NIS2 for directors: are you covered and what do you face?

You are on the board of a healthcare institution or a medium-sized company. The IT manager mentions NIS2 in passing. You ask whether that is something for the management. The answer is yes, and in fact mainly for the management.

Since 15 August 2026, the Cybersecurity Act has been in force, the Dutch implementation of the European NIS2 Directive (rijksoverheid.nl, 15 August 2026). The act replaces the old Wbni. After this piece, you know whether you are covered and what you arrange this month. If you are the IT manager yourself, also read our guide to the first 30 days.

What has changed?

The first NIS Directive from 2016 applied to a small group of vital providers. NIS2 (Directive (EU) 2022/2555) drew the circle a lot wider:

• From 7 to 18 sectors, from energy and healthcare to waste management, food and digital services.
• The board approves the measures, supervises them and takes a course itself.
• A reporting obligation with fixed deadlines, starting with a warning within 24 hours.
• Requirements for the security of your suppliers.
• Higher fines.

Are you covered?

The act distinguishes between essential and important entities. Which one you are depends on your sector and your size.

• In sectors such as energy, transport, banking, healthcare, drinking water, waste water, digital infrastructure, government and space, a large organisation is usually an essential entity and a medium-sized one usually an important one.
• In sectors such as postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research, a medium-sized or large organisation is an important entity.

As a rule of thumb, the act applies from medium-sized: 50 employees or more, or an annual turnover and balance sheet total above 10 million euros. Smaller organisations can be covered if they have a special role, for example as the only provider of a service.

Note: you determine yourself whether you are covered. Nobody sends you a letter. If you are covered, you register in the entity register of the NCSC.

What are you responsible for yourself?

The board approves the security measures and supervises their implementation. You can delegate the work to IT, but not the responsibility. In practice, that means: cyber security is a fixed item on the board agenda, with a report from IT, just like the figures. For essential entities, a supervisory authority can in the most extreme case even temporarily suspend a director (Article 32 of the directive).

The measures themselves are about risk management: a risk analysis, incident handling, backups and recovery, the security of your suppliers, encryption and access management. None of this is exotic. The difference is that you now have to be able to show it.

What if it goes wrong?

You report a significant incident in three steps. First an early warning within 24 hours, then a notification within 72 hours and finally a final report within a month. You report to your CSIRT and your supervisory authority, via the reporting portal of the NCSC.

The fines follow Article 34 of the directive. For essential entities, it is a maximum of 10 million euros or 2 percent of worldwide annual turnover. For important entities, that is 7 million euros or 1.4 percent. The highest amount counts.

What you arrange this month

1. Have it established whether you are covered, and as what. Record the reasoning.
2. Register with the NCSC if you are covered.
3. Ask for a baseline measurement: where does the organisation stand in relation to the duty of care?
4. Put the directors' course in your own calendar, not only in that of IT.
5. Agree who reports an incident, also in the middle of the night and at the weekend.

Many measures align with what you may already do for ISO 27001 or the BIO. Start there and add what is missing. And ask your most important suppliers how they deal with NIS2. Their answer says a lot.

How Noveu implements those measures in the technology, with the status per framework, you can read on our compliance page.