The NIS2 Directive: strengthening cybersecurity in a digital world — does it apply to you too?

Privacy Law

24 August 2023

The NIS2 Directive: strengthening cybersecurity in a digital world — does it apply to you too?

Stelt u zich eens voor: u werkt al jaren met dezelfde zelfstandige. Hij stuurt facturen, factureert btw en heeft een eigen kvk-nummer. Toch krijgt u in 2026 ineens vragen van de Belastingdienst over de aard van uw samenwerking. Hoe heeft het zo ver kunnen komen?

In an era in which our society is increasingly permeated by the digital world, new challenges arise in the field of cybersecurity. More and more often we hear stories about cyberattacks that disrupt organisations or institutions. To limit this threat and its consequences as much as possible, the European Union has introduced the “Network and Information Security” (NIS2) Directive. This directive builds on the original NIS Directive from 2016 and aims to make our digital services and essential infrastructure more resilient. NIS2 expands the scope of the first directive by covering more sectors, and it also sets stricter security standards and incident reporting requirements. European countries are expected to have implemented the directive into national law by the end of 2024.

Essential services and digital service providers

In its scope, the NIS2 Directive distinguishes between two categories, namely ‘essential entities’ and ‘important entities’, as indicated in the table. The main difference between these two categories lies in the level of financial sanctions, with important entities being subject to milder sanctions and reactive supervision by the authorities. Proactive supervision, on the other hand, is reserved for essential entities. A number of sectors were already covered by the first NIS Directive, but an important difference from the first directive is that the “government” sector now falls within the scope of the directive. Government bodies carrying out activities in the field of security, defence and law enforcement are excluded from this.

Essential entities
– Energy
– Transport
– Banking
– Financial market infrastructure
– Healthcare
– Drinking water
– Digital infrastructure
– Managed ICT service providers
– Waste water
– Public administration
– Space

Important entities
– Digital providers
– Postal and courier services
– Waste management
– Food
– Chemicals
– Research
– Manufacturing

Obligations under the NIS2 Directive

The NIS2 Directive imposes a number of obligations on the entities referred to above.

Duty of care
Among other things, they are required to carry out their own risk assessment. As a result, they must take appropriate technical and organisational measures to safeguard the security of their network and information systems.

Reporting obligation
In addition, the directive requires entities to report incidents within 24 hours to the national supervisory authority, as well as to the Computer Security Incident Response Team (CSIRT), which can in turn provide help and assistance. Circumstances that make an incident reportable include, for example, the number of persons affected by the disruption or the possible financial loss. Furthermore, entities falling within the scope of the directive will also come under the supervision of an independent body, which will assess whether the entities comply with the aforementioned duty of care and reporting obligation.

Supervision
An independent supervisory authority will be established to monitor compliance with the obligations under the directive.

How can you prepare for the arrival of the NIS2 Directive?

Ahead of the arrival of the national legislation, it is important to first determine whether you fall under this new directive. That is a question of qualification that you are best off putting to an expert if you have doubts.
It is wise to set aside budget and capacity to comply with the directive.
If the answer is yes, you can already start preparing for your duty of care by taking measures that improve the security and resilience of your processes and services. Think, for example, of drawing up an incident register, mapping out and analysing company- and system-specific risks in advance, drawing up protocols for crisis management (an incident response plan), identifying alternative supply chains, and raising staff awareness (through training) of risks and security measures to be taken. ISO 27001 certification will, in principle, already achieve this. See also this article

Should you need advice or help determining whether you fall under NIS2 and in applying this new directive, do not hesitate to contact us via 020-345 0152 or info@thelegalcompany.nl

De afgelopen jaren stonden in het teken van de Wet VBAR, het wetsvoorstel dat een einde moest maken aan onduidelijkheid over de zzp’er. Het kabinet heeft delen van dat voorstel inmiddels geschrapt. Op het eerste gezicht is dat goed nieuws: minder regels, minder administratieve last. Maar in de praktijk blijven dezelfde toetsen overeind.

“De inhoud van de samenwerking is leidend, niet wat er op papier staat.”

De Belastingdienst handhaaft sinds 1 januari 2025 weer actief op schijnzelfstandigheid. En recente uitspraken van de Hoge Raad bevestigen dat rechters strikt toetsen of er sprake is van ondergeschiktheid en gezagsverhouding.

Voor uw praktijk betekent dit drie dingen. Een: leg de samenwerking duidelijk vast, met aandacht voor de inhoud. Twee: voorkom dat een zzp’er feitelijk werkt als werknemer. Drie: wees voorbereid op een controle, en weet hoe u de relatie kunt herzien als dat moet.

Heeft u vragen over uw concrete situatie? Wij sparren dagelijks met opdrachtgevers over hun zzp-relaties. Vraag een offerte op of bekijk onze Legal Safe abonnementen.