CBW enters force Q2 2026: three legal obligations for Dutch organisations. Register on mijn.ncsc.nl, meet reporting timelines, and find which of five sector regulators supervises your organisation.
NCSC-NL coordinates, but your compliance audits come from RDI, DNB, IGJ, or ILT depending on your sector. Map your Dutch NIS2 supervisor before July 2026.
Belgium’s CCB uses a 3-tier CyberFundamentals scheme to enforce NIS2. What the Basic, Important and Essential levels require — and the April 2026 deadline that makes this urgent.
WannaCry, NotPetya, SolarWinds, Colonial Pipeline, Viasat — each attack exposed a gap. Each gap became a NIS2 article. Here is the legislative paper trail.
The average data breach costs EUR 4.45M. NIS2 penalties reach EUR 10M. The compliance investment case is mathematical — here is the full ROI framework for CFOs.
NIS2 timeline: 8 key dates from 2022 directive to active enforcement — including Belgium’s closed March 2025 deadline and Germany’s BSI window (March 2026).
All 41 NIS2 Article 6 definitions — directive text, plain English, and compliance implications in one reference guide.
How the NIS2 Cooperation Group’s non-binding outputs become the Article 21 benchmark national authorities use to assess your controls — with CSIRTs Network and CyCLONe explained.
Your SOC 2 Type II evidence satisfies 5 of 10 NIS2 Article 21 measures — but 3 obligations must be built from scratch. Control mapping and reuse guide.
Qualified TSPs are NIS2 essential entities. eIDAS 2 Article 50 makes one 24-month audit cover both frameworks — map all four intersection points.
