NIS2 is in effect: can you demonstrate your organization is cyber resilient?
In recent years, NIS2 has mainly been about awareness, impact analyses and preparations. The phase has now begun in which organizations must not only make plans, but above all demonstrate that they’re actually implementing them. The question is no longer: ‘Do we need to do something with NIS2?’ but: ‘Can we demonstrate that we are managing our cyber risks?’.
NIS2 marks a fundamental change in the way organizations deal with cybersecurity. It’s no longer solely an IT matter, but a management responsibility that directly affects risk management, business continuity, supplier management and compliance.
In the Netherlands, an estimated 8,000 to 10,000 organizations are directly subject to the Cybersecurity Act (Cyberbeveiligingswet), the Dutch implementation of NIS2, which came into force on 15 August 2026. The indirect impact is even greater: an estimated 50,000 to 60,000 suppliers, including many small and medium sized businesses, will face stricter cybersecurity requirements from customers and clients through supply chain due diligence obligations.
From compliance to resilience
Many organizations still primarily approach NIS2 as a legal requirement.
Although compliance is important, its real value lies in structurally strengthening digital resilience and making cyber risks manageable.
This is not only about technology, but also about governance, processes, people and the supply chain in which organizations operate. Organizations that successfully implement NIS2 treat cybersecurity as a strategic business risk that is directly connected to business continuity, reputation and trust in the market.
Management at the helm
One of the most important changes under NIS2 is the explicit responsibility of management. Whereas cybersecurity was often delegated to IT or security in the past, NIS2 requires active and demonstrable involvement from executive and management teams. Leaders must understand cyber risks, oversee measures and participate in decision making on digital resilience. This shifts cybersecurity from an operational IT issue to a responsibility at the management level. The topic should be a structural part of management meetings, risk assessments and strategic decision making.
The supply chain becomes the new challenge
For many organizations, the greatest challenge is not only within their own walls, but also in the supply chain. NIS2 requires risks at suppliers, partners and service providers to be actively managed. A vulnerability at a supplier can have just as much impact as an incident within the organization itself. Organizations that are not directly subject to NIS2 are also finding that customers increasingly ask for evidence of cybersecurity. Demonstrable information security is therefore becoming a prerequisite for many suppliers to continue doing business. Certifications, assessments and independent audits are playing an increasingly important role in this.
What can you do in practice?
Now that NIS2 has entered the implementation phase, the focus is on being able to demonstrate compliance. At a minimum, organizations should work on:
- An up to date risk analysis
- A formal cybersecurity policy
- Incident management and reporting procedures
- Business continuity and disaster recovery
- Supplier and supply chain risk management
- Clear roles, responsibilities and governance
- Awareness and training for employees, management and executives
In addition, it’s important to periodically assess whether the measures taken are actually effective. Readiness assessments, gap analyses and independent audits help identify shortcomings and implement targeted improvements.
How Kiwa can support you
Kiwa supports organizations in assessing and demonstrating their cyber resilience, including through:
- NIS2 readiness assessments and gap analyses
- ISO 27001 certification
- NIS2 supply chain assessments
- Independent audits and assessments
- Cybersecurity assessments of suppliers
For organizations that already have ISO 27001 certification, the good news is that many of the foundations are already in place. These include risk management, policies, controls and continual improvement. This can make the transition to NIS2 significantly faster and more manageable. At the same time, NIS2 goes beyond ISO 27001 in certain areas, such as management responsibility, incident reporting requirements and supply chain responsibility. ISO 27001 is therefore not the endpoint, but it’s an excellent starting point for demonstrable NIS2 compliance.
A competitive advantage for the future
Organizations that invest in NIS2 now are not only complying with laws and regulations. They are also strengthening the trust of customers, partners, shareholders and regulators. In tenders and supply chains, demonstrable cyber resilience is increasingly becoming a selection criterion. Cybersecurity is therefore shifting from a cost item to a differentiator.
NIS2 is not a project with an end date, but a continuous process of risk management and improvement. Organizations that invest today in governance, supplier management and cyber resilience are not only building compliance, but also trust, continuity and competitiveness. The question is therefore not whether cybersecurity is important, but whether you can demonstrate that your organization has control over it.
Contact us
Fill out the form to contact our experts and get more information on Kiwa' services.
Read more
Why does ISO 27001 matter for supply chain security?
Cyberattacks rarely impact a single company. Instead, the shockwaves are felt through the chain, impacting suppliers, technology providers, and other third parties. Recent high-profile information security incidents have highlighted this, with several affecting everything from online orders to the availability of products in stores. For Linda Porter, Principal Assessor, Information Security Management Systems at NQA, a Kiwa company, these incidents demonstrate why organizations are paying closer attention to how they manage their suppliers, and how ISO/IEC 27001:2022 for information security can help.
What do you need to adopt ISO 27001? The clauses and controls explained
If your company decides to adopt the information security standard ISO/IEC 27001:2022, you are faced with ten clauses and 93 Annex A controls. At first, these can seem overwhelming. However, once you understand how all those elements work together, the process becomes simpler. In this article, Linda Porter, Principal Assessor, Information Security Management Systems at NQA, a Kiwa company, explains what you need to adopt ISO 27001 in your company.
Read our step-by-step guide on how to get ISO 27001 certified
In a world where big data, online connectivity, and AI integration are at the core of business infrastructure, ensuring safety and security is indispensable. That's why companies turn to ISO/IEC 27001, the international standard for information security. We asked Linda Porter, Principal Assessor, Information Security Management Systems at NQA, a Kiwa company, to tell us more about ISO/IEC 27001:2022 and the process of getting certified.
Yara’s chimney inspected safely without scaffolding – 3D model provided a detailed overview of its condition
Yara Suomi, a supplier of fertilizers and environmental solutions, wanted to assess the condition of a concrete chimney at its sulfuric acid plant in Siilinjärvi. Using traditional methods, the inspection would have been a demanding task, requiring extensive scaffolding to be erected around the tall chimney. However, there was also an alternative: a new inspection method that would eliminate the need to work at height altogether.
