The Belgian NIS2 law, which transposes the EU Directive 2022\/2555, imposes several cybersecurity obligations on entities deemed essential<\/strong> or important<\/strong> for the functioning of society and the economy.<\/p>\n

1. Registration<\/strong><\/h4>\n

Entities falling within the scope of the NIS2 law must register with the Centre for Cybersecurity Belgium (CCB)<\/strong> via the Safeonweb@work platform. This registration is mandatory and ensures that the CCB can effectively supervise and support these entities.<\/p>\n

2. Cybersecurity Risk Management Measures<\/strong><\/h4>\n

Both essential and important entities are required to implement appropriate technical, operational, and organizational measures<\/strong> to manage cybersecurity risks. These measures aim to:<\/p>\n

\n
• Secure network and information systems.<\/li>\n
• Prevent incidents.<\/li>\n
• Minimize the impact of incidents on customers and services.<\/li>\n<\/ul>\n

  4. Supply chain security<\/strong><\/p>\n

  Essential and Important entities must take appropriate and proportionate cybersecurity risk-management measures on their supply chain. This is why many companies outside NIS2 scope adopt CyFun\u00ae to strengthen cybersecurity governance<\/strong> or because a customer, supplier, or partner requires proof of compliance<\/strong>.<\/p>\n

  5. Notification of Significant Incidents<\/strong><\/h4>\n

  Entities must report any significant incidents<\/strong> to the national CSIRT<\/strong>, which in Belgium is the CCB<\/strong>. This includes:<\/p>\n

  \n
  • Incidents causing severe operational disruption.<\/li>\n
  • Incidents with potential cross-border effects.<\/li>\n
  • Financial or reputational damage.<\/li>\n<\/ul>\n

    The reporting process includes:<\/p>\n

    \n
    • Initial notification<\/strong> within 24 hours.<\/li>\n
    • Detailed incident report<\/strong> within 72 hours.<\/li>\n
    • Final report<\/strong> within one month.<\/li>\n<\/ul>\n

      4. Obligations for management<\/strong><\/h4>\n

      The management bodies<\/strong> of NIS2 entities are responsible for:<\/p>\n

      \n
      • Approving cybersecurity risk-management measures and supervise their execution.<\/li>\n
      • Following a training to ensure that their knowledge and skills are sufficient to identity risks and treatment<\/li>\n<\/ul>\n

        In case of non-compliance, management can be held liable<\/strong>.<\/p>\n

        5. Supervision<\/strong><\/h4>\n

        \n
        • Essential entities<\/strong> must undergo regular compliance assessments<\/strong>, choosing one of the following:\n
          \n
          • CyberFundamentals Certification or verification.<\/li>\n
          • ISO\/IEC 27001 Certification.<\/li>\n
          • Audit by the CCB\u2019s audit service.<\/li>\n<\/ul>\n<\/li>\n
          • Important entities<\/strong> must not undergo a regular compliance assessment.<\/li>\n<\/ul>\n

            6. Sanction<\/strong><\/p>\n

            Essential and Important entities which do not respect their obligations can be subjected to a series of administrative measures and fines.<\/p>\n

            \n

            \n<\/div>\n\t\t\n\t\t\t\n\t\t\n\t\t\t\n\t\t\n\t\t\t\n\t\t\n\t\t\t\n\t\t\n\t\t\t\n\t\t\n\t\t\t\n\t\t\n\t\t\t\n\t\t\n\t\t\t\n\t\t\n\t<\/div>\n\n<\/div>\n\t<\/div>\n\n\t\n<\/div>","protected":false},"excerpt":{"rendered":"

            A Must I demonstrate my cybersecurity maturity by law? Under the EU NIS2 Directive, certain organizations classified as essential and important are legally required to taking cybersecurity risk-management measures. Essential entities shall demonstrate cybersecurity maturity. This includes sectors such as energy, transport, health, finance, digital infrastructure, and public administration.Failure to comply can result in audits, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":35,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-182","page","type-page","status-publish","hentry"],"yoast_head":"\n