which supervisory authority oversees my sector under NIS2

Supervision arranged by country and by sector

Which supervisory authority carries out supervision depends on the country and the sector in which an organisation operates. NIS2 requires each Member State to itself designate one or more competent authorities, and that choice differs from country to country. In the Netherlands, that designation takes place via the Cybersecurity Act, the national transposition of NIS2, and there the sector-specific supervision is established — that can be a sectoral supervisory authority or an authority specifically designated for this purpose. For general information on the duty of care and the reporting obligation, the NCSC is a reliable point of reference, but the NCSC is not automatically the supervisory authority for every sector.

For those who do not yet know whether this subject is relevant at all, it is useful first to examine how to determine whether a company falls under NIS2 — the question "who supervises me" only follows the question "am I supervised". Once that is clear, the next step is usually the overview of the ten measures that follow from the duty of care, because the supervisory authority tests compliance with those in practice. This subject deliberately receives no definitive assignment of a specific supervisory authority per sector here, because that classification is worked out differently from country to country and in the Netherlands will be further developed via the Cybersecurity Act.

Ground in the Directive and the national law

NIS2 itself addresses in Article 21(2) the ten measures that essential and important entities must take, but the question of which authority carries out supervision is left to the Member States in the Directive and is only made concrete in the national transposition — in the Netherlands the Cybersecurity Act. That is why the correct source for the exact supervisory authority per sector is the text of that law itself, supplemented by the publications of the supervisory authorities that the NCSC maintains.