NIS2 and the Dutch Cybersecurity Act, someone to lead it.

The moment

It rarely starts with the law itself. It starts with something small: the outcome of the self-assessment, a letter from the regulator, a major customer sending a supply-chain questionnaire that wants answers within three weeks, or a board member who, after the mandatory training, suddenly asks questions nobody can answer. That's when it turns out everyone sees the point, but nobody has the time. In Veeam's April 2026 survey, 41 percent of IT leaders named "lack of time for implementation" as the biggest obstacle. That is exactly the gap we're there for: not another advisory report, but someone who will actually do it.

Do you fall under the Act?

That depends on two things: your sector and your size. The Act applies to organisations in the sectors listed in annexes 1 and 2 of the Cybersecurity Act, from energy, transport, banking, drinking water and digital infrastructure to digital providers, postal services, waste, food, chemicals and manufacturing. Within those sectors you count from 50 FTE, or if you're smaller but both your turnover and your balance sheet total exceed 10 million euros. For a few groups, such as telecom providers and public bodies, there is no size threshold. The fastest way to be sure is the NIS2 self-assessment by the RDI, anonymous and free; the NCSC explains the two steps and has guidance for organisations with multiple entities. We are not lawyers and won't tell you whether you're in scope. We come into the picture once the answer is yes.

What needs to happen now

The Act took effect on 15 August 2026 and has no transition period (Dutch government). What's on the table, and who leads it in practice:

1. Register with the NCSC. Via mijn.ncsc.nl, with your Chamber of Commerce number and domain names. Half a day's work, provided someone picks it up. Usually the security officer or a GRC officer.
2. Risk analysis and the duty of care. The Act doesn't prescribe a checklist, but it does require a substantiated risk analysis and demonstrable measures on access, backups, suppliers, incidents and continuity. This is the heart of the programme and the work of an interim CISO or a NIS2 programme lead, often with an ISO 27001 foundation underneath.
3. Set up incident reporting. A significant incident must be reported within 24 hours, with a follow-up within 72 hours and a final report after a month. That only works if there's a process and someone knows who to call. Work for a security officer or your SOC lead.
4. The supply chain. Assessing suppliers, adjusting contracts, and answering your own major customers' questionnaires. GRC work, with supplier-assessment experience.
5. The board. Board members approve the measures, oversee them and complete a training; they have two years from the Act's entry into force to do so (article 26 Cbw). Someone has to take them along without overloading them; that's what an experienced CISO does best.

Who leads this

In practice, organisations look for a NIS2 programme lead who sets up the whole programme, an interim CISO or security officer who takes on the duty of care and the board, a GRC officer for registration, supply chain and evidence, or an ISO 27001 lead implementer when the ISMS needs to become the foundation. Which of the four it is for you depends on what's already there and who's already in place; that's where the intake starts, and the question often turns out to be different from the job title. If you need someone permanently, that's simply permanent recruitment; temporarily, it's interim. We've been doing both for years.

Interim: within two days, and what it costs

Fast doesn't mean sloppy. We start with a proper intake: what's already in place, why now, who this person needs to bring along. Then we search a network of interim professionals we have usually known for years, which is how, for an interim assignment, you'll have your first candidate interviewed within two days. If you need someone permanently, it works differently and takes longer. The best permanent candidates are rarely actively looking: they're settled somewhere and only move for the right arguments, from someone who knows them and what drives them. That is exactly our work, and it produces the best match, but not within two days. Interim professionals are entrepreneurs: more commercial, more flexible in both directions, and therefore faster to propose from the network we actively maintain. If we don't have someone who truly fits, we'll say so, because a profile that wastes your time is worse than an honest no. You always see the professional's rate and our margin separately, and that margin is never more than €15 per hour on a full-time assignment. You can contract the freelancer directly or through your own broker, in which case we invoice only our margin, or entirely through Gruzzy with a single invoice. Who is available right now, and in which rate band, is listed anonymously with the available interim professionals.

Freelance, and the Dutch DBA Act

A NIS2 programme is the textbook example of an assignment with a clear beginning and end: there's a result, the professional decides how the work gets done, and there's no employer-style line of authority. That is exactly what the Dutch tax authority wants to see now that enforcement on false self-employment has resumed since 2025, so freelance fits well here, with a model agreement. We check that right at the intake. If the work is in fact a job, say a security officer who stays on after the programme, we'll say so. Usually that's a permanent role through recruitment; if you really want someone temporarily on payroll, secondment is possible, although it isn't our core business. We're happy to advise on this before you sign.