NIS2 Checklist & Awareness Training Guide (2026 Update)

16 August 2026 • NIS2

A person reading a large open book held in both hands, with a shield and checkmark on the cover (illustration)

NIS2 is no longer something to prepare for. In the Netherlands the directive became enforceable national law on 15 August 2026, when the Cyberbeveiligingswet (Cbw) entered into force without a transition period. Around 8,000 Dutch organizations now have to register, manage their cyber risks, train their management and report serious incidents.

The NIS2 directive (also referred to as NIS-2 or NIS 2.0) requires organizations across 18 sectors to implement robust cyber security measures, including security awareness training for all employees.

What NIS2 demands in practice, and how the Cyberbeveiligingswet translates it into Dutch obligations, is still hard to pin down. The law works in three layers, supervision is spread across sectors, and the European Commission is already working on amendments.

In this guide, we break down everything you need to know: what NIS2 is, who it applies to, the complete NIS2 checklist for 2026, and how to make your organization audit-ready.

What is the NIS2 directive?

The NIS2 directive (Directive (EU) 2022/2555) is the European Union’s updated framework for network and information security. It replaced the original NIS directive (NIS1) from 2016, which was the EU’s first piece of cybersecurity legislation.

NIS2 entered into force on 16 January 2023, and EU member states were required to transpose it into national law by 17 October 2024. However, most member states, including the Netherlands, missed this deadline.

The directive aims to achieve a high common level of cyber security across the EU by requiring organizations in critical sectors to:

Implement risk-based cyber security measures
Report significant incidents to authorities within strict timelines
Ensure management bodies are trained and accountable
Provide regular awareness training to all employees
Manage supply chain security risks

An estimated 160,000 entities across the EU fall under NIS2’s scope. That’s a tenfold increase compared to NIS1.

NIS2 starts with your people

Attackers target people before they target systems. That is why NIS2 expects regular security awareness training for every employee, management included. Guardey turns that into short weekly challenges and keeps the evidence ready for your supervisor.

Discover security awareness training

NIS2 vs NIS1: what changed?

The original NIS directive was a solid starting point, but it had significant gaps. NIS2 addresses these across the board. Here’s a quick summary of the most important changes:

Aspect	NIS1	NIS2
Sectors covered	7 sectors	18 sectors
Entities in scope	~15,000	~160,000
Incident reporting	No specific timeline	24h / 72h / 1 month
Penalties	Determined per member state	Up to €10M or 2% of turnover
Management liability	Not addressed	Personal liability for gross negligence
Supply chain	Not explicitly required	Mandatory risk management
Management training	Not required	Mandatory for board and C-suite

Want to dive deeper into the differences? Read our full comparison: What is the difference between NIS1 and NIS2?

A person comparing a thin old booklet with a thick new binder that has a shield on the cover (illustration)

NIS2 legislation in Europe

NIS2 is an EU directive, which means it doesn’t apply directly to organizations. Each member state must transpose it into national law. Here’s where things stand in 2026.

Implementation status across the EU

Implementation progress varies significantly. Countries like Belgium, Croatia, and Italy were among the first to adopt national legislation. Others, including the Netherlands and Germany, took longer.

The European Commission opened infringement proceedings against 23 member states for missing the October 2024 transposition deadline, and sent reasoned opinions to 19 of them in May 2025. By May 2026, 22 of the 27 member states had adopted transposing legislation. The stragglers felt the pressure: on 8 July 2026 the Commission referred the Netherlands and Spain to the Court of Justice of the EU for failing to notify complete transposition. The Dutch law took effect five weeks later.

The January 2026 EU cybersecurity package

On 20 January 2026, the European Commission published a proposal to amend the NIS2 directive as part of a broader cybersecurity package. The key changes include:

Simplified jurisdictional rules for organizations operating across multiple EU countries
Certification-based compliance pathways, allowing organizations to demonstrate compliance through recognized certifications
Enhanced ransomware reporting with more detailed incident data requirements
Expanded scope to include providers of European Digital Identity Wallets and submarine data infrastructure
Reclassification of roughly 22,500 entities to lower the compliance burden for smaller organizations
A strengthened role for ENISA in coordinating cross-border supervision

The proposal builds on the Digital Omnibus package of November 2025, which already streamlined incident reporting and clarified how NIS2 relates to DORA and the CER directive. It now follows the ordinary legislative procedure, with negotiations in the European Parliament and the Council running through 2026 and a transposition period once it is adopted. Until then, nothing changes about the obligations you have today.

NIS2 in the Netherlands: the Cyberbeveiligingswet (Cwb)

In the Netherlands, the NIS2 directive is being transposed into the Cyberbeveiligingswet (Cwb). This law replaces the current Wbni (Wet beveiliging netwerk- en informatiesystemen).

A person stamping a document with a wax seal, a small Dutch flag on the desk (illustration)

Current status (March 2026)

The Tweede Kamer passed the bill on 15 April 2026, the Eerste Kamer followed on 7 July 2026
The Cyberbeveiligingswet entered into force on 15 August 2026, together with the Wet weerbaarheid kritieke entiteiten (Wwke)
There is no transition period: every obligation, registration included, applies from day one
Around 8,000 organizations fall under the Cbw, and roughly 500 more under the Wwke
The Cbw replaces the Wbni, so organizations that already reported under the old law are now held to the wider NIS2 requirements

Three regulatory components

The Dutch implementation consists of three layers:

The Cyberbeveiligingswet, which is the primary law implementing NIS2
The Cyberbeveiligingsbesluit (AMvB), a General Administrative Order defining specific obligations
Sector-specific ministerial regulations with tailored requirements per sector

If your organization is in scope, the question is no longer whether to act but what to do first. These five steps cover the obligations that started immediately.

Confirm whether you are in scope. Check your sector and size against the criteria below. You determine this yourself, nobody sends you a letter telling you that you are covered.
Register your organization. Registration in the national entity register runs through the NCSC, at mijn.ncsc.nl. It has been mandatory since 15 August 2026 and organizations are responsible for registering on time themselves.
Get your management trained. Board members have to follow cyber security training and can be held personally liable. Our NIS2 training for executives covers exactly this requirement.
Set up your incident reporting process. Decide now who reports what and to whom, because the clock is short: an early warning within 24 hours, a full notification within 72 hours and a final report within one month.
Start recurring awareness training. The duty of care covers your people as much as your systems. Short, repeated security awareness training with documented results is what turns a requirement into evidence.

Supervisory authorities have signalled that they will use the first year mainly to get to know the newly regulated sectors, through questionnaires and introductory meetings. A gentle start to supervision is not the same as a later start to the obligations, and organizations that can show a systematic approach will come out of that first conversation in far better shape.

Key Dutch obligations

Organizations falling under the Cyberbeveiligingswet must comply with four core obligations:

Obligation	What it means	NIS2 basis
Zorgplicht (duty of care)	Implement appropriate technical and organizational measures to manage cyber security risks	Article 21
Registratieplicht (registration duty)	Register your organization in the national entity register through the NCSC, at mijn.ncsc.nl	Article 3 and Article 27
Trainingsplicht voor bestuurders (management training obligation)	Board members and management must undergo cyber security training	Article 20(2)
Meldplicht (incident reporting obligation)	Report significant incidents to the NCSC within the prescribed timelines: an early warning within 24 hours, a notification within 72 hours and a final report within one month	Article 23

Supervisory authorities

Registration, incident reporting and enforcement are handled by different organizations:

Task	Who handles it
Entity register	The NCSC (Nationaal Cyber Security Centrum)
Incident reporting	The NCSC as the main incident response team, alongside sector-specific CSIRTs for some sectors
Supervision and enforcement	Sector-specific supervisory authorities, designated through ministerial regulations, check whether organizations actually meet their obligations

For organizations in the healthcare sector, the regulatory landscape is particularly complex, combining NIS2 requirements with existing healthcare-specific regulations around patient data protection.

Who does NIS2 apply to?

NIS2 applies to organizations based on two criteria: sector and size.

A hand holding a magnifying glass over a power plant, a hospital and a factory (illustration)

The directive distinguishes two categories of entities, each with its own sectors, supervision and fines:

Aspect	Essential entities (highly critical sectors)	Important entities (other critical sectors)
Sectors	Energy (electricity, oil, gas, hydrogen, district heating) Transport (air, rail, water, road) Banking and financial market infrastructures Healthcare (hospitals, laboratories, medical device manufacturers, pharmacies) Drinking water and wastewater Digital infrastructure (DNS, TLD registries, cloud providers, data centers, CDNs) ICT service management (managed service providers, managed security service providers) Public administration Space	Postal and courier services Waste management Manufacturing (medical devices, electronics, machinery, motor vehicles) Food production, processing, and distribution Chemical production and distribution Digital providers (online marketplaces, search engines, social networking platforms) Research organizations
Supervision	Proactive supervision: regular audits and inspections	Reactive supervision: investigations only after incidents or reports of non-compliance
Maximum fine	Up to €10 million or 2% of global annual turnover	Up to €7 million or 1.4% of global annual turnover

Size thresholds

Organizations in these sectors are in scope if they meet the following size criteria:

Medium enterprises: 50+ employees or €10 million+ annual turnover
Large enterprises: 250+ employees or €50 million+ annual turnover

Some entities are in scope regardless of size, including DNS providers, TLD registries, and (under the proposed 2026 amendments) providers of European Digital Identity Wallets.

NIS2 checklist (2026)

Use this comprehensive checklist to verify your organization meets all NIS2 requirements. This goes beyond just awareness training and covers the full spectrum of NIS2 obligations to help you prepare for compliance and audits.

A person ticking boxes on a very long checklist that unrolls onto the floor (illustration)

Area	What to have in place	Who owns it	NIS2 basis
Governance and management accountability	Management body has formally approved the cybersecurity risk management measures Board members and C-suite have completed cyber security training A designated person or team (e.g., CISO, compliance officer) is responsible for NIS2 compliance Cybersecurity is a standing agenda item, with budget allocated for measures and training The governance structure is documented and communicated, and management is aware of its personal liability	Board and management, supported by the CISO or compliance officer	Article 20
Risk management and security measures	A formal risk assessment is conducted and reviewed regularly Risk management policies, procedures, roles and responsibilities are documented, approved and communicated Technical measures: firewalls, intrusion detection, encryption, access controls, network segmentation and MFA for critical systems and remote access Business continuity, disaster recovery and backup procedures are documented and tested regularly Vulnerability management (regular scanning, patching) and secure development practices for in-house software	CISO and IT, with risk management approved by the board	Article 21(1) and 21(2)(a), (c), (e), (j)
Incident reporting and response	An incident response plan is documented and tested, with roles assigned and team members trained Criteria define what counts as a “significant incident” Procedures for the 24-hour early warning, the 72-hour notification and the 1-month final report are in place, and staff know how to trigger them Contact details for the national CSIRT (NCSC in the Netherlands) are readily available Tabletop exercises at least annually, with post-incident reviews and documented lessons learned	CISO and the incident response team	Article 23 (reporting) and Article 21(2)(b) (incident handling)
Supply chain security	An inventory of critical suppliers and service providers exists Supplier contracts include cybersecurity requirements and incident notification clauses Suppliers are assessed for their cybersecurity posture (due diligence), and third-party risks are identified and mitigated Critical suppliers’ access to your systems is monitored and controlled Supplier security is monitored and reviewed over time	Procurement together with the CISO	Article 21(2)(d)
Security awareness training	All employees receive regular security awareness training, ongoing rather than once (monthly or weekly recommended) Management and board members receive dedicated cyber security training New employees are trained during onboarding, as are contractors and third-party personnel with access Content covers phishing, social engineering, password security, data handling, incident reporting and sector-specific threats, updated with the latest threat intelligence Phishing simulations run regularly, completion rates and scores are tracked, and evidence is stored for compliance audits	HR and the CISO, the board for its own training	Article 20(2) and Article 21(2)(g)
Registration and notification	Your organization has determined whether it qualifies as an essential or important entity Registration in the entity register at the NCSC is completed (mandatory in the Netherlands since 15 August 2026) Contact details for incident reporting (CSIRT/supervisory authority) are up to date Notification procedures are documented and assigned to specific roles NIS2 scope documentation is maintained (which systems, services, and processes are covered)	Compliance officer or legal	Article 3 (classification and registration) and Article 27 (registry for digital providers such as DNS and cloud)
Information security policies and documentation	An information security policy is documented and approved by management Acceptable use, remote work and BYOD policies are in place and communicated to all employees Access control, data classification and handling, and password policies (complexity, MFA, no reuse) are documented Physical security for facilities housing critical systems, cryptographic controls and encryption policies are documented All policies are reviewed and updated at least annually	CISO, with approval from management	Article 21(2)(a), (h) and (i)
Monitoring, auditing, and continuous improvement	Security monitoring is in place (log management, SIEM, alerting) Regular internal or external security audits, and penetration testing at least annually Cybersecurity KPIs are defined and reported to management Findings from audits and incidents lead to documented corrective actions The program is reviewed annually, threat intelligence is incorporated, and NIS2 compliance is checked before each audit cycle	CISO, with KPIs reported to management	Article 21(2)(f) and 21(4)

The one NIS2 requirement you can tick off this week

Awareness training is where most plans stall. Guardey turns it into short, gamified challenges, with the reporting built in. Try it free for 14 days, no payment details needed.

Start your free trial

NIS2 certification

A common question: is there an official NIS2 certification? The short answer is no, not yet.

Unlike ISO 27001, which has a well-established certification process, NIS2 is a legal requirement enforced through national supervisory authorities. There is no single “NIS2 certified” badge you can obtain.

However, there are important developments.

A person holding an ISO certificate in front of an empty shelf, a question mark above her head (illustration)

Certification-based compliance (proposed in 2026)

The European Commission’s January 2026 cybersecurity package proposes certification-based compliance pathways. This means organizations holding certain recognized certifications may be able to demonstrate NIS2 compliance, or at least partial compliance, through these certifications.

ISO 27001 as a foundation

ISO 27001 is widely recognized as the closest existing standard to NIS2 requirements. Organizations with ISO 27001 certification will find that many NIS2 requirements are already covered. However, NIS2 has additional requirements that go beyond ISO 27001, including:

Specific incident reporting timelines (24h, 72h, 1 month)
Management liability and mandatory board-level training
Supply chain security assessments
Sector-specific requirements

NIS2 quality marks and readiness assessments

Several third-party organizations offer NIS2 readiness assessments, maturity scans, or quality marks. While these are not official certifications, they can help organizations benchmark their compliance and demonstrate their commitment to stakeholders.

NIS2 and security awareness training

Security awareness training is one of the most explicit requirements in the NIS2 directive. Article 20 states that management bodies must undergo training and that organizations should offer similar training to their employees on a regular basis.

Three colleagues each looking at a smartphone with a shield on the screen, a stopwatch showing three minutes above them (illustration)

Why NIS2 emphasizes awareness training

The numbers make it clear. According to the ENISA Threat Landscape 2025 report:

Phishing accounts for 60% of all intrusion access points
Over 80% of social engineering attacks now leverage AI-generated content
53.7% of cyber incidents targeted organizations classified as essential entities under NIS2
Public administration alone accounted for 38.2% of targeted attacks

The human factor remains the number one vulnerability. Without trained employees who can recognize and report threats, even the most sophisticated technical defenses can be bypassed.

What NIS2 expects from your awareness training program

Expectation	What it means
Regular training, not once a year	Ongoing, regular training is expected.
Management participation	Board members and C-suite must participate.
Relevance	Training must cover current and emerging threats, including AI-powered attacks.
Evidence	You must be able to demonstrate that training is taking place and is effective.
Coverage	All employees with access to systems and data, including contractors.

How Guardey helps you meet NIS2 awareness requirements

With Guardey, your employees take on weekly cyber security challenges that take no more than three minutes to complete. Topics include phishing recognition, password security, data handling, social engineering, and more, all aligned with NIS2 requirements.

The gamified approach ensures high engagement and completion rates. And through Guardey’s reporting dashboard, you can demonstrate compliance to auditors with evidence of:

Training completion rates per employee and department
Assessment scores and knowledge trends
Phishing simulation results and improvement over time
Topic coverage aligned with NIS2 requirements

Common mistakes in NIS2 compliance

Many organizations underestimate the effort required for NIS2 compliance. Here are the pitfalls we see most often.

A manager carrying a huge stack of binders to an overwhelmed IT colleague behind two monitors (illustration)

Mistake	Why it goes wrong	What to do instead
Treating the first year as a grace period	The Cyberbeveiligingswet entered into force on 15 August 2026 without a transition period. Supervisors starting gently is not the same as obligations starting later.	Register and document now. Organizations that wait for a first inspection end up doing months of work under time pressure, with a supervisor already watching.
Treating NIS2 as an IT-only problem	NIS2 explicitly requires management accountability. This is not something you can delegate entirely to your IT department.	Make sure board members are trained, approve the cybersecurity measures and know they can be held personally liable.
Ignoring supply chain requirements	Many organizations focus on their own security but overlook their suppliers.	Assess and manage the cybersecurity risks in your entire supply chain, as NIS2 requires.
Annual awareness training only	A single yearly training session does not meet the “regular” training requirement.	Show the ongoing engagement auditors expect: monthly micro-learnings, regular phishing simulations, and continuous measurement.
Not knowing whether NIS2 applies to you	Surprisingly, many organizations haven’t even assessed whether they fall under NIS2’s scope.	Don’t assume you’re excluded. Check the sector and size criteria carefully.
No incident response testing	Having an incident response plan on paper is not enough. NIS2 expects you to test it.	Conduct tabletop exercises, simulate incidents, and ensure your team can meet the 24-hour early warning deadline.
Missing the registration requirement	Nobody registers your organization for you and no letter arrives to remind you, which makes it the easiest obligation of all to miss.	Register your organization yourself in the entity register at the NCSC, through mijn.ncsc.nl, as the Cyberbeveiligingswet requires.

NIS2 vs ISO 27001 vs DORA: how do they compare?

Many organizations need to comply with multiple frameworks. Here’s how NIS2 compares to ISO 27001 and DORA (Digital Operational Resilience Act).

Requirement	NIS2	ISO 27001	DORA
Type	EU Directive (legal requirement)	International standard (voluntary)	EU Regulation (legal requirement)
Scope	18 sectors, essential and important entities	Any organization (by choice)	Financial sector only
Awareness training mandatory?	Yes (Article 20)	Yes (Clause 7.3, A.6.3)	Yes (Article 13)
Management training required?	Yes (mandatory, board-level)	Required (clause 5.1)	Yes (mandatory, board-level)
Incident reporting timeline	24h / 72h / 1 month	Not specified (define your own)	4h / 72h (major ICT incidents)
Supply chain security	Mandatory	A.5.19-A.5.22 (supplier controls)	Mandatory (ICT third-party risk)
Penalties	Up to €10M or 2% of turnover	Loss of certification	Up to €10M or 2% of turnover
Certification available?	Not yet (proposed in 2026)	Yes (accredited certification bodies)	Not yet
Personal liability for management?	Yes	No	Yes

The good news: organizations with ISO 27001 certification have a strong head start on NIS2 compliance. The risk management approach, documentation requirements, and awareness training obligations overlap significantly.

Frequently asked questions about the NIS2 directive

What does NIS2 stand for?

NIS2 stands for the Network and Information Security Directive 2. It is also commonly written as NIS-2 or NIS 2.0. It is the second version of the EU’s cybersecurity directive, replacing the original NIS directive from 2016.

When does NIS2 come into force in the Netherlands?

It already has. The Cyberbeveiligingswet entered into force on 15 August 2026, after the Tweede Kamer passed the bill on 15 April 2026 and the Eerste Kamer on 7 July 2026. There is no transition period, so the duty of care, the registration duty, management training and incident reporting all apply right now.

Is security awareness training mandatory under NIS2?

Yes. Article 20 of the NIS2 directive explicitly requires management bodies to undergo cybersecurity training and to offer similar training to employees on a regular basis. This makes awareness training a legal obligation, not optional.

Does NIS2 apply to SMEs?

It can. Organizations with 50 or more employees or €10 million or more in annual turnover operating in one of the 18 covered sectors are in scope. Some entities are included regardless of size (e.g., DNS providers, TLD registries).

What are the penalties for NIS2 non-compliance?

Essential entities face fines of up to €10 million or 2% of global annual turnover. Important entities face up to €7 million or 1.4% of global turnover. Additionally, management can be held personally liable.

Can I get NIS2 certified?

Not currently. There is no official NIS2 certification. However, the European Commission’s 2026 cybersecurity package proposes certification-based compliance pathways. ISO 27001 certification covers many NIS2 requirements and is recognized by auditors as a strong foundation.

How is NIS2 different from GDPR?

GDPR focuses on protecting personal data. NIS2 focuses on the security of network and information systems more broadly. They are complementary: NIS2 measures help protect the systems that process personal data, supporting GDPR compliance as well.

What is the relationship between NIS2 and the Cyberbeveiligingswet?

The Cyberbeveiligingswet is the Dutch national law that implements the EU NIS2 directive. It translates the directive’s requirements into enforceable Dutch legislation and replaced the previous Wbni (Wet beveiliging netwerk- en informatiesystemen) on 15 August 2026. Put simply: NIS2 says what Europe wants, the Cbw says what you can be held to in the Netherlands, and it is the Cbw that a Dutch supervisor will hold you to.

What to do now that the NIS2 applies

NIS2 stopped being a future concern on 15 August 2026. Registration, the duty of care, management training and incident reporting apply today, and supervisors will start asking about them within the year. The organizations that come out of that first conversation well are the ones that can show what they do, not the ones that can explain what they intended.

With Guardey Security Awareness Training, your employees receive 3-minute weekly micro-learnings covering phishing, data handling, incident reporting, and more. All aligned with NIS2 requirements, with full reporting for compliance audits.

Meet the NIS2 training requirement, and prove it

Guardey trains every employee in minutes a week and documents it automatically, so you always have the evidence ready. See it live in a demo.

Schedule a demo

Dinela Lokvancic Marketing Specialist Dinela keeps Guardey's online presence up to date. She creates content that makes complex cyber security topics accessible, and helps organizations understand why security awareness training matters for their teams.

NIS2 Directive: The Complete Guide (2026)