NIS2 compliance guide for Belgian SMBs
The NIS2 Directive (EU 2022/2555) is the European Union's enhanced framework for cybersecurity requirements across critical sectors. For Belgian SMBs, it introduces mandatory security measures, incident reporting obligations, and significant penalties for non-compliance. Enforcement begins October 17, 2026.
This guide provides a practical roadmap to achieve NIS2 compliance without unnecessary complexity or cost.
| Enforcement Date | October 17, 2026 |
| Scope | Essential and important entities (most SMBs with 10+ employees) |
| Maximum Fine | €10 million or 2% of global revenue (whichever is higher) |
| Key Change | Mandatory security testing and incident reporting |
Who is affected by NIS2?
NIS2 applies to "essential" and "important" entities across specific sectors. In Belgium, this includes most SMBs with 10 or more employees operating in designated industries.
Affected sectors
| Sector | Classification | Typical Belgian SMBs |
|---|---|---|
| Energy | Essential | Utilities, renewable energy providers |
| Transport | Essential | Logistics, shipping, aviation services |
| Healthcare | Essential | Hospitals, clinics, medical device manufacturers |
| Digital Infrastructure | Essential | Cloud providers, data centers, ISPs |
| Manufacturing | Important | Industrial manufacturers, chemical producers |
| Food Production | Important | Food processing, distribution |
| Digital Services | Important | Online marketplaces, search engines, social networks |
| Postal Services | Important | Courier and postal operators |
Size thresholds
- Medium-sized enterprises: 50–249 employees or €10–50M annual turnover
- Small enterprises: 10–49 employees or €2–10M annual turnover
- Micro enterprises: Under 10 employees (generally exempt, unless classified as essential)
Warning: Even if your company has fewer than 50 employees, you may still be classified as an "essential entity" if you provide critical services. Check with the Belgian Centre for Cybersecurity (CCB) if unsure.
The 7 key NIS2 requirements
NIS2 mandates specific cybersecurity measures across seven core areas. Each requirement has practical implications for how you operate your IT infrastructure and respond to incidents.
1. Risk management & security policies
Implement risk management measures appropriate to your threat landscape.
What you need:
- Documented cybersecurity policy
- Regular risk assessments (at least annually)
- Risk treatment plans with assigned ownership
- Board-level cybersecurity oversight
Common gap: Many SMBs lack formal risk documentation or have outdated policies that don't reflect current threats.
2. Incident handling & reporting
Establish procedures for preventing, detecting, and responding to incidents.
What you need:
- Incident response plan (documented and tested)
- Early warning notifications within 24 hours of detection
- Incident reports within 72 hours
- Final reports within one month
- Designated incident response team or contact
Common gap: No tested incident response plan. No clear escalation path. Unrealistic reporting timelines.
3. Business continuity & crisis management
Ensure operational resilience through backup systems and disaster recovery.
What you need:
- Business continuity plan (BCP)
- Regular backups tested for restoration
- Disaster recovery procedures
- Crisis communication plan
- Defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)
Common gap: Backups exist but are never tested. No documented RTOs. No crisis communication plan.
4. Supply chain security
Assess and manage cybersecurity risks from suppliers and service providers.
What you need:
- Vendor risk assessment process
- Security requirements in contracts
- Regular audits of critical suppliers
- Supply chain incident response coordination
Common gap: No visibility into third-party security posture. Contracts lack cybersecurity clauses.
5. Security in network & information systems
Deploy appropriate technical and organizational measures to secure systems.
What you need:
- Network segmentation
- Access controls (least privilege, MFA)
- Encryption for data at rest and in transit
- Secure configuration management
- Patch management process
- Logging and monitoring
Common gap: Flat networks with no segmentation. Weak access controls. Inconsistent patching.
6. Security testing & audits
Regularly test the effectiveness of your security measures.
What you need:
- Penetration testing (at least annually)
- Vulnerability assessments
- Security audits (internal or external)
- Remediation tracking and validation
Common gap: No external testing. Vulnerabilities identified but never fixed. No retesting after remediation.
7. Training & awareness
Ensure staff understand cybersecurity risks and responsibilities.
What you need:
- Regular security awareness training
- Phishing simulations
- Role-specific training for IT staff
- Management cybersecurity briefings
Common gap: One-time training during onboarding. No phishing tests. Executives not trained.
90-day implementation roadmap
This roadmap prioritizes the most critical NIS2 requirements and provides a realistic timeline for Belgian SMBs to achieve compliance. Adjust timelines based on your organization's size and resources.
Phase 1: Foundation (Days 1–30)
Week 1 — Gap Analysis
- Assess current security posture against NIS2 requirements
- Identify critical gaps
- Prioritize remediation efforts
Week 2 — Documentation
- Draft cybersecurity policy
- Document current risk register
- Create incident response plan template
Week 3 — Technical Assessment
- Conduct vulnerability scan
- Review network architecture
- Audit access controls and permissions
Week 4 — Planning
- Define implementation roadmap
- Assign responsibilities
- Set budget and timeline
Phase 2: Implementation (Days 31–60)
Weeks 5–6 — Critical Controls
- Implement MFA for all privileged accounts
- Deploy network segmentation
- Configure centralized logging
- Establish backup procedures
Weeks 7–8 — Processes & Policies
- Finalize incident response plan
- Complete business continuity plan
- Conduct tabletop exercise
- Train incident response team
Phase 3: Validation & Improvement (Days 61–90)
Weeks 9–10 — Testing
- Conduct penetration test
- Test backup restoration
- Validate incident response plan
- Review vendor contracts
Weeks 11–12 — Remediation & Documentation
- Address findings from pentest
- Complete compliance documentation
- Conduct staff training
- Prepare for external audit
Penalties & enforcement
NIS2 introduces significant penalties for non-compliance, with enforcement beginning October 17, 2026. Belgian authorities have broad powers to inspect, audit, and sanction non-compliant organizations.
Financial penalties
| Violation Type | Essential Entities | Important Entities |
|---|---|---|
| Major violations (e.g., no incident reporting, inadequate security measures) | €10M or 2% of global turnover | €7M or 1.4% of global turnover |
| Minor violations (e.g., failure to cooperate with authorities) | €7M or 1.4% of global turnover | €5M or 1% of global turnover |
Beyond fines: real business impact
- Personal liability for management: Directors and senior management can be held personally liable for failing to implement adequate cybersecurity measures.
- Operational shutdown: Authorities may suspend operations during investigations or until critical vulnerabilities are remediated.
- Reputational damage: Non-compliance reports may be made public, damaging customer trust and competitive position.
- Loss of contracts: Many public sector and enterprise contracts now require NIS2 compliance as a condition for doing business.
Enforcement timeline
- October 17, 2024: NIS2 entered into force (EU level)
- October 17, 2024 – October 17, 2026: Transposition period for member states
- October 17, 2026: Enforcement begins in Belgium
- Post-October 2026: Audits, inspections, and penalties for non-compliance
Common gaps we find during pentests
Based on penetration tests conducted across Belgian SMBs in 2024–2025, these are the most frequent vulnerabilities that leave organizations non-compliant with NIS2 requirements.
1. Misconfigured network segmentation
Flat network architecture allows lateral movement from guest WiFi to production systems. Found in 74% of tested organizations. Impact: Critical.
Fix: Implement VLANs, firewall rules, and zero-trust network access (ZTNA).
2. Weak or missing multi-factor authentication (MFA)
Privileged accounts protected only by passwords, vulnerable to credential stuffing and phishing. Found in 68% of tested organizations. Impact: High.
Fix: Deploy MFA for all admin accounts, VPN access, and cloud services.
3. Unpatched vulnerabilities
Critical CVEs remain unpatched months after disclosure, especially on legacy systems. Found in 61% of tested organizations. Impact: Critical.
Fix: Establish patch management SLA (critical patches within 14 days) and asset inventory.
4. Inadequate logging & monitoring
No centralized logging, retention periods too short, no alerting on suspicious activity. Found in 82% of tested organizations. Impact: High.
Fix: Deploy SIEM or centralized logging with 12+ month retention and automated alerts.
5. Untested backup & recovery
Backups exist but have never been tested for restoration; RPO/RTO undefined. Found in 77% of tested organizations. Impact: Critical.
Fix: Quarterly restore tests, document RTOs, implement offline/immutable backups.
6. Weak access controls
Overly permissive access rights, shared admin accounts, no regular access reviews. Found in 71% of tested organizations. Impact: High.
Fix: Implement least privilege, disable unused accounts, quarterly access reviews.
Next steps: how Cypra can help
NIS2 compliance doesn't require a six-figure security budget. It requires a clear assessment of where you stand, a prioritized remediation plan, and expert guidance to implement it efficiently.
Our approach
| Service | What We Do | Timeline |
|---|---|---|
| NIS2 Gap Assessment | Evaluate your current posture against all 7 NIS2 requirements. Identify critical gaps and prioritize remediation. | 2–3 weeks |
| Penetration Testing | Simulate real-world attacks to validate your defenses. Test network segmentation, access controls, and incident detection. | 2–4 weeks |
| Network Analysis | Map your network architecture, identify misconfigurations, and recommend segmentation strategies. | 1–2 weeks |
| Remediation Roadmap | Provide a step-by-step plan with cost estimates, timelines, and vendor recommendations. | 1 week |
| Ongoing Support | Annual retesting, incident response support, and compliance monitoring. | Ongoing |
Book a free 30-minute security assessment
We'll walk you through:
- Where you currently stand relative to NIS2 requirements
- The 3–5 highest-priority gaps to address first
- A realistic timeline and budget estimate