NIS2: also for those who just miss the threshold.
The law covers a few thousand organisations. The questionnaires reach all of their suppliers.
Short answer
NIS2 is the European directive on digital resilience. In the Netherlands it is implemented in the Cyberbeveiligingswet (the law that implements NIS2), in force since 15 August 2026. It puts a duty of care, a reporting duty and a registration duty on organisations in eighteen sectors. Jevana helps with the technical measures under the duty of care, and helps suppliers answer their clients' questions. We do not give legal advice.
The law in brief
- Name
- Cyberbeveiligingswet, the Dutch implementation of the European NIS2 directive.
- In force
- Since 15 August 2026.
- Who it covers
- Organisations in eighteen sectors, such as energy, healthcare, transport, digital infrastructure and government, as a rule from medium size upwards.
- Three duties
- A duty of care (taking appropriate measures), a reporting duty (reporting serious incidents) and a registration duty.
- Source
- The Dutch government and the National Cyber Security Centre publish the current explanation and a self-assessment.
Why you meet it as a supplier
An organisation covered by the law also has to control the risks in its chain. In practice that means a questionnaire for every supplier that can reach systems or data: how is your access secured, do you make backups, how quickly do you report an incident.
A cleaning company, a software supplier or an installer with twenty staff is not covered by the law itself. But without good answers it loses the client that is. For SMEs, that is the form in which NIS2 arrives.
The duty of care, translated into technology
| What the law asks | What you arrange |
|---|---|
| Access security | Two-step verification, personal accounts, rights per role |
| Business continuity | Backups outside the network, a tested restore, a plan for outages |
| Handling incidents | Knowing who you call, what you record and who reports |
| Security of network and systems | Updates, a managed firewall, separated networks |
| Security in the chain | Knowing which suppliers can reach what, and agreements with each |
| Basic hygiene and awareness | A password vault, and staff who recognise a suspicious email |
This is a summary of the technical side. The law also asks for policy, a risk analysis and involvement from the board. For that you need a lawyer or a specialist adviser.
Questions
Does NIS2 apply to me?
It applies to you if your organisation is active in one of the eighteen designated sectors and is medium-sized or large: as a rule from fifty employees or an annual turnover of more than ten million euros. For some services the law applies whatever the size. The Dutch government has a self-assessment that lets you check this yourself. If in doubt, consult a lawyer.
What do clients ask of me as a supplier?
Clients covered by the law ask their suppliers how access is secured, whether systems are updated, whether there are backups and how quickly an incident is reported. It usually arrives as a questionnaire at a contract renewal. If you can back the answers with what is really in place, it is dealt with easily. We help fill in the list based on your own environment.
What has to be arranged technically for NIS2?
Technically it is about measures every business should already have: two-step verification, current software, a tested backup outside the network, a managed firewall, recorded rights and a way to spot incidents. The law prescribes no products, but requires that the measures fit the risk and that you can show them.
Can Jevana make us NIS2 compliant?
We can set up and record the technical measures, and that is a large part of the work. Meeting the law also needs a risk analysis, policy, a reporting procedure and involvement from management. That part is for the organisation itself, with help from a lawyer or adviser. So we do not say we make you compliant. We do the technology.
Goes well with
-
Cybersecurity for SMEs
The measures that stop most attacks, in an order a small business can follow.
-
Backup and recovery
Backups of servers, workstations and a NAS to separate storage, with a restore test at a fixed moment.
-
Microsoft 365 security
Two-step verification, conditional access and Defender: what is in your licence, switched on and checked.
-
Advice
Someone to think through your IT with you, from where you stand today to a switch or growth.
From the knowledge base
-
What is a data processing agreement and when do you need one?
If a host, payroll provider or IT administrator handles personal data for you, put it in writing. What it contains and what to check.
-
Ransomware: what do you do in the first hours?
Files encrypted and a ransom note on the screen. What to do straight away, what to leave alone and how to get back to work.
Tell us what you run.
An introduction costs nothing. You talk straight away to one of the two people who will actually do the work.
or email info@jevana.systems