NIS2 is the EU directive that widened cybersecurity law from a few critical sectors to eighteen, and it reaches companies you would not expect: a managed IT provider with sixty staff, a SaaS company that hosts for hospitals, a food manufacturer, a data centre operator. In the Netherlands it is implemented through the Cyberbeveiligingswet (Cbw), which has lagged the EU deadline of October 2024 and is entering into force with a delay. This note gives small and medium-sized companies a way to work out whether they are in scope, what the law asks, and what to do if you are "only" a supplier.
Step one: your sector
Annex I lists sectors of high criticality: energy, transport, banking, financial market infrastructure, health, drinking and waste water, digital infrastructure (DNS, cloud, data centres, content delivery, trust services, public networks), ICT service management (managed service and managed security providers), public administration and space. Annex II lists other critical sectors: postal services, waste management, chemicals, food, manufacturing of medical devices, computers, electronics, machinery and vehicles, digital providers (online marketplaces, search engines, social networks) and research. If you are not in one of these, NIS2 does not apply directly, but read step four.
Step two: your size
The general rule is that medium-sized and large companies in those sectors are in scope: fifty or more employees, or more than EUR 10 million turnover and balance sheet. Large companies in Annex I sectors are 'essential entities'; the rest are 'important entities' with slightly lighter supervision but the same measures. Size is counted at group level, so a small Dutch subsidiary of a large group may count as large. Some categories are in scope regardless of size: DNS providers, top-level domain registries, trust service providers, public network providers, and entities designated as critical by the government.
Step three: what the law asks
Four groups of duties. Registration with the national authority. Risk-management measures, the famous list of ten: policies on risk analysis and information security; incident handling; business continuity and crisis management; supply-chain security; security in acquisition, development and maintenance, including vulnerability handling; effectiveness assessment of measures; cyber hygiene and training; cryptography and encryption; human resources security, access control and asset management; multi-factor authentication and secured communications. Incident reporting of significant incidents: an early warning within 24 hours, a notification within 72 hours, a final report within a month. Management duties: the board must approve the measures, oversee implementation, follow training and can be held personally liable.
Step four: you are a supplier
This is where most SMEs meet NIS2. In-scope entities must manage supply-chain risk, and they do that by contract: security questionnaires, right-to-audit clauses, incident notification within hours, minimum control sets, and sometimes a requirement to hold ISO 27001 or NEN 7510. You are not regulated, but your customer is, and your sales cycle now depends on being able to say yes. Being able to show a risk analysis, an incident process and MFA across your systems is often enough to stay on the vendor list.
What proportionate looks like for an SME
The law says measures must be proportionate to your size and risk. In practice, for a 60-person SaaS company, that means: an information-security policy signed by the board, a risk register reviewed twice a year, MFA everywhere, offline backups tested quarterly, a supplier list with criticality ratings, a one-page incident runbook with the 24/72-hour clocks, secure development basics, and an hour of training a year for everyone. ISO 27001 is not required, but its structure maps onto NIS2 almost one to one, so companies that already have it are nearly done.
If you want to know whether the Cyberbeveiligingswet applies to you, send us your sector, headcount and turnover and we will tell you in one reply.