NIS2: Cybersecurity Talent for Every Sector

NIS2 (Network and Information Security Directive 2) is the successor to the original EU NIS Directive. It is a European directive that sets stricter requirements for the cybersecurity of organisations in essential and important sectors. NIS2 requires these organisations to take appropriate technical and organisational measures to secure their network and information systems.

The NIS2 directive should have been transposed into national legislation by 17 October 2024. The Netherlands is working on the Cybersecurity Act (Cyberbeveiligingswet/Cbw) as the national implementation. Although the exact effective date still depends on the legislative process, organisations are well advised to start preparing now, as the directive is already in force at EU level.

NIS2 applies to organisations in 18 sectors, divided into essential entities (energy, transport, banking, financial market infrastructure, healthcare, drinking water, digital infrastructure and government) and important entities (postal & courier services, waste management, chemicals, food, manufacturing, digital service providers and research). Generally, medium and large organisations in these sectors fall under the directive.

NIS2 provides for significant sanctions for non-compliance. Essential entities risk fines of up to 10 million euros or 2% of global annual turnover, and important entities up to 7 million euros or 1.4% of global annual turnover. Additionally, board members can be held personally liable for failing to fulfil their duty of care.

While NIS2 does not prescribe specific job titles, the directive does require organisations to have sufficient qualified personnel for cybersecurity governance, risk management, incident response, business continuity and supply chain security. In practice, this means roles such as CISO, Security Officer, GRC Consultant, DPO, IT Risk Manager and Security Awareness Specialist are essential for compliance.

MVPeople Group specialises in recruiting and seconding cybersecurity professionals. We deliver the specialists your organisation needs to become and remain NIS2-compliant: from interim CISOs and GRC Consultants to Security Officers and DPOs. With our network of 7,000+ screened cybersecurity professionals and our 4-hour response guarantee, we help you quickly access the right expertise.

Essential entities are organisations in sectors that are crucial to society, such as energy, transport, banking and healthcare. These are subject to stricter supervision and higher fines. Important entities operate in sectors that are important but less critical, such as postal & courier services, chemicals and manufacturing. The main difference is the level of supervision: essential entities are proactively monitored, while important entities are subject to reactive supervision.