NIS2 & the Dutch Cybersecurity Act
The Dutch Cybersecurity Act has applied since 15 August 2026, without a general transition period. What NIS2 and the supply-chain duty of care really require of you, and why you have to demonstrate it, not just declare it.
Published on August 16, 2026
Is a vulnerability scan mandatory under NIS2?
NIS2 does not mandate any tool by name, including vulnerability scans. What the law does require: appropriate measures you can demonstrate.
Read article →Published on July 11, 2026
Do I fall under NIS2? How to determine whether your organisation is an essential or important entity
Sector plus size determine whether your organisation falls under NIS2 and the Dutch Cybersecurity Act. Walk through the self-check: which sectors, which thresholds, the exceptions, and what to arrange now.
Read article →Published on July 7, 2026
Dutch Cybersecurity Act final: NIS2 applies in the Netherlands from 15 August 2026
The Dutch Senate has adopted the Cybersecurity Act and the Critical Entities Resilience Act. Both entered into force on 15 August 2026. What does this mean for your organisation and your suppliers?
Read article →Published on June 16, 2026
What is actually required under the NIS2 supply-chain duty of care (and what is not)?
NIS2 does not mandate any specific tool. Learn what the supply-chain duty of care really asks of you, when the Dutch Cybersecurity Act took effect, and how to substantiate it with evidence.
Read article →Published on June 12, 2026
How do you answer a NIS2 supplier questionnaire? A practical guide for SMEs
A NIS2 supplier questionnaire from your large customer on your desk? How to answer the four themes that follow directly from the NIS2 requirements (patch management, MFA, incident response and your own suppliers), with evidence the assessor takes seriously.
Read article →Published on June 12, 2026
The NIS2 roadmap for public-sector boards: from duty of care to demonstrable compliance
A practical NIS2 roadmap for public-sector boards: from duty of care to demonstrable compliance in five steps. With concrete actions for scope, training, monitoring, incident response and the audit trail.
Read article →Published on June 5, 2026
NIS2 and joint and several liability: what public-sector directors should and should not fear
NIS2 makes cybersecurity a board-level responsibility. Read what this means for public-sector directors, liability, duty of care, training obligations and demonstrable risk management.
Read article →Published on May 26, 2026
Scanning is not NIS2 compliance. But it is a necessary building block
An honest take: scanning for vulnerabilities does not make you NIS2 compliant. But it does provide defensible evidence for vulnerability management and the supply-chain duty of care.
Read article →Published on May 12, 2026
NIS2 and suppliers: what your large customer asks of you and how you prove it
Supplying a NIS2-regulated customer? The supply-chain duty of care (Art. 21) also reaches suppliers. What your customer may ask and how you demonstrate it.
Read article →