NIS2 · apply · about 10 minutes

Does NIS2 apply — and what do you tell them first?

A Belgian road-freight company: 220 employees, €38 million turnover, head office in Liège, never covered by a cyber regulation before. The CEO asks you: "Are we concerned by NIS2, and if so, what do we do first?"

Write the answer you would actually send. Five lines, in their language — not the directive's.

Write your answer somewhere else — on paper, in a mail draft, out loud to someone. Then come back and mark it against the rubric. The rubric is disputable: if you think a line is wrong for your situation, you are probably right, and noticing that is worth more than the tick.

Mark it against the rubric

Scope: a transport sector in Annex I, at medium size → important entity, not essential The size cap, and who is caught anyway
Names the authority: the CCB, as both CSIRT and competent authority Who receives the report
First step: registration, and one named accountable owner Registering, and why it comes first
Management duties: training and approval, and that liability is personal Managers can be held personally liable
The clocks: 24 hours is the one that surprises people, and 72 h and one month follow The three clocks: 24 hours, 72 hours, one month
Written for a CEO, not for a lawyer Essential and important entities

Sources: Directive (EU) 2022/2555 (NIS2), Belgian law of 26 April 2024 establishing a framework for the cybersecurity of networks and information systems, Centre for Cybersecurity Belgium — NIS2 and CyberFundamentals. Written from those texts and last checked on 2026-10-16 against reporting on them — not read line by line against the primary documents. Every card names the clause it comes from precisely so you can settle it at the source, and [email protected] is where a correction goes.