NIS2 & DORA Compliance Consulting

NIS2 is the European directive on network and information security, the successor to NIS1. In the Netherlands it is implemented through the Cyberbeveiligingswet. NIS2 imposes a duty of care (appropriate technical and organisational measures) and a duty to report significant incidents on essential and important entities, and introduces supervision and management accountability.

That depends on your sector and size. NIS2 has a far broader scope than NIS1 and covers areas such as energy, transport, healthcare, drinking water, digital infrastructure, government, postal services, waste management, and the manufacture of critical products. Whether you are an essential or important entity determines the intensity of supervision: essential entities are under proactive supervision, important entities under reactive supervision. We establish your scope in a readiness scan.

NIS2 widens the scope to more sectors, strengthens the duty of care, introduces explicit management accountability, sets a phased reporting obligation (an initial report typically within 24 hours), and gives supervisors broader enforcement and sanctioning powers than were available under NIS1.

DORA (the Digital Operational Resilience Act) is a European regulation governing the digital operational resilience of the financial sector, applicable since 17 January 2025. DORA sets requirements for ICT risk management, incident reporting, resilience testing (including threat-led penetration testing), and the management of third-party ICT provider risk.

DORA applies to a wide range of financial entities, including banks, insurers, payment institutions, investment firms, and crypto-asset service providers, and extends to the critical third-party ICT providers of those entities.

We start with a gap analysis against the relevant framework, prioritise the findings by risk, and build a concrete roadmap. We then support implementation through a matched specialist from our network and validate the technical measures with our offensive services (a penetration test or, where required, threat-led penetration testing). You keep a single point of contact; we manage the engagement end to end.

Most frameworks, including NIS2, DORA, ISO 27001, and SOC 2, expect demonstrable technical testing of your controls. A penetration test, and under DORA a threat-led penetration test, provides that evidence. We connect the readiness engagement directly to our offensive services so that compliance is genuinely tested rather than only documented.

DORA has applied since 17 January 2025. NIS2 is being implemented in the Netherlands through the Cyberbeveiligingswet (Cbw). The Tweede Kamer passed the bill on 15 April 2026; it is now before the Eerste Kamer for final review, with entry into force expected on 1 July 2026. Preparation can and should begin now, because the duty of care applies from entry into force without a generous transition period. Fines are substantial: up to 10 million euro or 2% of global annual turnover for essential entities, and up to 7 million euro or 1.4% of turnover for important entities, whichever is higher. Directors are also personally accountable: they must approve the measures and oversee their implementation.