Frameworks · NIS2 / Cybersecurity Act

NIS2: from requirement to proof.

The European NIS2 directive for network and information security, transposed in the Netherlands as the Cybersecurity Act (Cbw). In short: take appropriate measures and prove they are in place.

Request a demo → View a sample report
StatusDutch Cybersecurity Act (Cbw) in force since 15 August 2026
Who it applies toessential and important entities in 18 sectors, over 8,000 organisations in the Netherlands; public bodies without a size threshold
Supervisionsupervision per sector; entities have a duty of care, a duty to report and a duty to register
Relationshipfor Dutch public bodies implemented via BIO2; shares controls with ISO 27001/27002, with substantial overlap with CIS in practice

What it requires

Three duties, one common thread: demonstrability.

DUTY OF CARE Appropriate measures

Technical and organisational measures that fit the risk, from access management to secure configuration. And you must be able to show that they are actually in place.

DUTY TO REPORT Report incidents

Significant incidents must be reported within the set deadlines. That requires that you know what is running and what deviates.

THE BOARD Responsibility at the top

The board approves the measures and oversees their implementation. Passing it on to IT is no defence.

How you make it demonstrable

Measured, not claimed.

Easy2audit measures your systems and accounts against the technical controls of NIS2, structured according to Implementing Regulation (EU) 2024/2690: the technical elaboration the European Commission adopted for Article 21(2), and scores the same scan against the other frameworks as well.

In Easy2audit, NIS2 follows the annex of that regulation, per point of Article 21(2): from access management and multi-factor authentication (11) and configuration management, patch management, network segmentation and malware protection (6) to logging (3) and cryptography (9). Every setting is linked to such a point, so you see per point which systems deviate.

Controls
01Policy on the security of network and information systems84.2%
01.02Roles, responsibilities and authorities84.2%
03Incident handling71.8%
03.02Monitoring and logging68.3%
03.04Event assessment and classification75%
03.05Incident response72.4%
04Business continuity and crisis management88.6%
04.02Backup management88.6%
05Supply chain security64.9%
05.01Supply chain security policy61.2%
05.02Directory of suppliers and service providers79.3%
06Security in acquisition, development and maintenance76.5%
06.03Configuration management81.7%
06.06Security patch management74.2%
06.08Network segmentation69.8%
08Basic cyber hygiene practices and security training91.4%
08.01Awareness raising and basic cyber hygiene practices91.4%
11Access control79.6%
11.05Identification92.1%
11.06Authentication71.3%
11.07Multi-factor authentication75.8%
12Asset management82.9%
12.04Asset inventory82.9%

demo environment · sample scores · a selection, the application covers the full framework

Traceableevery finding traceable to system and setting
Reproduciblesame scan, same outcome: evidence an auditor can verify
No duplicate work6 frameworks from one scan, no separate projects per standard

Also measured

BIO2 · governmentNEN 7510 · healthcareDORA · financial sectorISO 27001/27002CIS Benchmarks

also available: NIST benchmarks · ISA 315 reporting for the financial statement audit

See how you make NIS2 demonstrable.

30 minutes · online · no obligations

Request a demo → View a sample report