Six Persistent Myths About NIS2 in the Netherlands

Myth 1

“The Dutch NIS2 Act will surely be delayed again”

For years, delay was the norm. As a result, many organisations still assume the law’s introduction could be postponed again.

The reality is different. The Dutch Senate has passed the Cyberbeveiligingswet, the Dutch implementation of NIS2, and it comes into force on 15 August 2026. From that date, organisations within scope must meet the statutory obligations, including registration, duty of care and reporting requirements.

Myth 2

“This law only applies to large organisations and critical sectors”

Many board members immediately think of energy companies, telecom providers, hospitals or government bodies.

While the law targets organisations within designated sectors, its scope is broader than often assumed. Alongside sector, the size of the organisation also counts: companies with more than 50 employees, or annual turnover and/or a balance sheet total of more than €10 million, can fall within scope if they’re active in a designated sector – regardless of whether they consider themselves “critical”.

Myth 3

“We are not in scope for NIS2, so we don’t need to do anything”

This may be the most underestimated misconception of all.

Organisations subject to NIS2 must manage risk throughout their supply chain. As a result, suppliers, software developers, MSPs, SaaS providers and other service providers are increasingly being asked about their cyber resilience.

Even when your organisation isn’t directly in scope, an important client can still impose requirements around security measures, supplier assessments, audits or additional contractual obligations. A regulator won’t fine you directly in that case – but your client may well make the relationship or the contract conditional on it.

Myth 4

“Cybersecurity is an IT matter, not a board matter”

Cybersecurity is still regularly seen as a technical topic that belongs entirely to IT or Security.

NIS2 makes clear that cyber risk is a board-level responsibility. Directors are expected to be involved in cyber risk management and to oversee appropriate measures within the organisation. Cybersecurity therefore becomes not only a technical question, but also a governance and risk-management question.

Myth 5

“We have ISO 27001, so we’re already NIS2 compliant”

ISO 27001 provides a strong foundation for information security, but holding the certificate doesn’t automatically mean an organisation meets every requirement of NIS2.

One important point that’s often overlooked: ISO 27001 certification is scope-bound. A certificate can apply to a specific business unit, product, service or process. NIS2, by contrast, looks at the resilience, responsibilities and risks of the organisation as a whole.

NIS2 also introduces additional requirements around governance, executive oversight, supply-chain risk management and incident reporting. These obligations extend beyond the scope of a typical ISO 27001 certification and require organisations to demonstrate that cybersecurity is managed at an organisational level.

Myth 6

“We’ll wait until the regulator contacts us”

Some organisations assume they’ll automatically be approached once the law applies to them.

NIS2, however, works on the basis of self-responsibility. Organisations must assess for themselves whether they fall within scope and take their own measures to meet the obligations. The government has explicitly stated that organisations must determine this themselves.

Conclusion

Already know enough and want to move straight ahead?