Compliance
NIS2
Cybersecurity as a legal duty, with a 24-hour clock
Who is in scope, the ten measures, the three reporting clocks, and what the management body now signs for personally. Sourcing note: the Directive has been read against every card that cites it. The three cards on the Belgian layer rest on the 2024 law and the CCB's own guidance, which have not been, so the topic as a whole is still marked as secondary.
Start the map 6 pillars · 18 cards · about 27 minutes end to end
The map
Five minutes, once. Rate each pillar before you start and the cards you are shakiest on come first. Skipping it costs you nothing but the ordering.
-
Scope — who is covered
Sector plus size decides whether you are in, and whether you are essential or important.
-
Obligations — the ten measures
Article 21 lists ten minimum measures; everything else is how you evidence them.
-
Governance — who signs
The management body approves the measures, oversees them, and can be held liable for them.
-
Incident reporting — the clocks
A significant incident starts three deadlines, all counted from awareness.
-
Supervision and penalties
Essential entities are supervised before the fact, important ones after, and the ceilings differ.
-
Belgium — the local layer
The 2024 law, the CCB as authority, and CyberFundamentals as the way to prove conformity.
Apply it
One scenario per sitting, about ten minutes. No marking scheme that pretends to be objective — a rubric you are invited to argue with.
Sources: Directive (EU) 2022/2555 (NIS2), Belgian law of 26 April 2024 establishing a framework for the cybersecurity of networks and information systems, Centre for Cybersecurity Belgium — NIS2 and CyberFundamentals. Written from those texts and last checked on against reporting on them — not read line by line against the primary documents. Every card names the clause it comes from precisely so you can settle it at the source, and [email protected] is where a correction goes.