NIS2 directive: what does this mean concretely for your SME?

What is the NIS2 directive?

NIS2 stands for Network and Information Security Directive 2 — the successor to the original NIS directive from 2016. The European Union issued this directive to strengthen the cybersecurity of organisations in critical and important sectors.

In Belgium, NIS2 has been transposed into national legislation. This means Belgian organisations that fall within the scope have concrete obligations regarding risk management, incident reporting and securing their systems.

Who falls under NIS2?

NIS2 significantly expands the scope compared to NIS1. The directive distinguishes two categories:

• Essential entities: energy, transport, water, finance, healthcare, digital infrastructure
• Important entities: postal services, waste management, chemicals, food, manufacturing, digital providers

For SMEs, the threshold is organisations with more than 50 employees or annual turnover exceeding €10 million in the relevant sectors. But smaller organisations in the supply chain of affected companies may also have indirect obligations.

What obligations arise from NIS2?

Affected organisations must, among other things:

• Conduct and document a risk analysis
• Implement appropriate technical and organisational security measures
• Have an Incident Response Plan
• Report significant incidents within 24 hours (initial notification) and 72 hours (detailed report)
• Manage supply chain security
• Ensure personnel security and access control

What are the sanctions?

NIS2 provides for significant fines. Essential entities risk up to €10 million or 2% of global annual turnover. Important entities risk up to €7 million or 1.4% of turnover.

What first steps can you take today?

1. Check whether your sector and size place you under NIS2
2. Conduct a baseline assessment: where do we stand today?
3. Create a priority list of measures
4. Develop a basic information security policy
5. Consider external support via CISO as a Service

NetGuard guides SMEs from baseline assessment to compliance. Get in touch for a no-obligation conversation.