NIS2 makes cybersecurity a matter for the administration.
By: Hans Risseeuw
Cybersecurity is no longer solely the domain of the IT department. Since August 15, 2026, the Cybersecurity Act has been in force, the Dutch implementation of the European NIS2 Directive. As a result, new obligations regarding digital resilience apply to over 8,000 organizations. The responsibility for this also explicitly lies with the board.
The Cybersecurity Act aims to increase the resilience of essential and important organizations. Organizations subject to the Act face, among other things, a duty of care, registration obligation and reporting obligation. They must take appropriate measures to protect their services and information and report significant cyber incidents to the relevant CSIRT and the regulator.[1]
This also changes the position of cybersecurity within the organization. Digital security affects the continuity of business operations and requires demonstrable risk management. The Cybersecurity Decree further elaborates, among other things, on the duty of care and the training obligation for directors.
Also look at the chain
Not every FHI member falls directly under the Cybersecurity Act. Nevertheless, the law can also have consequences for other technology companies.
The reason is the supply chain. Organizations falling under NIS2 must pay attention to security risks surrounding their suppliers. For a manufacturer, technical service provider, system integrator, or other supplier, cybersecurity can therefore become part of the requirements a customer imposes on the collaboration.
FHI Partner Together Digitally Safe Therefore, it focuses not only on organizations that fall directly under NIS2. The platform also offers support to SMEs and suppliers and pays specific attention to supply chain risks.[2]
For companies, therefore, the only relevant question is: does my organization fall under the Cybersecurity Act? The question of which of my customers fall under it also deserves attention.
From technical risk to business risk
The broader responsibility for cybersecurity makes it necessary to also consider the consequences of incidents. After all, a cyber incident is not solely a technical problem. It can impact business operations and have financial or legal consequences.
This also brings insurability into play. Cyber insurance can be part of a company's broader risk management. In addition, there are insurance policies for business, professional, and directors' liability. Which risks are actually covered depends on the specific policy and situation.
FHI members can turn to insurance partner Klap for this. Klap offers business insurance, including cyber insurance and directors' and officers' liability insurance. FHI members pay a significantly lower premium.[3]
Naturally, insurance does not replace the necessary security measures. The first step remains gaining insight into the digital risks and taking measures to manage those risks.
Demonstrably digitally resilient
It is precisely this demonstrable character that is becoming more important. Increasingly, suppliers must not only state that their security is in order, but be able to substantiate this to clients.
FHI collaborates with Samen Digitaal Veilig for this purpose. The platform offers companies support, documents, and webinars, among other things, to get started with digital resilience. Additionally, Samen Digitaal Veilig offers suppliers a NIS2 Supply Chain certification; organizations that are themselves NIS2 certified can use the platform to manage and assess supplier risks.[4]
NIS2 thereby makes cybersecurity broader than compliance alone. For technology companies, digital resilience touches upon business continuity, customer relationships, and governance. The relevant question is therefore not only whether an organization formally falls under the Cybersecurity Act, but above all whether it knows its digital risks and can demonstrate that it manages them.
