NIS2 requirements: what must your organisation demonstrate?

NIS2 requirements in board language

The Dutch Cybersecurity Act combines registration, risk-management measures, incident reporting, executive training, approval and oversight. The practical question is how these obligations are embedded in governance and daily operation rather than which document mentions them.

A board should be able to see the current scope, material risks, chosen measures, owners, exceptions, evidence of operation and remaining priorities.

Many NIS2 requirements call for board-level choices

Governance, policy, incident roles, supplier agreements, continuity, training, reporting and decision-making require contributions from many functions. Technical measures become effective when ownership, operation, testing and escalation are organised around them.

• scope, registration and accountable ownership;
• risk analysis and proportionality;
• incident handling and statutory reporting;
• business continuity, crisis management and recovery;
• supply-chain security and supplier evidence;
• access, assets, vulnerability handling, encryption and authentication;
• effectiveness testing, reporting and improvement.

Translate requirements into governance

Assign an owner to each obligation, connect it with existing processes, define evidence and agree which thresholds trigger board attention. Use a roadmap that distinguishes legal deadlines, material risk, quick improvements and structural change.

Management reporting should show results and exceptions, not only activity. This enables directors to approve, challenge and follow implementation.

What does NIS2 compliance mean for executive and supervisory boards?

NIS2 compliance means that the organisation has demonstrably embedded its applicable statutory obligations in governance and internal control. Executive and supervisory boards should be able to follow how scope, risk analysis, measures, incident reporting, suppliers, training, evidence and follow-up connect.

The board role centres on approval, challenge, prioritisation and oversight. Gap analyses, audits, implementation programmes and ongoing compliance support are services provided by Kynexis Informatiebeveiliging BV.

Keep requirements and implementation distinct

The requirement describes the outcome or obligation. Implementation describes how the organisation achieves it. Several measures may satisfy the same objective, depending on risk, size, architecture and service context.

This distinction supports proportionality and avoids treating a generic control list as the final design.

Frequently asked questions