NIS2 in Belgium: what do you need to do and where do you start?

The NIS2 law has applied in Belgium since October 2024. For many organisations, that means new cybersecurity obligations, and personal accountability for their board. The questions we hear most often stay the same: are we covered, what exactly do we need to do and where do we start?

In this guide, we set out what NIS2 involves and how to build your resilience step by step, based on the projects we run with our clients.

NIS2 is a European directive (EU 2022/2555) that requires organisations in critical sectors to get their cybersecurity in order. In Belgium, it was transposed into the NIS2 law, which came into force on 18 October 2024. The Centre for Cybersecurity Belgium (CCB) supervises compliance.

The law applies to organisations in 18 sectors, such as energy, transport, healthcare, drinking water, digital infrastructure, food, chemicals and manufacturing. You are covered from 50 employees, or from an annual turnover and balance sheet total above 10 million euros. Depending on your sector and size, you are an essential or an important entity.

Even if you fall outside the law yourself, NIS2 can still affect you. Organisations that are covered must also manage the risks in their supply chain, so they set requirements for their suppliers and service providers.

• Risk management: you take appropriate technical and organisational measures, such as access management, backups, patching, encryption and an incident plan.

• Incident reporting: you report a significant incident to the CCB with an early warning within 24 hours. The incident notification follows within 72 hours, and the final report within one month.

• Board accountability: the board approves the measures, oversees their implementation and takes training itself.

• Supply chain: you assess the security of your suppliers and service providers.

• Registration: essential and important entities had to register via Safeonweb@work by 18 March 2025.

Essential entities had to show by 18 April 2026 that they are getting their risk management in order. That can be done through the CCB's CyberFundamentals framework, through ISO 27001 or through an inspection. Certification must be completed by April 2027. For important entities, this conformity assessment is voluntary, and the CCB only supervises after the fact, for example after an incident. Fines go up to 10 million euros or 2% of worldwide annual turnover, and even higher for serious breaches.

Many organisations know NIS2 exists, but have no clear view of where they stand today. Threats only surface once the damage is done. Laptops stay unpatched for months and home workplaces drop out of sight. A phishing email or a wrong click is enough to get in, and security demands more specialists than an internal team can free up.

The six steps below help you bring structure to this.

Check which sector you operate in, how large your organisation is and whether you are an essential or an important entity. Check whether you are registered with the CCB. If you work for clients covered by NIS2, ask them what requirements they set for you.

A baseline assessment shows where you stand against the requirements. With the Xylos NIS2 Quickscan, you quickly see where the biggest gaps are and which measures need attention first. A security roadmap follows: what you tackle when, and with which budget.

Start with the measures that remove the most risk. Think of multi-factor authentication and deliberately managed access, managed and patched laptops, and backups you have actually tested. Tools such as Microsoft Intune, Defender and Entra ID make sure every device and every user follows the same rules.

Also decide what you will do if things go wrong anyway. A ransomware attack often hits the backups too, so choose a solution that is protected against it and lets you recover quickly.

NIS2 requires you to spot and report an incident quickly. That only works if someone monitors your environment continuously. A Security Operations Center (SOC) follows up alerts 24/7, investigates them and intervenes. This service is also called managed detection and response (MDR). That way you can issue an early warning within 24 hours, with the information the CCB asks for.

A large share of incidents start with a click. An awareness programme with realistic phishing simulations teaches your people to recognise risks, and you keep repeating it. The board is part of this too: NIS2 requires its members to take training themselves, so they can assess the risks and follow up on the measures.

NIS2 is an ongoing process. Threats change, and so does your environment. Evaluate your measures regularly, update your roadmap and keep your documentation ready for an audit or inspection.

• Does the partner know the Belgian NIS2 law and the CCB's CyberFundamentals framework?

• Can the partner advise you and also implement the measures technically?

• Is there a SOC that monitors your environment 24/7, and who intervenes in an incident?

• How does the partner help your people and your board recognise risks?

• Is the partner itself ISO 27001 certified?

Xylos is a Belgian family-owned tech company headquartered in Antwerp, with forty years of experience and more than 150 certified experts. Xylos is ISO 27001 certified and a Microsoft Solutions Partner for Security.

Xylos helps organisations comply with NIS2 and build their resilience. With Cyber Resilience, you map your risks through assessments, a security roadmap and NIS2 support with the NIS2 Quickscan and Advisory. Secure Workplace protects every device, every employee and every location. Applied Security combines the Microsoft Security Stack with HPE, Palo Alto Networks and Cohesity for ransomware recovery. Managed Security monitors your environment 24/7 with our SOC, together with Eye Security. The Cybersecurity Awareness Programme turns your people into your first line of defence.

Everything runs through one team with a single point of contact.

Curious where your organisation stands? Take the NIS2 Quickscan or talk to one of our experts.