RDI quickscan: how far along are organisations with NIS2?

Update 4 November 2026: the Cyberbeveiligingswet has applied since 15 August 2026. The original article from May 2026 follows below.

The Dutch Authority for Digital Infrastructure (RDI) has published the results of the NIS2 quickscan for all nine sectors it will soon supervise. Between February 2024 and September 2025, the self-assessment was completed anonymously 3,389 times. The results give the first broad picture of where Dutch organisations stand in preparing for the Cyberbeveiligingswet (Cbw), the Dutch law implementing NIS2. The Cbw was passed by the House of Representatives on 15 April and will soon be considered by the Senate.

RDI supervision

The RDI will supervise the Cbw for nine sectors. A distinction is made between essential and important organisations.

Essential organisations are subject to proactive supervision: the RDI checks compliance even when there have been no incidents:

• Energy
• Digital infrastructure
• ICT service management
• Government (except water authorities)
• Space

Important organisations are subject to reactive supervision: supervision mainly takes place afterwards, for example after an incident:

• Postal and courier services
• Manufacturing
• Digital providers
• Research (for organisations under the Ministry of Economic Affairs and Climate)

Five areas for attention

Organisations from all nine sectors say they still have work to do in five areas:

1. Training all board members. This is a new obligation under the Cbw. Executive directors must be able to demonstrate knowledge of cybersecurity, through a certificate. They bear ultimate responsibility for governance and risk management, including digital security.
2. Supply chain security. Organisations must develop policies to reduce risks at existing and new suppliers, both digital and physical.
3. Reporting procedure for significant incidents. There must be a formal process for reporting incidents to the sectoral CSIRT, preferably set out in an incident response plan.
4. Assessing the effectiveness of measures. Organisations must periodically and independently test whether their cybersecurity measures actually work.
5. Policy on cryptography and encryption. A formal cryptography policy describes where and how encryption is applied, both for stored data and for data in transit.

Board training: the biggest area for attention

It says a lot that board training tops the list. The Cbw makes it a legal obligation. Once the law takes effect, executive directors must be able to demonstrate that they know and can assess the risks to their organisation. Supervisory directors (commissioners) and non-executive directors are exempt from this obligation. In our experience, participation in the board training by supervisory board members and by senior roles such as the head of IT, Legal, Risk or the CISO leads to good conversations and discussions.

Our NIS2 Boardroom Training was developed specifically for directors of NIS2 organisations. The training aligns with the requirements of the Cyberbeveiligingswet and Cyberbeveiligingsbesluit, and provides a certificate as proof of up-to-date knowledge.

Five areas that are already going well

The quickscan also shows positive news. Organisations are already well on their way on these five points:

• Incident handling: processes for registering, assessing, handling and reporting incidents are in order.
• Authentication and communication security: multi-factor authentication and secure communication systems are widely implemented.
• Reporting obligations: organisations have procedures to inform customers quickly in the event of an incident.
• Governance and board approval: responsibilities for information security have been assigned and the board approves measures.
• Security of network and information systems: organisations have information security policies and monitor their systems for vulnerabilities.

What can you do now?

The RDI quickscan is a useful starting point, but no guarantee of compliance. Do you want to know how far along your organisation is? Take the NIS2 Quickscan yourself, and make sure your directors have the right knowledge. See our NIS2 Boardroom Training, developed specifically for directors with a legal training obligation.