what you can show.

Also make a first version of your plan: for each gap a measure, an owner and a date. Keep it small. Ten lines that you really finish are worth more than a hundred that disappear in a folder.

Close the month with a tabletop exercise of one hour. Take a realistic scenario, for example an administrator account that has been taken over, and go through the reporting procedure. You almost always find something that is not right. That is exactly the point.

After thirty days

You then have a scope, a list of gaps, a plan and a reporting procedure that has been practised. The plan itself runs for months. Plan a progress meeting with the board every quarter, because the board has ultimate responsibility.

What Noveu arranges technically, you can read on our compliance page.