NIS2 & EU cybersecurity requirements

Get your cybersecurity and NIS2 compliance in order.

SpySecure puts your organisation’s technical security in place and keeps it managed. With Compliance Manager, we help you organise policies, risks, suppliers, actions and evidence in one place. This gives you a practical path towards demonstrable NIS2 compliance.

Book a demo → Learn more →

What does NIS2 mean for your organisation?

NIS2 makes cybersecurity a board-level responsibility

NIS2 is an EU directive that raises cybersecurity standards across Member States. It covers technical security as well as risk management, incidents, suppliers, policies, training, evidence and management involvement. Each Member State implements the directive through its own national legislation.

If NIS2 applies directly to you

Security becomes a legal obligation

Organisations within scope must implement appropriate security measures, manage cyber risks and report significant incidents. Whether your organisation is covered depends on its sector, size and activities. Applicable obligations and deadlines depend on national implementation.

If NIS2 does not apply directly to you

Your customers may still require security evidence

Organisations subject to NIS2 must also manage supplier risks. As a result, more SMEs are receiving security questionnaires, contractual security requirements, requests for evidence and audits from their customers.

Why act now?

Pressure from customers and regulators is growing

Security measures, supplier management and evidence take time to put in place. Starting now helps you avoid a costly rush when a customer, auditor or regulator asks for them.

What do you need to put in place?

NIS2 requires measures and evidence that they work consistently

The exact requirements depend on your organisation and the applicable national legislation, but the same key areas form the foundation.

Your cybersecurity

✓

Technical security

Devices, cloud, email, identities, backups and other relevant systems.

✓

Monitoring & incident response

Detecting, investigating and responding to threats, and handling incidents effectively.

✓

Employees & training

Training, phishing tests and appropriate measures to manage human risk.

Your organisation & evidence

✓

Governance & risk management

Policies, responsibilities, risks, actions and management oversight.

✓

Suppliers & supply chain

Assessing critical suppliers and documenting how relevant risks are addressed.

✓

Evidence & reporting

Recording what has been implemented, who is responsible and which actions remain open.

Why SpySecure

One partner for security measures and compliance

We explain which security measures you need and can implement and manage them directly. You organise the remaining NIS2 obligations with Compliance Manager and our support.

Managed Cybersecurity

We take care of the technical measures

We implement, monitor and manage your organisation’s security layers. This saves your team from having to manage multiple security tools and suppliers.

✓ Setup

✓ Ongoing management

✓ 24/7 monitoring & response

✓ Security reporting

Explore Managed Cybersecurity →

Compliance Manager

Stay in control of your entire NIS2 process

Compliance Manager brings requirements, actions, policies, risks, suppliers and evidence together. We help you with setup and implementation, so you can move away from spreadsheets and scattered documents.

✓ NIS2 controls & gap analysis

✓ Tasks & responsibilities

✓ Suppliers & risks

✓ Evidence & audit preparation

Explore Compliance Manager →

A practical approach to NIS2

Put security measures in place and stay on top of NIS2 compliance

See how SpySecure can manage your cybersecurity and how Compliance Manager helps you organise and document the remaining NIS2 obligations.

Book a demo →

FAQ

Frequently asked questions about NIS2

What exactly is NIS2? +

NIS2 is European legislation that requires organisations to establish and maintain their digital resilience. In the Netherlands, NIS2 has been implemented through the Dutch Cybersecurity Act (Cyberbeveiligingswet), which has been in force since 15 August 2026. The requirements go beyond IT security and cover areas such as risk management, incidents, suppliers, training, governance and evidence of compliance.

Does NIS2 apply to my organisation? +

That depends on factors such as your sector, size and services. NIS2 may also affect you indirectly as customers impose stricter security requirements on their suppliers. Unsure whether or how NIS2 affects your organisation? Contact us; we can help you work out what it means for your business.

I supply an organisation subject to NIS2. What does this mean for me? +

Organisations subject to NIS2 must manage risks in their supply chain. They may therefore require you to implement appropriate security measures and demonstrate how your cybersecurity is organised. In practice, this takes the form of security questionnaires, contractual requirements, supplier assessments, audits and requests for evidence.

What does NIS2 mean for me as a board member or director? +

Cybersecurity can no longer be left entirely to IT. Management must approve measures, oversee their implementation and have sufficient knowledge to understand cyber risks. This makes cybersecurity an explicit part of management responsibility and risk management.

Is NIS2 mainly about better IT security? +

No. Strong technical security is essential, but it is only part of the picture. NIS2 also requires policies, risk management, incident procedures, supplier management, training, clear responsibilities and evidence. You must also be able to demonstrate that these measures have actually been implemented and are being maintained.

Why do NIS2 projects often become complex, expensive and time-consuming? +

Because NIS2 affects different parts of the organisation. IT, management, HR, legal, procurement and suppliers all need to provide information and take action, while policies and evidence are often scattered across documents and spreadsheets. If technical measures still need to be selected and implemented as well, separate projects, suppliers and costs quickly multiply.

How does SpySecure keep NIS2 from becoming a major internal project? +

We can implement and manage the technical cybersecurity measures directly. For the remaining NIS2 requirements, you use Compliance Manager to organise requirements, actions, risks, policies, suppliers and evidence in one place. This saves you from having to coordinate multiple security tools, consultants, spreadsheets and separate workflows yourself.

Why start now instead of waiting until a customer or regulator asks? +

Because many of the required measures must demonstrably work in practice. Cybersecurity, incident procedures, supplier management and evidence lack credibility if they are only put in place just before an audit or customer request. Starting now allows you to improve step by step and avoid a costly rush to catch up.