NIS2 checklist and Cybersecurity Act: quick guide

NIS2 and the Cybersecurity Act in brief

What applies

NIS2 is a European directive: (EU) 2022/2555. A directive does not apply directly to your organisation. Each member state transposes it into its own law, and the member states had to do so by 17 October 2024 at the latest.

In the Netherlands, that is the Cybersecurity Act (Cyberbeveiligingswet, Cbw). It has applied since 15 August 2026 and replaces the Network and Information Systems Security Act (Wbni). The Cybersecurity Decree (Cyberbeveiligingsbesluit, Staatsblad 2026, 189) set that date. So for you, the Dutch law counts; the directive explains where that law comes from.

This quick guide helps you determine whether you fall under it and what you need to arrange. It is not legal advice.

Does your organisation fall under it?

The law applies to organisations that provide essential or important services in 18 sectors. You determine yourself whether you fall under it. A selection of the sectors:

Essential entities

Energy (electricity, oil, gas, hydrogen)
Transport (air, rail, water, road)
Healthcare
Drinking water
Digital infrastructure (DNS, internet exchange points, top-level domains, cloud, data centres)
Government

Important entities

Postal and courier services
Waste management
Chemicals
Food
Manufacture of medical devices
Digital providers (online marketplaces, search engines, social networks)

What the law asks of you

Register

Organisations that fall under the law register in the national entity register of the NCSC. After that, you receive information about threats and help with incidents from the NCSC or the CSIRT of your sector.

The board is responsible

The board approves the security measures and oversees their implementation. Board members must know enough to assess risks and measures, and follow appropriate training for that.

Taking measures (duty of care, article 21 of the directive)

You take appropriate and proportionate measures to manage the risks to your network and information systems. The directive names these topics, among others:

Measure	What it is	Evidence you can show
Risk analysis	Periodic assessment of threats	Risk register, BIA
Incident management	Detection, response and recovery	Incident logs, playbooks
Business continuity	Backups and recovery after a disaster	Recovery plans, test reports
Supply chain	Assessing and monitoring suppliers	Supplier assessments
Network and system security	Technical security	Hardening guidelines
Access management	Managing identities and rights	Access logs, MFA overview
Cryptography	Encryption of stored and transmitted data	Certificates, key management
Staff	Awareness and screening	Training records
Asset management	Inventory of critical systems	CMDB, asset register
Authentication	MFA and strong passwords	MFA coverage

Reporting incidents (reporting obligation, article 23 of the directive)

You report a significant incident to your CSIRT and your supervisory authority, via the reporting portal of the NCSC. When an incident is significant is set out per sector in a ministerial regulation. The deadlines from the directive:

An early warning within 24 hours after you discover the incident.
An incident notification within 72 hours, with an initial assessment of the consequences.
Interim updates if the supervisory authority asks for them.
A final report within one month, with the cause and the measures taken.

Supervision and fines

Supervisory authorities check whether you comply with the obligations. The directive (article 34) names as the maximum fine at least:

for essential entities: 10 million euros or 2 percent of worldwide turnover per year
for important entities: 7 million euros or 1.4 percent of worldwide turnover per year

In addition, a supervisory authority can carry out audits and inspections and give binding instructions.

Checklist to get started

Board (week 1 to 4)

Appoint a responsible person with a mandate from the board
Have the board follow the training about the obligations
Determine whether your organisation falls under it, as an essential or as an important entity
Register your organisation in the entity register of the NCSC

Technology (week 4 to 12)

Make an inventory of your systems and data
Carry out a risk analysis on the critical systems
Turn on MFA on all access
Set up central logging
Divide your network into segments

Organisation (week 8 to 16)

Write an incident response plan
Practise the plan with a tabletop exercise
Record how you report to the CSIRT and the supervisory authority
Map the risks of your suppliers
Set up backups and recovery, and test them

Ongoing

Scan regularly for vulnerabilities
Review your risk analysis every year
Keep awareness up to date, for example every quarter
Check every month whether the updates have been installed

Where Noveu fits

Noveu supports your organisation with these technical measures and information:

Topic	What Noveu does
Access management	One Noveu login via OpenID Connect, with TOTP and passkeys, optional for users
Data location	Data and backups in a Hetzner data centre in Falkenstein (Germany); Cloudflare (US) is a sub-processor for CDN, DNS and TLS
Supply chain	All sub-processors are on our list of sub-processors

Sources

Directive (EU) 2022/2555 (NIS2), EUR-Lex, consulted on 29 September 2026
Government of the Netherlands (Rijksoverheid): news item on the entry into force of the Cybersecurity Act and the Critical Entities Resilience Act, news item of 15 August 2026 (in Dutch), consulted on 29 September 2026
Cybersecurity Decree (Cyberbeveiligingsbesluit), Staatsblad 2026, 189 (in Dutch), consulted on 29 September 2026
National Cyber Security Centre (NCSC), consulted on 29 September 2026

This document is informative. Ask for legal advice for your own situation.

NIS2 checklist for SMEs