{"id":2714,"date":"2026-02-28T11:55:06","date_gmt":"2026-02-28T10:55:06","guid":{"rendered":"https:\/\/www.canyonclan.com\/?p=2714"},"modified":"2026-02-28T11:55:55","modified_gmt":"2026-02-28T10:55:55","slug":"nis2-wat-betekent-dit-concreet-voor-jouw-onderneming","status":"publish","type":"post","link":"https:\/\/www.canyonclan.com\/en\/nis2-wat-betekent-dit-concreet-voor-jouw-onderneming\/","title":{"rendered":"NIS2: What does this mean for your company?"},"content":{"rendered":"<h2 class=\"wp-block-heading\">What is NIS2?<\/h2>\n\n\n\n<p>The NIS2 directive requires companies to structurally organize cybersecurity at the board level. IT security is no longer seen as a technical afterthought, but as a core management responsibility.<\/p>\n\n\n\n<p>Directors must actively monitor, understand risks and be able to demonstrate that appropriate measures have been taken.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">When does NIS2 apply to you?<\/h2>\n\n\n\n<p>Your company falls under NIS2 when:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You operate in one of the following critical sectors where failure could cause direct societal disruption: energy, transportation, banking, financial market infrastructure, healthcare, drinking water, wastewater, digital infrastructure, government services, aerospace, postal and courier services, waste management, chemical industry, food production and distribution, production of critical goods, digital platform services, or research organizations.<\/li>\n\n\n\n<li>You have more than 50 employees <strong>or<\/strong><\/li>\n\n\n\n<li>You have a turnover of more than 10 million euros<\/li>\n<\/ul>\n\n\n\n<p>Smaller companies can also fall under NIS2 if they play a key role in a critical chain.<\/p>\n\n\n\n<p>In addition, you may incur indirect obligations if you are a supplier to an organization that is NIS2-compliant. Customers will then include stricter security clauses in their contracts.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What specifically do you need to arrange?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">1. Risk management<\/h3>\n\n\n\n<p>You must be able to demonstrate that you systematically manage cyber risks.<\/p>\n\n\n\n<p>This includes, among other things:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Formal risk analysis<\/strong> (annual cyber risk assessment with impact, likelihood and action plan)<\/li>\n\n\n\n<li><strong>Clear cybersecurity policy<\/strong> (recorded document with roles, responsibilities and security rules)<\/li>\n\n\n\n<li><strong>Incident response plan<\/strong> (step-by-step plan with clear roles and reporting procedures for cyber incidents)<\/li>\n\n\n\n<li><strong>Backup and recovery procedures<\/strong> (automatic backups with periodic recovery tests)<\/li>\n\n\n\n<li><strong>Access control with MFA<\/strong> (role-based access and multi-factor authentication for all users)<\/li>\n\n\n\n<li><strong>Patch and update management<\/strong> (structured process to install security updates in a timely manner)<\/li>\n\n\n\n<li><strong>Logging and monitoring<\/strong> (central registration and follow-up of suspicious activities)<\/li>\n\n\n\n<li><strong>Employee training<\/strong> (regular security awareness training and phishing simulations)<\/li>\n\n\n\n<li><strong>Supplier evaluation<\/strong> (screening and contractual agreements regarding cybersecurity with external partners)<\/li>\n<\/ul>\n\n\n\n<p>You must be able to demonstrate what you do, how you do it and who is responsible, so that processes can be repeated and audited in the same way.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. Incident reporting obligation<\/h3>\n\n\n\n<p>In the event of a serious incident, fixed deadlines apply:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Within 24 hours: first warning<\/li>\n\n\n\n<li>Within 72 hours: complete notification<\/li>\n\n\n\n<li>Within 1 month: final report<\/li>\n<\/ul>\n\n\n\n<p>This requires pre-defined procedures, roles and communication flows.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Responsibility of directors<\/h3>\n\n\n\n<p>The management:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Oversees cybersecurity<\/li>\n\n\n\n<li>Follows training on cyber risks<\/li>\n\n\n\n<li>Can be held personally liable for gross negligence<\/li>\n<\/ul>\n\n\n\n<p>Cybersecurity is therefore structurally placed on the board&#039;s agenda and forms part of the overall corporate strategy and risk management.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Sanctions<\/h3>\n\n\n\n<p>Supervisors can conduct audits and impose sanctions.<\/p>\n\n\n\n<p>Fines can amount to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>10 million euros or 2% of global turnover (essential entities)<\/li>\n\n\n\n<li>7 million euros or 1.4% of turnover (major entities)<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What does this mean in practice?<\/h2>\n\n\n\n<p>For many companies, NIS2 means:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Introducing formal governance<\/strong> (clearly define roles, responsibilities and reporting lines around cybersecurity)<\/li>\n\n\n\n<li><strong>Write a security policy<\/strong> (document concrete guidelines and procedures for system and data security)<\/li>\n\n\n\n<li><strong>Screening suppliers<\/strong> (assessing IT and other partners on their security measures and recording contractual agreements)<\/li>\n\n\n\n<li><strong>Testing incident procedures<\/strong> (carry out exercises and simulations to check whether the response plan works in practice)<\/li>\n\n\n\n<li><strong>Actively involve management<\/strong> (regular reporting to management and formal oversight of cyber risks)<\/li>\n<\/ul>\n\n\n\n<p>A good approach therefore not only strengthens compliance with regulations, but also increases the resilience of your organization and the trust of customers and partners.<\/p>\n\n\n\n<p>Are you unsure whether your company falls under NIS2 and where the greatest risks lie? Then it&#039;s best to start with a targeted gap analysis.<\/p>\n\n\n\n<p>A gap analysis is a practical assessment in which we compare what NIS2 expects with what your organization already has in place. We map the differences and clarify where the greatest risks and priorities lie.<\/p>\n\n\n\n<p>Curious how we approach this? Here&#039;s more information about our security audit:<br><a href=\"https:\/\/www.canyonclan.com\/en\/security-audit\/\">https:\/\/www.canyonclan.com\/security-audit<\/a><\/p>\n\n\n\n<p><\/p>","protected":false},"excerpt":{"rendered":"<p>Wat is NIS2? De NIS2-richtlijn verplicht bedrijven om cybersecurity structureel te organiseren op directieniveau. IT-beveiliging wordt dus niet langer gezien als een technische bijzaak, maar als een kernverantwoordelijkheid van het management. Bestuurders moeten actief toezicht houden, risico\u2019s begrijpen en kunnen aantonen dat er passende maatregelen genomen zijn. Wanneer is NIS2 voor jou van toepassing? Je [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":2716,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[47,46],"tags":[],"class_list":["post-2714","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-nis2","category-security"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.canyonclan.com\/en\/wp-json\/wp\/v2\/posts\/2714","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.canyonclan.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.canyonclan.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.canyonclan.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.canyonclan.com\/en\/wp-json\/wp\/v2\/comments?post=2714"}],"version-history":[{"count":1,"href":"https:\/\/www.canyonclan.com\/en\/wp-json\/wp\/v2\/posts\/2714\/revisions"}],"predecessor-version":[{"id":2715,"href":"https:\/\/www.canyonclan.com\/en\/wp-json\/wp\/v2\/posts\/2714\/revisions\/2715"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.canyonclan.com\/en\/wp-json\/wp\/v2\/media\/2716"}],"wp:attachment":[{"href":"https:\/\/www.canyonclan.com\/en\/wp-json\/wp\/v2\/media?parent=2714"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.canyonclan.com\/en\/wp-json\/wp\/v2\/categories?post=2714"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.canyonclan.com\/en\/wp-json\/wp\/v2\/tags?post=2714"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}