Cybersecurity
NIS2 in Belgium: the checklist to know where you stand.
Who is in scope, what to do first and in which order: ten points to go from “we should look into it” to a dated plan that fits Belgian law and the CCB framework.
The NIS2 directive is transposed in Belgium by the law of 26 April 2024, in force since 18 October 2024. The competent authority is the Centre for Cybersecurity Belgium (CCB). The text does not ask you to buy tools: it asks you to manage risks, prove it, and report incidents. Here is the order in which we handle the topic on engagements.
1. Check whether you are in scope
Two criteria combine: the sector (energy, health, transport, digital, water, food, manufacturing, postal services…) and the size (from 50 staff or 10 million euros in turnover, with exceptions). Entities are classified as “essential” or “important”, with different supervision obligations. A supplier of an in-scope entity can also be pulled in by contract.
2. Register with the CCB
Registration goes through the Safeonweb@work portal. The initial deadline was 18 March 2025; if it has not been done, it is the first action, before any technical project.
3. Choose a framework
Two accepted routes in Belgium: the CCB’s CyberFundamentals framework (Basic, Important, Essential levels) or the ISO 27001 standard. CyFun has the advantage of being free, available in the national languages, and calibrated by organisation size.
4. Document a risk analysis
A short but real analysis: critical assets, plausible threats, impacts, existing measures. It is the document management signs and the auditor opens first.
5. Put the minimum measures in place
Multi-factor authentication everywhere, tested and offline backups, patch management, centralised logging, separate administrator accounts, endpoint encryption. These six points cover most common incidents.
6. Prepare incident notification
Early warning within 24 hours, notification within 72 hours, final report within one month. Without a written procedure and a named contact, these deadlines do not survive a Friday evening.
7. Look at the supply chain
Which suppliers have access to your systems? Under which clauses? NIS2 makes you accountable for what you delegate.
8. Train management
The law holds management bodies personally accountable. Half a day of documented awareness training is both an obligation and a protection.
9. Plan the conformity assessment
Self-assessment for important entities, certification or inspection for essential ones. Set the date now, the rest of the plan follows backwards.
10. Schedule the annual review
Risks, measures, suppliers, training: one traceable review per year. NIS2 compliance is a cycle, not a project.