In recent years, developments such as the COVID-19 pandemic, the war in Ukraine, cyber threats, and the impacts of climate change have increasingly strained society’s and the economy’s security. In response, the European Union has been working on the NIS2 directive since 2020. The directive aims to enhance the digital and economic resilience of EU member states.
The NIS2 directive focuses on risks to network and information systems, including cybersecurity risks. It aims to promote greater harmonisation across Europe and raise cybersecurity standards among businesses and organisations. The NIS2 directive succeeds the first NIS directive, which was transposed into Dutch law in 2016 as the ‘Wet beveiliging netwerk- en informatiesystemen (Wbni)’.
The NIS2 directive is transposed into Dutch legislation through the Cyberbeveiligingswet (Cbw). Now in force, the Cyberbeveiligingswet replaces the Wbni, which implemented the first NIS directive.
NIS2 directive criteria
Organisations automatically fall under the NIS2 directive and, by extension, the Cbw if they operate in designated sectors and meet the criteria to be classified as ‘essential’ or ‘important’ entities. In this context, ‘automatically’ means the directive does not allow member states to determine which organisations are covered, nor does it permit them to decide when the obligations take effect. The obligations of the Cyberbeveiligingswet and its subsidiary regulations now apply directly to these organisations, as the law has entered into force.
