Who is in scope of NIS2 in the Netherlands?

Medium and large organisations in the sectors listed in Annex I and II of Directive (EU) 2022/2555, plus some providers regardless of size, through the Cyberbeveiligingswet in force since 15 August 2026. Medium means 50 or more staff or more than EUR 10 million turnover.

I only supply an in-scope company. Do I have duties?

Not directly. In-scope entities must manage supply-chain security, so they send suppliers questionnaires and contract clauses. The practical duty is to answer with evidence: email authentication, MFA, backups with a restore test, access control, logging, an incident process and a security contact.

What is the difference between an essential and an important entity?

Both apply the same measures. Essential entities face proactive supervision and fines up to EUR 10 million or 2% of worldwide turnover; important entities are supervised after the fact with fines up to EUR 7 million or 1.4%.

Does NIS2 reach your business?

The Cyberbeveiligingswet has applied in the Netherlands since 15 August 2026. Six questions give you an indication in a minute: in scope as an essential or important entity, reached as a supplier through your customers' questionnaires, or neither. Then download the twelve-point checklist those questionnaires are built on.

Six questions

Is your main activity in one of these sectors? Annex I sectors ("high criticality").

Or in one of these? Annex II sectors ("other critical").

How big is the company?

Does any of these apply regardless of size?

Do you sell to companies in those sectors, or to government?

Has a customer already sent you a security questionnaire or clause?

Indication only. The authoritative route is the RDI self-assessment and the text of the Cyberbeveiligingswet.

Indication

Answer the questions on the left.

Download the twelve-point checklist Check what your domain shows (instant)

Where the rules come from

Sectors and size rules: Directive (EU) 2022/2555, Article 3 and Annexes I and II. Medium means 50 or more staff or more than EUR 10 million turnover or balance sheet; large means 250 or more, or more than EUR 50 million. source
The Netherlands implements it as the Cyberbeveiligingswet, in force since 15 August 2026. source
Supply-chain security is one of the minimum measures (Article 21), which is why in-scope entities send questionnaires to suppliers who are not themselves regulated.

The checklist

Twelve things every supplier questionnaire asks for

One page per item: what the question looks like, what counts as evidence, and what to fix first. The same list we use in the NIS2 supplier-readiness assessment. Free, as a PDF, straight after the form.

An inventory of what you run
Email authentication
Multi-factor authentication
Patching and updates
Backups and a restore test
Access control and offboarding
and six more