A Belgian business subject to NIS2 must be able to demonstrate that it manages cyber risks in a structured way: a risk assessment, security policies, an incident handling and reporting procedure, a business continuity plan, an inventory of its assets and their owners, and management approval of these measures. Directive (EU) 2022/2555 sets out this framework, the Belgian law of 26 April 2024 transposes it into national law, and the CCB oversees its implementation.
Does NIS2 apply to your business?
Size alone does not determine this. Your sector comes first.
The directive covers medium-sized and large entities operating in the sectors listed in its Annexes I and II: energy, transport, banking, health, water, digital infrastructure, manufacturing of certain products, food, and postal services, among others. It classifies them as essential or important entities, with different supervisory regimes.
In Belgium, the law of 26 April 2024 transposes the directive into national law. It came into force on 18 October 2024. Entities within scope must register with the CCB. In some sectors, a sector-specific authority is also involved, such as the BIPT for certain digital infrastructure.
In practice, a business with more than 1,000 employees in a listed sector is almost always within scope. The real question then becomes: essential or important? The CCB publishes guidance to help you check.
What exactly do you need to document?
Many teams treat NIS2 as a documentation exercise. They draft policies, file them on SharePoint and consider the job done. That is not what the legislation requires. It calls for risk management measures to be implemented, with documentation serving as evidence that they are.
Article 21 of the directive lists the minimum measures. For each one, you must be able to show what is in place and who is responsible.
| What the directive requires | What you must be able to show | Where data governance helps |
|---|---|---|
| Risk analysis and security policies (Art. 21(2)(a)) | An up-to-date risk assessment and the policies based on it | Knowing which data is critical, and for which processes |
| Incident handling and reporting (Art. 21(2)(b) and Art. 23) | A procedure, defined roles and an incident history | Quickly identifying which systems, data and reports are affected |
| Business continuity (Art. 21(2)(c)) | Backups, disaster recovery and crisis management | Identifying the sources that day-to-day decisions depend on |
| Supply chain security (Art. 21(2)(d)) | A list of critical suppliers and the requirements they must meet | Seeing which data passes through which supplier or platform |
| Access control and asset management (Art. 21(2)(i)) | An inventory of assets, their owners and access rules | An up-to-date inventory of sources, datasets and their owners |
The other measures in Article 21 cover areas including secure development and maintenance, assessing the effectiveness of measures, cyber hygiene and training, cryptography and multi-factor authentication. These are primarily IT security matters, rather than data governance.
Who is responsible within the business?
NIS2 does not leave this solely to the person in charge of security. Article 20 of the directive requires management bodies to approve risk management measures, oversee their implementation and undergo training. They can be held liable for failures to comply. Belgian law incorporates this principle.
For documentation, this changes one thing. Having a policy is not enough. You need a record of who approved it, when, and who keeps it up to date.
For example: your access control policy states that every sensitive dataset has an owner who approves access. If nobody knows who that owner is for the customer database, the policy exists on paper, not in practice.
What are the deadlines for reporting an incident?
Article 23 of the directive sets out three stages for a significant incident: an early warning within 24 hours of becoming aware of it, a notification within 72 hours, and a final report no later than one month after the notification. In Belgium, incidents are reported to the CCB.
These are tight deadlines. They require you to identify quickly which systems are affected, what data they contain and which services depend on them. This is where an up-to-date inventory saves hours, while an outdated one wastes them.
How does the CCB help structure your approach?
The CCB provides the CyberFundamentals (CyFun) framework, with several assurance levels. Entities can use CyFun or the ISO/IEC 27001 standard to demonstrate compliance.
Both frameworks require an asset inventory and clearly assigned responsibilities. If you have already started working with either one, much of your NIS2 documentation is probably already at least partly in place. The work often involves connecting it, filling the gaps and keeping it up to date.
A practical framework: Inventory, Assign, Assess, Track, Review
- Inventory: list the systems, data sources and reports that support your critical services.
- Assign: give each one a named owner, an individual rather than a team.
- Assess: record how critical each asset is and the state of its data quality.
- Track: keep a dated record of decisions, approvals and incidents.
- Review: have the inventory and owners confirmed at regular intervals, for example every quarter.
Where dScribe fits in
dScribe is not a NIS2 compliance tool and does not make any business compliant. It helps with one specific part of the work: showing who is responsible for your data, and what has changed.
In the dScribe application, the audit trail shows you the owner of each of your data assets. It also keeps a history of who changed what, and when. For NIS2 documentation, this provides a concrete record of how responsibilities are assigned and tracked over time.
For example, in just a few clicks, you can see who owns the customer database and who changed its description last month. These are the questions raised in the section on responsibilities: who is accountable for the asset, and who keeps the information up to date.
dScribe reads metadata only. Your data itself never leaves its source. Risk assessments, security policies and legal advice remain your responsibility.
Conclusion
NIS2 is not about filling binders. It is about knowing what you have, what is critical and who is responsible. Documentation simply demonstrates that knowledge. If your inventory of assets and their owners is already actively maintained, much of the work is done. If it sits in a forgotten file, that is where you need to start.
Frequently asked questions
Does NIS2 apply to my business in Belgium?
That depends first on your sector, then on your size. Medium-sized and large entities in the sectors listed in Annexes I and II of the directive are within scope. The CCB publishes guidance to help you check.
Does NIS2 require a data catalogue?
No. The directive does not specify any tools. Its requirements include asset management and access control policies, and an inventory of data and its owners is one way to document this part.
What is the difference between NIS2 and the GDPR?
The GDPR protects personal data. NIS2 addresses the security of the network and information systems that support essential or important services. The same incident can, however, fall under both laws, with separate reporting requirements.
Who must approve NIS2 measures within the business?
Management bodies, under Article 20 of the directive. They approve risk management measures, oversee their implementation and undergo training. Keeping a dated record of these approvals is useful.
Do you need ISO 27001 certification for NIS2?
The directive does not require any specific certification. In Belgium, the CCB recognises several routes to demonstrating compliance, including CyberFundamentals and ISO/IEC 27001. Check with your legal adviser which is right for your situation.