The Network and Information Security Directive 2 (NIS2) is the most far-reaching piece of European cybersecurity legislation to date. Dutch organisations in critical and important sectors must meet strict security requirements, with fines of up to EUR 10 million or 2% of worldwide annual turnover. The need to attract qualified cybersecurity talent has never been more pressing.
What is NIS2 and who is in scope?
NIS2 succeeds the original NIS Directive of 2016 and significantly widens its scope. Where the original directive focused on a limited number of sectors, NIS2 now covers eighteen sectors, divided into essential and important entities.
Essential sectors include energy, transport, banking, financial market infrastructure, healthcare, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration and space. Important sectors include postal and courier services, waste management, chemicals, food production, manufacturing, digital providers and research organisations.
In the Netherlands, an estimated 10,000-plus organisations fall under NIS2. Many of them are still insufficiently aware of the impact and of the effort required to become compliant. The breadth of the directive means that mid-sized organisations and suppliers to critical sectors now also have to meet stricter requirements.
The key NIS2 requirements
NIS2 places extensive cybersecurity requirements on organisations. The core requirements are:
- Risk analysis and security policy: Organisations must carry out a thorough risk analysis and implement an appropriate information security policy that is regularly reviewed and updated.
- Incident handling: Procedures must be in place for detecting, reporting and handling security incidents. Significant incidents must be reported to the competent authority within 24 hours, followed by a full report within 72 hours.
- Business continuity: Backup management, disaster recovery and crisis management plans are mandatory. Organisations must be able to demonstrate that they can restore their services after an incident.
- Supply chain security: Organisations are responsible for the security of their entire supply chain. This requires contractual agreements with suppliers and regular assessment of security across the chain.
- Management accountability: Directors are personally liable for compliance with cybersecurity measures and must demonstrably follow cybersecurity training. This is one of the most significant changes compared with the original NIS Directive.
The talent shortage: the biggest challenge
The biggest bottleneck for NIS2 compliance is not technology or budget, but talent. The Netherlands faces a structural shortage of cybersecurity professionals. According to recent figures, there are more than 20,000 open cybersecurity vacancies in the Netherlands, while only a few thousand new professionals enter the labour market each year. NIS2 widens this gap further by forcing thousands of organisations to expand their cybersecurity capacity at the same time.
NIS2 compliance calls for a wide range of specialisms: from GRC consultants who carry out risk analyses and write policy, to SOC analysts who monitor and handle incidents, to security architects who design and implement technical controls. No organisation can absorb all of this internally without substantial investment in people.
Which profiles do you need?
Based on our experience at MVPeople Group, we see the following profiles as essential for NIS2 compliance:
- GRC Consultant / NIS2 Specialist: For the gap analysis, risk analysis and policy implementation. This profile is the backbone of every NIS2 compliance programme and translates the legal requirements into concrete measures.
- CISO (interim or permanent): For strategic direction of the compliance programme and for reporting to the board on progress and risks.
- Security Architect: For designing technical security measures that meet NIS2 standards, including network segmentation, encryption and monitoring.
- SOC Analyst: For monitoring, detection and incident response capability. NIS2 requires organisations to be able to detect incidents and report them within strict deadlines.
- DPO / Privacy Officer: Given the overlap between NIS2 and the GDPR, a privacy officer is essential to approach both regulatory frameworks in an integrated way.
Why you need to act now
The NIS2 transposition deadline passed in October 2024, but the Dutch implementing law (the Cyberbeveiligingswet, or Cybersecurity Act) has now entered into force. Organisations that have not yet started their compliance programme run a significant risk. Not only because of potential fines, but also because of the personal liability of directors that is now enshrined in law.
On top of that, the market for cybersecurity talent is getting tighter as more organisations try to comply with NIS2 at the same time. Those who wait will soon pay more for less available talent. Organisations that invest in cybersecurity capacity first gain a clear competitive advantage.
How MVPeople Group helps with NIS2 compliance
MVPeople Group supports organisations in several ways on their NIS2 compliance journey. Through MVProjects we deliver complete NIS2 gap analyses and roadmap programmes based on a Statement of Work, with fixed-price agreements and clear deliverables. This includes a full gap analysis against the NIS2 requirements, a prioritised roadmap with concrete actions, and support in implementing measures.
In addition, MVPeople provides immediately available cybersecurity specialists through our freelance and interim services to strengthen your internal team. Whether you need an interim CISO to lead the NIS2 programme or SOC analysts to build your monitoring capability, we present the first candidate within 4 hours.
Do not wait any longer with your NIS2 compliance preparations. Contact MVPeople Group today for a no-obligation consultation about your cybersecurity talent needs and find out how we can help you become fully compliant in time.