NIS2 is not a compliance exercise, but a strategic responsibility

As the Netherlands prepares to implement the NIS2 Directive through the Cybersecurity Act, Philipp Strasmann, Managing Director at Fox-IT at NCC Group, explains why cybersecurity must be treated as a business and leadership priority, not simply a regulatory requirement.

"NIS2 is not a compliance exercise, but a strategic responsibility
 
Tomorrow (15 August), the Cybersecurity Act officially comes into force, implementing the European NIS2 Directive in the Netherlands for thousands of organisations. This marks a decisive shift, making cybersecurity a strategic issue for business leaders rather than merely a technical concern.

While many organisations are focused on meeting the new legal requirements, the conversation should not be limited to compliance alone. The real objective of NIS2 is to strengthen the digital resilience of organisations and the supply chains of which they are a part.

This is particularly relevant and urgent given that ransomware and supply chain attacks continue to increase in both frequency and impact. Geopolitical tensions further heighten the need for resilient supply chains. Organisations that embed cybersecurity into their governance structures and risk management processes will strengthen their cyber resilience and be better prepared for future threats.

In cybersecurity, continuous attention is required to remain prepared for emerging threats. The implementation of NIS2 in the Netherlands is therefore not an endpoint, but an important opportunity for organisations to strengthen their cybersecurity on a long-term basis. Not only because the law requires it, but because digital resilience is essential for business continuity, trust, and a secure digital organisation and society.

I encourage business leaders to use this important milestone as an opportunity to strengthen their cyber resilience. Need support? Feel free to send me a message or leave a comment."
 
More information: NCSC Netherlands: Cybersecurity Act and WWKE effective from 15 August 2026