Read more at https://www.digitaleoverheid.nl/overzicht-van-alle-onderwerpen/cyberbeveiligingswet/

Does NIS2 apply to my organization?

NIS2 applies to companies with 50+ employees or €10 million+ revenue in essential sectors such as: Healthcare (hospitals, pharmacies, labs) Digital infrastructure (hosting, cloud, online platforms) Food production and distribution Manufacturing (chemicals, pharmaceutical industry) Wastewater and waste management Public administration Smaller organizations in critical sectors may also fall under NIS2. Especially when they are suppliers in the above supply chain. Self-assessment available here: https://regelhulpenvoorbedrijven.nl/NIS2-NL/

What does it mean if I fall within a NIS2 supply chain?

Read more at https://samendigitaalveilig.nl/nis2-ketenzorgplicht/ “Increasingly, companies work intensively with suppliers and service providers, both digitally and physically. NIS2 legislation requires NIS2 entities (approximately 10,000 large organizations and companies) to carefully examine their risks – not only IT and network suppliers, but also suppliers of operational technology and physical systems. This means that 50,000 companies (the suppliers) will be assessed for risk. This will set in motion a large wave of certification requests. After all, it is a requirement of the NIS2 cybersecurity law. Companies will then have to prove to their customers that they have their cybersecurity in order. To prevent this problem from escalating into requirements for overly heavy and unattainable standards, industry associations have further developed Samen Digitaal Veilig (Dutch national platform) and there is collaboration with the NIS2 certification framework. A very good and especially achievable certification.”

How does Lupasafe help?

With Lupasafe you perform the baseline scan yourself or through your auditor or MSP: you then see exactly what is already in order and what is still missing. Your MSP helps to get the technical matters in order, such as safe working from home or backup. Your auditor determines whether you meet the requirements and certifies you according to the certification framework, for example.

What can we provide as evidence for the key controls?

Lupasafe delivers 12 of the 17 key controls. You must deliver the other 5 yourself or with IT. This includes, for example, the backup procedure or the information security policy. See the list here: https://lupasafe.com/auditors/

What do we need to set up once for this?

People & Roles: Assign which users in the Employee list are management, IT manager and data privacy officer Inform client contact person Activate AlwaysOn Elearning Schedule year-long phishing Technical: Connect EntraID Deploy endpoints: install endpoint on workstations via Intune (20 min work) Install network scanner per office location (10 minutes per office or care location) Start 365 cloud audit (1 minute)

Which package do we need from Lupasafe for this?

See feature comparison at https://lupasafe.com/nieuws/welk-niveau-van-cyberbeveiligingsmonitoring-heeft-u-nodig/

NIS2 compliance: software for SMEs, auditors & MSPs

"Top security startup" by Mastercard Strive

Cybersecurity law from Q2 2026.
Lupasafe delivers compliance software for SMEs & organizations, auditors and IT providers to get NIS2 in order. Baseline clear for 12 of the 17 key controls within 60 minutes.

Schedule a demo I am an MSP I am an auditor

I am interested in NIS2 as

Organization

You want to get NIS2 in order

Your challenge

Supply chain must be NIS2 compliant, you are part of it
Management liability for non-compliance
Incident reporting obligation (report within 24 hours to CSIRT).
Complex and time-consuming to manage manually

Auditor

You want to organize NIS2 smartly for your clients and have them engaged in the process

Your challenge

Completing audits within time and budget
Few staff, lots of work
Data is everywhere and nowhere

Reduce audit time by 60%

MSP

You want to demonstrate that the technical & personnel requirements of NIS2 for your clients are in order and not be busy full-time with manual requests

Your challenge

Not losing clients
Lack of time to get clients and organization in order
Lack of integrations and tools

We automate NIS2 for your clients

"Excellent tool"

5/5 Gartner Peer
Insights

For organizations

NIS2 for your organization?

Why start with NIS2 now?

Deadline approaching (Q2 2026)

NIS2 becomes your 'license to operate'

Supply chain responsibility

Heavy penalties for non-compliance

Organizations must start implementation now to comply with customer and legal requirements on time

From baseline check to certificate

In two weeks the baseline is clear 'where do we stand' with Lupasafe

Step 1: Orientation & demo

Step 2: Quote & decision

Step 3: Implementation by IT

Step 4: In operation & insight into the NIS2 baseline

With the baseline check you know what still needs to be done.

Request your NIS2 certification at Samen Digitaal Veilig (Dutch national platform)

Lupasafe solution

All tools ready for NIS2: Awareness, Technical

Continuous insight into progress towards certification

Smart integrations with Microsoft and Google save time and money

Our network of auditors helps you receive the certification quickly and easily.

Trusted by SMEs, healthcare and local governments

Solutions

Marco Wientjes

IT manager
Zorggroep Solis

"Lupasafe delivers with key controls half of our action plan for NIS2 and saves an extraordinary amount of work"

Schedule a demo

Case study: Total Packaging & NIS2

Challenge: Total Packaging, a professional packaging manufacturer in the Netherlands serving the Western European market for A-brands and multinationals, took the security of their systems very seriously. With NIS2 approaching and questions like "Are we ready for NIS2?" and "Can criminals disrupt our factory processes?" Total Packaging wanted certainty. Initially they were interested in a pentest, but quickly realized they wanted fast, continuous results for the entire company.

The solution: Lupasafe provides Total Packaging with continuous scanning of employees, technology and processes to identify and prioritize all cyber risks. In addition, Lupasafe provides phishing training and testing – since 90% of cyber attacks start with phishing. The holistic dashboard gives Total Packaging's IT team direct insight into the health of their systems, while the proactive support team actively contributes ideas for security improvements.

Results:
* Effective monitoring via dashboard prevents issues from becoming serious
* Phishing awareness significantly increased – where normally up to 40% of employees share confidential data, this rapidly decreases with Lupasafe
* Board convinced after first results: "important step towards NIS2 compliance"
* Jurry Bouterse, IT administrator: "Excellent dashboard, proactive support and continuous improvement of our security strategy" Read more

Case study: How auditor Schuiteman helps SME clients with NIS2

Challenge: Schuiteman supports dozens of SME clients that fall under NIS2. As a trusted advisor, they must help their clients not only with financial compliance, but also with cybersecurity and NIS2 compliance. Without appropriate tools, they lacked insight into the actual risks and awareness among clients.

The solution: Schuiteman implemented Lupasafe for their own office and their clients in collaboration with MSPs. Through Lupasafe dashboards they get real-time insight into: the security level of their clients, phishing risks within client organizations, progress of security awareness training & NIS2 compliance status.

Results:
* Hundreds of employees at Schuiteman and their clients now follow Lupasafe Learning
* Concrete substantiation for NIS2 compliance
* Good triangle between client, MSP and auditor where MSP works on auditor's recommendations

How does it work?

Insight into the NIS2 baseline within 60 minutes

Step 1: Onboarding (60 minutes)
Collect data for 12 of the 17 key controls:
Sign up on the platform
Start AlwaysOn Elearning & Phishing
Connect Microsoft EntraID
Deploy the software manually or automatically
Start network scanner
Activate 365 cloud audit

Step 2: Immediate value (day 1)
Dashboard shows 12/17 NIS2 controls. You see immediately: 'We have this under control'.
You have access to key control evidence, for example:
1.6.2 ICT assets inventory
2.2 Education of directors and employees
2.6 Safe working from home
4.4 Malware prevention

Step 3: Continuously compliant
The 12 technical controls are continuously monitored. You see immediately which measures are active and where action is needed.

The team doesn't waste time searching and exporting - everything is continuously collected and updated.

You implement, we support
Support on process, people and technology for your team
Documentation and guides
Advice on targeted phishing and awareness

Why Lupasafe?
Partner of Samen Digitaal Veilig (Dutch national platform).
1000+ organizations / 60+ MSPs in the Netherlands
12/17 controls automated
60 minutes work - instead of weeks of manual work, measured by SMEs & MSPs

Mapped to ISO 27001
Samen Digitaal Veilig (Dutch national platform)'s framework is pragmatic and mapped to ISO 27001. Familiar structure, modern execution.

Data stored at Microsoft Azure Amsterdam

From €7.99 per user per month

Schedule a demo Roadmap
for SME management

Features

What does Lupasafe deliver for NIS2?

1. Organizational controls

Direct insight into the key controls

1.3 Assignment of who is responsible for cybersecurity

1.6.1 Information inventory

1.6.2 ICT assets inventory

1.8 Return of company assets after use

1.14 Management of access rights

Technological controls

We collect data on threats and vulnerabilities from various sources, such as NVD, Microsoft, CISA, and scout the (dark) web for exploits.

4.1 Security and management of user devices

4.4 Combating and preventing malware

4.7 Keep software on company assets up-to-date

4.10 Apply authentication methods

NIS2 Dashboard

The 12 controls are directly filled in for the client so that NIS2 becomes an achievable goal which helps with motivation. Together with your IT and auditor you can follow the progress and see what the 'next best actions' are. The five other controls you and IT must do yourself: for example backup & information plan.

Easily share access with team, IT providers and auditors

Autotask, Google & Microsoft integrations

The endpoints directly share data about for example laptop encryption, employee MFA and use of VPN software

2. Personnel controls

Measure and improve awareness & prevent phishing Smart integration in the controls

2.2 Education of directors and employees on digital security

2.6 Working from home or hybrid in a safe manner

3. Physical measures

Improve the security of Microsoft 365 with Lupasafe integration. A responsive strategy with comprehensive cloud control and continuous monitoring.

3.9 Define access security

Schedule a demo Roadmap for SME management

Frequently asked questions (FAQ)

What is NIS2?
NIS2 is European cybersecurity legislation that came into force on October 17, 2024. The legislation requires organizations to better manage digital risks and take cybersecurity seriously.
Read more at https://www.digitaleoverheid.nl/overzicht-van-alle-onderwerpen/cyberbeveiligingswet/
Does NIS2 apply to my organization?
Your organization may fall under NIS2 directly or indirectly.
NIS2 applies to companies with 50+ employees or €10 million+ revenue in essential sectors such as:
- Healthcare (hospitals, pharmacies, labs)
- Digital infrastructure (hosting, cloud, online platforms)
- Food production and distribution
- Manufacturing (chemicals, pharmaceutical industry)
- Wastewater and waste management
- Public administration
Smaller organizations in critical sectors may also fall under NIS2. Especially when they are suppliers in the above supply chain.
Self-assessment available here:
https://regelhulpenvoorbedrijven.nl/NIS2-NL/
What does it mean if I fall within a NIS2 supply chain?
NIS2 legislation requires NIS2 entities (approximately 10,000 large organizations and companies) to carefully examine their risks – not only IT and network suppliers, but also suppliers of operational technology and physical systems.
Read more at https://samendigitaalveilig.nl/nis2-ketenzorgplicht/
“Increasingly, companies work intensively with suppliers and service providers, both digitally and physically. NIS2 legislation requires NIS2 entities (approximately 10,000 large organizations and companies) to carefully examine their risks – not only IT and network suppliers, but also suppliers of operational technology and physical systems.
This means that 50,000 companies (the suppliers) will be assessed for risk. This will set in motion a large wave of certification requests. After all, it is a requirement of the NIS2 cybersecurity law. Companies will then have to prove to their customers that they have their cybersecurity in order.
To prevent this problem from escalating into requirements for overly heavy and unattainable standards, industry associations have further developed Samen Digitaal Veilig (Dutch national platform) and there is collaboration with the NIS2 certification framework. A very good and especially achievable certification.”
How does Lupasafe help?
Lupasafe offers a complete compliance platform for NIS2 with awareness training, phishing simulations and reports that demonstrate you comply with the law.
With Lupasafe you perform the baseline scan yourself or through your auditor or MSP: you then see exactly what is already in order and what is still missing. Your MSP helps to get the technical matters in order, such as safe working from home or backup. Your auditor determines whether you meet the requirements and certifies you according to the certification framework, for example.
What can we provide as evidence for the key controls?
12 of the 17 controls.
Lupasafe delivers 12 of the 17 key controls. You must deliver the other 5 yourself or with IT. This includes, for example, the backup procedure or the information security policy.
See the list here: https://lupasafe.com/auditors/
What do we need to set up once for this?
Connect EntraID & endpoint deployment
People & Roles:
- Assign which users in the Employee list are management, IT manager and data privacy officer
- Inform client contact person
- Activate AlwaysOn Elearning
- Schedule year-long phishing
Technical:
- Connect EntraID
- Deploy endpoints: install endpoint on workstations via Intune (20 min work)
- Install network scanner per office location (10 minutes per office or care location)
- Start 365 cloud audit (1 minute)
What do we need to maintain monthly for this and how much time does it take?
Management tasks such as checking scanner and handling user questions, renewing EntraID consent - max 15 minutes
Which package do we need from Lupasafe for this?
AWARENESS contains 1 key control 2.2 "Education of directors", PRO contains the 12 controls
See feature comparison at https://lupasafe.com/nieuws/welk-niveau-van-cyberbeveiligingsmonitoring-heeft-u-nodig/

Leaders choose Lupasafe

What IT leaders and MSPs say

Gert de Fluiter

Partner Schuiteman Accountants and Advisors

"Many SME entrepreneurs struggle with the question 'Am I secure enough?'. With Lupasafe we work to guarantee security and reduce and limit the risks of a hack."

F.S.

IT Director Sobell Rhodos

"I can continuously monitor the team, devices and security, so we are all safe."

NIS2

Compliant

Evidence

Compliance and monitoring

Ruben Schevers

IT Manager Hendriks Group

"Thanks to the phishing campaigns our employees are now better prepared for cyber threats"

Juryry Bouterse

IT Administrator, Total Packaging

"Lupasafe provides a reassuring step towards compliance, helps me meet legal requirements and effectively secure my systems."

Marc Paus

CISO Mobile World Congress

"Within 10 days we were more secure."

Pieter Willemsen

CEO, Hupra ICT

"Every company is a potential target due to the automation and scale of hackers - Lupasafe makes us more secure by making vulnerabilities harder for hackers to find."

100%

Recommend Lupasafe

5/5 Gartner rating

Jelle Witteveen

Technical Director, Motivo

"Quick results: now we have cybersecurity under control"

Rick van den Hoorn

STH Automatisering

"Our clients tell us they have become much more aware of cyber risks. For us, Lupasafe is a great tool to achieve this awareness of cyber risks."

Book a demo NIS2 for SME management

Recent NIS2 articles

Henk Bijsterbosch

Samen Digitaal Veilig (Dutch national platform)

"With Lupasafe our platform offers a complete package. SME companies can demonstrate that they work safely, in accordance with the risks they run in the supply chain of the NIS2 client."