NIS2 is the European directive that obliges organizations to take their digital security seriously. Not just ministries and energy companies, but also many medium-sized organizations in sectors like healthcare, government, waste management, transport, and digital services.
Belgium has already implemented NIS2 in legislation. In the Netherlands, this is done through the Cybersecurity Act. Always check the current status and specific rules for your sector.
What does NIS2 require?
In short, your organization must:
- identify cyber risks and take appropriate measures;
- ensure access management, MFA, and encryption;
- be able to detect incidents and report them quickly to the supervisor;
- consider the security of suppliers;
- ensure business continuity, including backups;
- hold the management responsible. Executives are personally accountable.
Where does Microsoft 365 help?
Microsoft 365 is not a NIS2 certificate. But it does contain many building blocks you need.
Identity and access
With Microsoft Entra, you manage MFA, conditional access, and administrator rights.
Devices
With Intune, you ensure laptops and phones are encrypted, updated, and managed.
Detection and response
Microsoft Defender detects attacks on devices, email, identities, and cloud apps. With Microsoft Sentinel, you can consolidate signals.
Information protection
With Microsoft Purview, you label and protect sensitive information and record activities in audit logs.
Insight into your status
Microsoft Secure Score shows how strong your security is. Compliance Manager in Purview helps assess your measures against standards and legislation.
What Microsoft 365 does not solve for you
- Processes: who reports an incident, when, and to whom?
- Risk analysis: which systems are critical for your services?
- Suppliers: how secure are the parties you work with?
- Governance: does the management know what is expected of them?
Technology is a tool. NIS2 mainly requires an organization that knows what it’s doing.
How to start
- Determine if your organization is subject to NIS2.
- Assess your current security level, for example with Secure Score.
- Address the basics: MFA, managed devices, and backups.
- Define incident processes and responsibilities.
- Schedule periodic checks.
Honest advice
We are Microsoft specialists, not lawyers. For legal questions, work with your lawyer or a specialized advisor. But for translating to a secure Microsoft 365 environment, we’re happy to stand by your side.
Want to know how your Microsoft 365 environment is doing regarding NIS2? Schedule a conversation and we’ll make an initial analysis together.
Frequently Asked Questions
Is my organization subject to NIS2?
That depends on your sector and size. Consult the information from the supervisor in your country, such as the CCB in Belgium.
Is Microsoft 365 NIS2-compliant?
Microsoft offers tools that help you comply. Compliance is always the responsibility of your own organization.
Do I need E5 for NIS2?
Not necessarily. Many basic measures can be arranged with Business Premium or E3. E5 offers more advanced detection and compliance.
