NIS2 Cybersecurity Act in force since 15 August 2026

Cybersecurity is not a project but a process

A firewall and a virus scanner are no longer enough, and an audit report in a drawer does not make you safer. Newblend embeds security in daily IT operations: technology, behaviour and documentation, set out in SLA agreements.

Request the NIS2 check See what we do

In short

The Dutch Cybersecurity Act, the transposition of NIS2, came into force on 15 August 2026.
Four layers: legislation and compliance, ISO 27001, endpoint security and MDR, and awareness.
Newblend helps organisations with ISO 27001: implementation and internal audits.
Even if the law does not apply to you, customers and clients pass the requirements on to you contractually.
Security is included as standard in the blends, with fixed SLA agreements.

Last updated: 10 November 2026

What we do

Four layers that need each other

Technology without policy does not pass an audit. Policy without technology does not stop an attacker. And neither works if employees click the link anyway.

NIS2 & the Cybersecurity Act

Baseline assessment, measures plan, incident process and the documentation the duty of care and reporting obligation require.

ISO 27001

An information security management system you actually use. We help with implementation and internal audits.

Endpoint security & MDR

Detection and response on every device, monitored 24 hours a day, with patch management and automatic ticket creation.

Awareness

Periodic training and realistic phishing simulations, with reporting on who is improving and who needs extra help.

Legislation

NIS2 in brief

NIS2 is a European directive transposed into national law in each country. In the Netherlands that is the Cybersecurity Act, which came into force on 15 August 2026. In Belgium the transposition already applies, with a registration obligation at the Centre for Cybersecurity Belgium. The core is the same: you must assess your own risks, take appropriate measures, report incidents and be able to demonstrate this.

Duty of care

You assess your own risks and take appropriate measures: access management, multi-factor authentication, backup and recovery, patch management, monitoring, supplier management and awareness.

Reporting obligation

For a significant incident: an early warning within 24 hours, a more detailed notification within 72 hours and a final report within one month. You only meet that with a process set up in advance.

Board accountability

Responsibility lies with the board, not with the IT supplier. Directors must understand the risks and be able to show there is oversight.

Not covered? You will still get the questions

Organisations covered by the law must assess their supply chain. In practice that means questionnaires, contract clauses and sometimes proof of certification — including from suppliers who are outside the scope themselves. Those who cannot provide it drop out of tenders.

From baseline to demonstrably in control

We work the same way as with an IT takeover: first record what is there, then give reasoned advice, then implement and maintain.

Table. The NIS2 programme at Newblend.
Step	What we do	What you get
1. Baseline assessment	Define scope, inventory current measures and test them against the requirements.	An overview of your risks and the gap to the requirements, with priorities.
2. Measures plan	Define technical and organisational measures, with owner and planning.	A plan with costs, lead time and the rationale for each measure.
3. Implementation	Set up technology, document policy, start awareness training.	Working measures plus the documentation that goes with them.
4. Incident process	Define roles, contacts and reporting deadlines and test the procedure.	A rehearsed incident plan that meets the 24- and 72-hour deadlines.
5. Maintain	Periodic reporting, reassessment of risks and adjustments where needed.	Staying demonstrably in control, including during audits and customer questions.

Request the NIS2 check All about NIS2

Technology

Detection and response

Prevention does not always succeed. The difference lies in how quickly you notice something is happening and how quickly you stop it.

Endpoint Detection and Response

Every workstation and server is continuously monitored for unusual behaviour. Critical alerts automatically create a ticket.

Managed Detection and Response

Monitoring 24 hours a day, including Identity Threat Detection on your Microsoft 365 environment. If a threat is confirmed, we isolate the device.

Backup and recovery

Daily full backup of mailboxes, SharePoint and OneDrive, with ransomware protection. We test recovery, because a backup that does not come back is not a backup.

Mail and identity

Spam and phishing filtering, multi-factor authentication, conditional access and continuous monitoring of DKIM, DMARC and SPF.

Behaviour

The human in the chain

Most incidents start with an employee who clicks something, forwards something or reuses a password. That is where most can be gained, and awareness is also explicitly part of the duty of care.

Periodic security awareness training, in short modules people actually finish.
Realistic phishing simulations, tailored to your sector and your own branding.
Reporting per department: who is improving, where extra attention is needed.
A password manager on every workplace, so passwords are no longer reused.
Tailored training through our colleagues at Spike Academy, specialised in training and e-learning.

An addition to your blend

Awareness training and phishing simulations are available as an addition to your blend. See the package comparison.

ISO 27001 and audits

We know what an audit requires

Newblend helps organisations implement ISO 27001 and carries out internal audits. We know what an audit requires, which documentation works and which is a paper tiger.

Frequently asked questions about NIS2 and security

Does NIS2 apply to me as an SME?

That depends on your sector and size. The Cybersecurity Act affects organisations in designated sectors from around 50 employees or 10 million euros turnover. Even if the law does not apply to you, you may be affected indirectly: customers who are covered must assess their supply chain and pass those requirements on contractually.

Since when has the Cybersecurity Act applied?

The Dutch Cybersecurity Act, the transposition of the European NIS2 directive, came into force on 15 August 2026. In Belgium the NIS2 transposition already applies, with a registration obligation at the Centre for Cybersecurity Belgium.

What does the duty of care mean in practice?

You must assess your own risks and take appropriate measures: access management, multi-factor authentication, backup and recovery, patch management, monitoring, supplier management, awareness and a tested incident process. Responsibility lies with the board, not with the IT supplier.

What reporting deadlines apply to an incident?

For a significant incident, an early warning is due within 24 hours, a more detailed incident notification within 72 hours and a final report within one month. That is why we define the incident process in advance, with roles, contacts and a documented timeline.

Does ISO 27001 make us automatically NIS2 compliant?

No, but it saves a lot of work. ISO 27001 covers a large part of the required measures and provides the documentation and management process the law expects. The additional points lie mainly in the reporting obligation, supply chain responsibility and board accountability.

Does Newblend help with ISO 27001?

Yes. We set up the management system, carry out internal audits and prepare you for the external audit. Certification itself is done by an independent certification body.

Do you know where you stand?

The NIS2 check consists of seven questions and shows which obligations apply to you and where the biggest gaps are.

Request the NIS2 check Book an introduction