NIS2: what you need to know about the cybersecurity law and Software procurement
NIS2 is the largest European cybersecurity law in years and has applied in the Netherlands since 15 August 2026 via the Cybersecurity Act. What changes and what does it mean for Software procurement and managing Software manufacturers?
- 18 August 2026
- 5 min
- NIS2 – Cyber Security Directive
The NIS2 Directive is the most significant European cybersecurity legislation in years. In the Netherlands, it has been implemented in the Cybersecurity Act (Cbw), which came into force on 15 August 2026. For those responsible for Software procurement, the law is immediately relevant.
What is NIS2?
NIS2 stands for Network and Information Security Directive 2, the successor to the original NIS Directive from 2016. The directive requires organisations in critical sectors to structurally enhance their digital resilience. Member States were required to transpose the directive by 17 October 2024 at the latest. The Netherlands did so with the Cybersecurity Act, effective from 15 August 2026, replacing the Network and Information Systems Security Act.
Who does the Cybersecurity Act apply to?
It applies to over 8,000 organisations in the Netherlands that provide essential or important services in sectors such as energy, transport, healthcare, drinking water, digital infrastructure, financial services, and government. Suppliers feel the impact through the requirements their clients impose on the supply chain.
What changes?
Duty of care: appropriate measures to manage risks, including within the supply chain.
Notification obligation: serious incidents must be reported promptly, with an initial notification within 24 hours.
Registration requirement: organisations subject to the law must register with the NCSC.
Role of directors: directors are responsible for compliance and must undertake training in cybersecurity.
Higher fines: the directive specifies maximum fines up to €10 million or 2% of global annual turnover for essential entities.
What does this mean for Software procurement?
The supply chain responsibility affects Software procurement most directly. In practice, this means:
An up-to-date overview of all ICT suppliers and Software, including tools acquired outside IT departments
Security agreements in contracts with relevant Software manufacturers
Regular assessment of the security of those parties
Agreements on incident reporting with critical Software manufacturers
How SoftVaro helps
Without a complete overview of your Software, compliance is difficult. SoftVaro maps your Software landscape and incorporates the terms your organisation requires at each renewal. This article is not legal advice; please coordinate its application with your compliance or legal department.
Frequently Asked Questions
The most commonly asked questions on this topic.
What does NIS2 have to do with Software procurement?
The law requires organisations to manage risks in their supply chain, including their ICT suppliers and Software manufacturers. For this, you need an up-to-date overview of your Software and suitable agreements in contracts.
Since when has the Cybersecurity Act applied?
The Cybersecurity Act, the Dutch implementation of NIS2, came into effect on 15 August 2026. Organisations subject to it must register via the NCSC portal.
What are the fines for non-compliance?
The NIS2 Directive specifies maximum fines of up to €10 million or 2% of global annual turnover for essential entities, and up to €7 million or 1.4% for important entities. Directors are responsible for compliance.
Ready to save on software?
SoftVaro negotiates the best deal for you with over 4,000 suppliers. Independent, transparent, within 24 hours.