NIS2 · CONTINUOUS COMPLIANCE

MANAGE NIS2 AS ONGOING COMPLIANCE WORK

For teams building their NIS2 approach and teams extending an existing ISMS. Keep risks, measures, responsibilities, actions and evidence connected and visible throughout the year.

Turn NIS2 requirements into clear ownership and follow-up

Keep risks, measures and supporting evidence connected

See what is open, who owns it and what needs attention

Book a demo See how it works

Works with the Microsoft 365 environment your organisation already uses.

● ● ●

https://isoplanner.app/

NIS2 Compliance Register

8/10

Status

Risk analysis & information system security

Owner: M. Klein

Implemented

Supply chain security

Owner: R. de Wit

Implementation

Incident handling & reporting procedure

Owner: T. Vermeer

Design

Evidence linked as owners complete their tasks

The hard part isn't understanding NIS2. It's keeping the work behind it current, connected and demonstrable.

A risk assessment, security policy, list of measures or incident procedure is manageable on its own. The challenge is keeping risks, measures, responsibilities, actions and evidence connected as people, systems and risks change.

Spreadsheets, SharePoint folders, email and documents are often a practical place to start. But as NIS2 work spreads across teams, someone still has to know what has been decided, who owns the next action, what evidence exists and where attention is still needed.

That is where compliance becomes an ongoing management process rather than a one-time implementation project.

WHAT NIS2 MEANS IN PRACTICE

A practical way to organise the work NIS2 creates

NIS2 creates different legal obligations depending on national implementation. For day-to-day management, the work can be organised around four practical areas. Each one is understandable on its own. Each one also creates work that has to stay current long after it is first organised.

Know why the rules apply to you

Determine whether your organisation falls within the applicable national NIS2 legislation, document the basis for that assessment and complete any required registration. This does not stay settled: as activities, size or services change, the basis for that assessment has to remain traceable and current.

In the Netherlands: NIS2 is implemented through the Cyberbeveiligingswet, which entered into force on 15 August 2026. Organisations in scope must register with the national entity register.

Make cybersecurity a management responsibility

Management bodies must approve the cybersecurity risk-management measures, oversee their implementation and have sufficient knowledge to assess the risks involved. That means NIS2 cannot remain the responsibility of one information security specialist. Management needs visibility into risks, measures, open actions and progress, and that visibility has to hold between meetings, not be assembled in the week before one.

Take appropriate measures based on your risks

NIS2 requires appropriate and proportionate technical, operational and organisational measures to manage cybersecurity risks.

Under the Dutch Cyberbeveiligingswet, the care obligation covers ten areas that organisations must address as a minimum.

Risk Analysis & System Security

Understand your risks and define how information systems are protected.

Incident Handling

Prepare how incidents are detected, handled and followed up.

Business Continuity & Crisis Management

Plan for disruption, recovery, backups and crisis situations.

Supply Chain Security

Manage cybersecurity risks arising from suppliers and service providers.

Development & Maintenance

Address security throughout the system lifecycle, including vulnerability handling.

Effectiveness of Measures

Assess whether cybersecurity measures actually work.

Cyber Hygiene & Training

Maintain basic security practices and cybersecurity awareness.

Cryptography & Encryption

Define how cryptography and encryption are used.

People, Access & Asset Management

Manage personnel security, access and relevant assets.

Authentication & Communications

Use multi-factor or continuous authentication and secure communication channels.

Be ready to act when an incident becomes reportable

NIS2 introduces a phased reporting process for significant incidents. Organisations need clear responsibilities, escalation and records so the right information is available when reporting is required. Readiness is the part you can only organise beforehand: who decides, who escalates, and where the record of the incident already lives.

24 hours – early warning

➤

72 hours – incident notification

➤

Within one month – final report

ISOPlanner™ can help structure the responsibilities, actions and records around your incident process. Formal incident reporting remains part of the applicable national reporting procedure.

WHERE THE FRICTION STARTS

Without a connected system, someone still has to hold the work together by hand

Once NIS2 responsibilities are distributed across IT, security, management, HR, procurement and other teams, the management challenge grows.

A risk may require several measures. A measure may depend on several people. Actions change over time. Documents live in different locations. Evidence needs to remain connected to the decision or measure it supports.

When those relationships are maintained manually, compliance starts depending on spreadsheets, reminders and the knowledge of a few people.

Ownership becomes unclear

The security team knows what needs to happen, but it still has to chase the people responsible for doing it.

Evidence becomes fragmented

Policies, actions, screenshots, decisions and supporting documents sit in different places without a clear relationship to the requirement they support.

Management visibility becomes manual

Reporting means collecting status from different registers and people before management can see where the organisation actually stands.

WHY SOFTWARE, SPECIFICALLY

Stop maintaining those connections by hand

Compliance software does not make your organisation NIS2 compliant. It gives the work structure: instead of maintaining risks, measures, actions, evidence and reporting separately, the relationships between them stay visible. That is what keeps the work current, connected and demonstrable without a manual collection round every time someone asks.

Connected, not just stored

See which risk a measure addresses and which evidence supports it.

Owned, not chased

Give actions and measures clear owners so follow-up does not depend on one person remembering who still owes what.

Current, not reconstructed

Maintain status as work progresses instead of rebuilding the picture when management, auditors or regulators need it.

NIS2 IS NEW FOR YOUR ORGANISATION

Starting with NIS2

You know NIS2 applies, or you are determining what it means for your organisation, but risks, measures, responsibilities and evidence are not yet managed as one process.

Structure requirements, risks and measures from the start

Assign clear responsibility for follow-up

Build evidence into the way the work is managed

Make progress visible across everyone involved

Starting with NIS2 ➤

Build a structure that remains manageable after the initial implementation work is done

ALREADY MANAGING AN ISMS OR ISO 27001?

Already certified

You already manage risks, controls, responsibilities and evidence. The challenge is adding NIS2 without creating a separate compliance process alongside the one you already run.

Map relevant existing work to NIS2 where requirements overlap

Keep ownership and actions in the same management structure

Avoid maintaining separate registers for every framework

See NIS2 alongside the other compliance obligations you manage

See how to professionalise your ISMS ➤

Add NIS2 to the structure you already run, instead of maintaining a second set of registers alongside it.

WHERE THE WORK HAPPENS

Much of the NIS2 work lands with people who don't work in a compliance tool

NIS2 reaches IT, HR, procurement, management and beyond. ISOPlanner™ keeps the compliance structure in place while connecting parts of the work to the Microsoft 365 tools employees already know.

SharePoint

Outlook

Teams

Entra ID

ISOPlanner™

Keeps NIS2 compliance structured around the work your team does in Microsoft 365.Houdt NIS2-compliance gestructureerd rond het werk dat je team in Microsoft 365 doet.Hält die NIS2-Compliance strukturiert rund um die Arbeit, die Ihr Team in Microsoft 365 erledigt.

Keep relevant documents in SharePoint

Bring compliance actions closer to employees' tasks and calendars

Let employees contribute to assigned compliance work

Use your existing Microsoft identity environment to access ISOPlanner™

Don't build a second compliance process for NIS2

NIS2 and ISO 27001 are not the same thing. NIS2 is legislation with governance, risk-management and reporting obligations. ISO 27001 is a management-system standard. But the operational security work can overlap significantly: risks, measures, ownership, evidence and review. Where that overlap exists, ISOPlanner™ lets you map relevant compliance work across frameworks instead of treating every framework as a completely separate programme.

ISO 27001 requirements

➤

Shared risks · measures · owners · actions · evidence

➤

NIS2 requirements

Add NIS2 to the compliance structure you already manage, while keeping clear which requirement belongs to which framework.