News and updates
Changes to the standard, new legal sources and what buyers and banks have started asking in practice — and what you need to do about it.
Multiple authentication in the metals and manufacturing industry: where it is and isn't required?
The duty of care does not name specific technologies, but does describe where strong access controls are expected — and why older production systems often call for a different approach.
Read more →Backups and recovery in the metal and manufacturing industry: when did you last test it?
A backup that exists says nothing if nobody has tried to restore it. This article explains why, especially in metal and manufacturing industries, the recovery test is the focal point, not the backup itself.
Read more →Incident registration in the metal and manufacturing industry: what do you record?
What must you record when a cyber incident affects your production environment, and why machines connected to the network require a different approach than a laptop in the office.
Read more →Access control in the metal and manufacturing industry: who may access which production systems?
A practical guide to access control for manufacturing companies: who may access which systems, how to set this up for machines and PLCs connected to the network, and what customers specifically ask about.
Read more →What requirements does a contracting authority impose on the metal and manufacturing industry after NIS2?
Contracting authorities that are themselves subject to NIS2 translate their duty of care into contractual requirements for suppliers in the metal and manufacturing industry — with particular attention to machines and production systems connected to their network.
Read more →Does the metal and manufacturing industry fall under NIS2?
For metal companies and machinery manufacturers, an obligation under NIS2 depends on three things at the same time: the precise sector, the company size, and the role in the supply chain of a larger contracting authority.
Read more →Security questionnaire in the metal and manufacturing industry: which questions recur?
Suppliers in the metal and manufacturing industry are often presented with the same questions about their production environment. This article sets out the recurring categories, with production systems connected to the network as the core.
Read more →Awareness and training in the installation sector: what does the duty of care under NIS2 require?
The duty of care requires that employees in an installation company are regularly made aware of cyber risks; managers are subject to a separate, personal training obligation. This article explains the difference.
Read more →What belongs in an information security policy for an installation company?
An overview of what an information security policy for the installation sector should contain, precisely because technicians work on-site at customer locations and have access to buildings and systems.
Read more →Supplier policy for installation companies: how do you assess who may enter your client's premises?
An installation company also works with subcontractors, freelancers and suppliers who gain access to your client's buildings and systems. This article shows how you map and assess your own supply chain.
Read more →Multiple authentication in the installation sector: where mandatory and where not?
An overview of where two-factor authentication in the installation sector is expected, and why access to customer buildings and systems on-site often requires separate consideration.
Read more →Backups and recovery in the installation sector: when did you last test it?
A backup that has never been restored is not a guarantee but an assumption. This article explains what 'testing' concretely means for an installation company with access to customer buildings and systems.
Read more →Incident registration in the installation sector: what do you record when things go wrong?
A system failure, a stolen key or a wrong account at a customer: what an installation company records when something goes wrong, and why that is more than an error message in a ticket system.
Read more →Access control in the installation sector: who is allowed to access which systems and keys?
Access control is the measure that security questionnaires ask about most frequently. For installation companies, this goes beyond passwords alone—it also covers keys, badges, and physical access at customer sites.
Read more →What requirements do principals impose on installation companies after NIS2?
Principals who are themselves subject to the NIS2 duty of care translate that obligation into contractual requirements for installers — particularly around access to buildings, keys and building systems. This article explains what you can expect and why.
Read more →Does the installation sector fall under NIS2?
For installation companies, the answer depends on sector, size, and the access they have to buildings and systems of customers who themselves fall under NIS2.
Read more →Security questionnaire in the installation sector: which questions come back?
An installation company that works on-site at customers and manages systems remotely often receives a security questionnaire with specific questions about access to buildings and systems. This article lists the recurring questions.
Read more →Security awareness training in software development: what does the duty of care require?
The NIS2 duty of care requires software developers to train employees in security awareness, and additionally imposes a separate, personal training obligation on management. This article explains the difference.
Read more →What belongs in the information security policy for software development?
An information security policy for software development describes both how you secure the product you build and how you protect your own development environment — this article explains which components belong in it.
Read more →Supplier policy for software development: how do you assess your own suppliers?
Software companies receive security questionnaires themselves, but must also assess their own suppliers. This article shows how to build this, with the development pipeline and the code in your product as two separate points of focus.
Read more →Multiple verification in software development: where does it fit and where doesn't it?
An overview of the places where two-step verification in software development makes sense, and the situations in which it is less obvious.
Read more →Backups and recovery in software development: when did you last test it?
A backup you have never restored is an assumption, not a measure — especially not for source code, the development pipeline, and the secrets behind it.
Read more →Incident registration in software development: what do you document when things go wrong?
An overview of what a software company documents when an incident occurs: the distinction between a vulnerability in the code you deliver and a problem in your own development pipeline, and what a customer wants to see about it.
Read more →Access control in software development: who may access the source code and the development pipeline?
An explanation of what access control means for a development team: who may access the source code, the build pipeline and the production environment, and what you document for your cyber dossier.
Read more →What contractual requirements apply to software development following NIS2?
A client who is themselves subject to the NIS2 duty of care translates that obligation into contractual requirements for the software you build and the way you build it. This article sets out which requirements are typically involved.
Read more →Does software development fall under NIS2?
Software development is not listed as a separate sector in the NIS2 annexes, but through cloud or ICT service provision, your company's size, and your position as a supplier, you may still become subject to the Directive.
Read more →What questions does a software company receive in a NIS2 questionnaire?
An overview of the questions that come up repeatedly in security questionnaires specifically for software developers: about the code you build and about the development pipeline in which you do that.
Read more →Is security awareness training mandatory for ICT service providers under NIS2?
NIS2 names awareness and training as one of the ten risk management measures, separate from the specific training obligation for the governing body. This article explains the difference and what it means for an ICT service provider.
Read more →What should be included in the information security policy of an ICT service provider?
An information security policy for an ICT service provider describes how you manage remote access, access to customer systems and subcontractors — this article shows which components belong in it.
Read more →Develop a supplier policy for ICT services: where do you start?
ICT service providers receive questionnaires from customers themselves, but must also assess their own suppliers: subcontractors, remote management tools, and anyone with access to customer systems.
Read more →Multiple authentication in ICT service delivery: where required and where not?
Multiple authentication appears in nearly every NIS2 duty of care measure and every security questionnaire, but the requirement varies by access path. This article shows where MFA is structurally expected and where the discussion remains open.
Read more →Backups and recovery in ICT services: when did you last test it?
A backup that exists but has never been restored does not count in a care duty assessment. What this means in practice for remote management, access to customer systems, and subcontractors.
Read more →Incident registration in ICT service provision: what do you record?
As an ICT service provider, you often work remotely in customer systems, sometimes with a subcontractor involved. This article describes what you record when something goes wrong, so you can demonstrate it later.
Read more →Access control in ICT service delivery: who may do what where?
An explanation of what access control means within the NIS2 duty of care, and why questionnaires probe most sharply here on remote management, customer access and subcontractors.
Read more →What a client expects from ICT service delivery after NIS2
Clients who are themselves subject to the NIS2 due care obligation translate that requirement into contractual requirements for their ICT supplier — covering access to systems, remote management, and subcontractors.
Read more →Does ICT service provision fall under NIS2?
For ICT service providers, the answer is twofold: some fall directly under the NIS2 sector list, while a much larger portion is affected because customers must assess them as suppliers with access to systems.
Read more →Security questionnaire in ICT service provision: which questions come up repeatedly?
ICT service providers often receive the most detailed security questionnaires due to their access to customer systems. This article outlines the recurring topics: remote management, access to customer systems, and subcontractors.
Read more →Reusing a security questionnaire: why the second time takes minutes
A customer's first security questionnaire takes hours of searching and drafting. Those who record the answers in a file notice that the second and third questionnaire require only a review and a few adjustments.
Read more →Tackle NIS2 as an SME: how do you build a file without making it a year-long project?
An NIS2 file doesn't have to be a long-running project: start with what your company already has and build up measure by measure with status, owner and evidence.
Read more →NIS2 or DORA: which regulation applies to your organization?
Financial institutions are subject to DORA and not to NIS2. This article explains how you can see which regulation applies to your organization based on your sector.
Read more →How high is the fine for NIS2, and who can actually receive it?
The directive names high maximum fines, but these apply only to organisations that fall under NIS2 themselves. For the much larger group of suppliers, the risk is not the fine, but the contract that disappears sooner.
Read more →Is a board member personally liable under NIS2?
NIS2 places part of the duty of care directly on the board: approval, oversight and training. This article explains what this means in practice and why it cannot be delegated to a supplier.
Read more →Does a NIS2 certificate exist?
No — there is no official NIS2 certificate and no body that issues one. This article explains what the Directive actually requires and how to demonstrate that in a credible manner.
Read more →NIS2 and ISO 27001: what is the difference?
An ISO 27001 certificate covers much of what the NIS2 obligation to implement security measures requires, but it does not cover the registration obligation or the obligation to notify a supervisory authority in the event of an incident.
Read more →NIS2 registration with the competent authority: how does it work?
Organizations classified as essential or important entities under the NIS2 Directive must register themselves with the national competent authority — this article explains what information is required and why no one will remind you to do so.
Read more →NIS2 reporting obligation: what do 24 hours, 72 hours and one month mean exactly?
The NIS2 Directive sets out three reporting moments following a significant incident. What is expected at each moment differs from what is usually claimed.
Read more →Which ten measures does the NIS2 duty of care require from your organisation?
The duty of care under the NIS2 Directive lists ten types of security measures. This article explains in plain language what each measure involves and how you can tell it is properly arranged.
Read more →Customer security questionnaire: what should you do with it?
A customer sends you a long questionnaire about your security and refers to NIS2. What that questionnaire means, why it arrives and how you can provide a useful answer.
Read more →Does my business fall under NIS2?
Two questions determine whether your company falls directly under the NIS2 Directive: the sector in which you operate and the size of your organization. If you do not fall under it, you may still encounter it through a customer or supplier.
Read more →