The Network and Information Security Directive 2 (NIS2) is the EU's most ambitious cybersecurity legislation to date. Since its enforcement deadline in October 2024, thousands of organizations across Belgium must meet stricter security requirements or face significant penalties.
What Is the NIS2 Directive?
NIS2 replaces the original NIS Directive from 2016, dramatically expanding the scope of organizations that must comply. It establishes a baseline of cybersecurity risk management measures and reporting obligations across the EU, with the goal of improving the collective resilience of critical infrastructure and essential services.
Belgium has transposed the directive into national law through the Centre for Cybersecurity Belgium (CCB), making compliance mandatory for a wide range of sectors.
Who Must Comply in Belgium?
NIS2 divides organizations into two categories based on their sector and size:
Essential Entities
- Energy (electricity, gas, oil, hydrogen)
- Transport (air, rail, road, water)
- Banking and financial market infrastructure
- Healthcare
- Drinking water and wastewater
- Digital infrastructure (DNS, TLD, data centers, cloud)
- Public administration
Important Entities
- Postal and courier services
- Waste management
- Chemical manufacturing
- Food production and distribution
- Manufacturing (medical devices, electronics, machinery)
- Digital providers (marketplaces, search engines, social networks)
- Research organizations
Medium-sized companies (50+ employees or €10M+ turnover) and large companies in these sectors are automatically in scope. Some smaller organizations may also be included if they provide critical services.
Key NIS2 Requirements
Organizations must implement cybersecurity measures that are proportionate to the risks they face. The directive outlines several specific areas:
- Risk analysis and information security policies — formal risk management frameworks and documented security policies.
- Incident handling — processes for detecting, reporting, and responding to security incidents. Significant incidents must be reported to the CCB within 24 hours.
- Business continuity — backup management, disaster recovery, and crisis management plans.
- Supply chain security — assessing and managing risks from direct suppliers and service providers.
- Vulnerability management — regular vulnerability assessments, including penetration testing, and coordinated disclosure processes.
- Cybersecurity training — regular security awareness training for all staff, including management.
- Encryption and access control — appropriate use of cryptography and multi-factor authentication.
Penalties for Non-Compliance
NIS2 introduces significant penalties, making cybersecurity a boardroom-level concern:
- Essential entities: fines up to €10 million or 2% of global annual turnover, whichever is higher.
- Important entities: fines up to €7 million or 1.4% of global annual turnover.
Management bodies can also be held personally liable, and may face temporary bans from exercising managerial functions.
How to Prepare Your Organization
Getting NIS2-ready is not a one-time project — it requires building sustainable security practices into your organization:
- Assess your scope — determine whether your organization falls under NIS2 based on sector, size, and criticality.
- Conduct a gap analysis — compare your current security posture against NIS2 requirements to identify areas that need improvement.
- Implement risk management — establish formal risk assessment processes and document your security policies.
- Set up incident response — create and test incident detection and reporting workflows that meet the 24-hour notification requirement.
- Review your supply chain — evaluate the security practices of your key suppliers and include security requirements in contracts.
- Train your team — ensure all employees, especially leadership, understand their cybersecurity responsibilities.
- Engage expert support — work with cybersecurity professionals who understand both the technical and regulatory landscape in Belgium.
How ICTLAB Can Help
ICTLAB helps Belgian organizations navigate NIS2 compliance with practical, hands-on support. From initial gap assessments and risk analysis to implementing security monitoring, incident response plans, and employee training programs, our cybersecurity services provide the technical expertise needed to meet regulatory requirements without disrupting your operations. We also help teams adopt DevSecOps practices to embed security throughout the development lifecycle.
Whether you are starting from scratch or need to strengthen existing security measures, our team in Brussels is ready to help you build a compliant and resilient security posture.