Belgium · Compliance
NIS2 compliance in Belgium
Achieve NIS2 compliance in Belgium with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- Enschede office team
- Effivity software included
- Academy training included
Who asks for NIS2 in Belgium
Clients include
NIS2 compliance in Belgium at a glance
Law of 26 April 2024 establishing a framework for the cybersecurity of networks and information systems of general interest for public security (the NIS2 Law) is the instrument itself: it applies to the organisations within its scope, and buyers and partners in Belgium ask for evidence that you meet it.
Belgium's NIS2 Law of 26 April 2024 has been in force since 18 October 2024, and the Centre for Cybersecurity Belgium, the national cybersecurity authority and CSIRT, treats registration and evidence as live obligations. Essential entities face mandatory conformity assessment, and the CCB's guidance for the 18 April 2026 milestone sets out three routes: a CyberFundamentals verification, ISO/IEC 27001 documents, or a direct inspection that may lead to supervisory measures. There is no NIS2 certificate, so the work is applicability, registration, risk-management measures and evidence. Financial entities should read DORA alongside it, since the National Bank of Belgium says DORA prevails where the two overlap. Sterling's Enschede office handles the applicability check, gap analysis and documentation, with Effivity and Sterling Academy included. Belgian points are answered below.
Who needs NIS2 in Belgium, and what happens without it
These are the organisations in Belgium that most often need to show NIS2.
- Essential entitiesConformity assessment is mandatory, via CyberFundamentals or ISO/IEC 27001, and the CCB set an 18 April 2026 milestone for demonstrating measures.
- Other entities in covered sectorsConformity assessment is voluntary, but the risk-management duties of the NIS2 Law still apply.
- Financial entitiesDORA applies from 17 January 2025 and prevails over NIS2 where they overlap.
- Suppliers to covered entitiesOrganisations not directly covered may still need to comply because they serve covered entities.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the free readiness checkNIS2 requirements in Belgium
Strip away the vocabulary and NIS2 asks essential and important entities to comply in six areas of cyber risk management.
In Belgium these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: NIS2 explained →
How to achieve NIS2 compliance in Belgium
One team from the Enschede office carries the work from scoping to sign-off. Clients in Belgium are served from Sterling's Enschede office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against NIS2 and the Belgian requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does NIS2 compliance take in Belgium?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Belgium these are the factors that set the timeline.
- Whether the entity is essential or important
- Chosen route: CyberFundamentals verification, ISO/IEC 27001 or direct inspection
- Existing ISMS and incident-reporting arrangements
- Management training and board reporting
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does NIS2 compliance cost in Belgium?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In Belgium these factors move both.
- Size and number of entities in scope
- Control remediation across the entity
- Fees of the accredited assessment body or certification body
- Group structure and sector overlaps with DORA
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
NIS2 consultants and assessors in Belgium
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers NIS2 and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Belgium are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive NIS2 in Belgium (4)
| Instrument | How it treats the standard |
|---|---|
| Law of 26 April 2024 establishing a framework for the cybersecurity of networks and information systems of general interest for public security (the NIS2 Law) | The instrument itself It transposes Directive (EU) 2022/2555; the Centre for Cybersecurity Belgium states that it entered into force on 18 October 2024. |
| Royal Decree implementing the NIS2 Law | Implementing decree The CCB says it completes the transposition, makes conformity assessment mandatory for essential entities and voluntary for others, and names CyberFundamentals and ISO/IEC 27001 as reference frameworks. |
| CCB guidance: what essential entities must have in place by 18 April 2026 | Regulator guidance The ISO/IEC 27001 route requires the certification scope, the Statement of Applicability and the latest internal audit report; the CyberFundamentals route asks for a Basic or Important verification, obtained or in progress, or a signed agreement with an accredited assessment body; a direct inspection route may lead straight to supervisory measures. |
| Regulation (EU) 2022/2554 (DORA), supervised in Belgium by the National Bank of Belgium | The regulation itself Applies to financial entities since 17 January 2025; covers ICT risk management, incident reporting, resilience testing and ICT third-party risk; the Bank's report does not name ISO/IEC 27001. |
Accreditation, audit language and remote audits in Belgium
Compliance, not certification: there is no NIS2 certificate. Entities register, apply the measures and, for essential entities, undergo conformity assessment through CyberFundamentals verification or ISO/IEC 27001 certification by an accredited body. A certificate supports the evidence but does not by itself settle every duty. Edition and transition details: NIS2 hub →
Audit language
The CCB communicates through its portal and guidance, with material available in Belgium's official languages. Internal documentation can be in Dutch, French or English.
Remote and on-site
Gap assessment, policy work and documentation can be remote or on-site; any inspection or verification follows the CCB's and the assessment body's procedure.
NIS2 in Belgium: questions clients ask
Is the NIS2 law in force in Belgium?
Yes. The Law of 26 April 2024, which transposes Directive (EU) 2022/2555, entered into force on 18 October 2024 according to the Centre for Cybersecurity Belgium. A Royal Decree implementing it has also been adopted. Whether your own organisation falls within scope is a legal question for your counsel or the CCB.
Which authority supervises NIS2 in Belgium?
The Centre for Cybersecurity Belgium, which the CCB describes as the national cybersecurity authority and the national CSIRT. Several sectoral authorities support it. Covered organisations register through its Safeonweb@Work portal. For the exact authority responsible for your sector, check the CCB's guidance or ask your counsel.
What does the CCB expect essential entities to show by 18 April 2026?
That they can demonstrate effective risk-management measures. On the CyberFundamentals route, that means a Basic or Important verification obtained or in progress, or a signed agreement with an accredited assessment body. On the ISO/IEC 27001 route, it means the certification scope, Statement of Applicability and latest internal audit report. A direct inspection route may lead straight to supervisory measures.
Does DORA replace NIS2 for a Belgian bank?
Largely. The National Bank of Belgium describes DORA, applicable since 17 January 2025, as a lex specialis that prevails over NIS2 where the two overlap. The Bank supervises financial entities for DORA compliance. Where a group has non-financial activities, which law governs each part is a question for your counsel.
More on NIS2 for Belgian organisations
Other standards Belgian businesses ask Sterling for
Organisations in Belgium often combine NIS2 with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Enschede office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Law of 26 April 2024 establishing a framework for the cybersecurity of networks and information systems of general interest for public security (the NIS2 Law) — ccb.belgium.be (accessed 7 Oct 2026)
- Royal Decree implementing the NIS2 Law — ccb.belgium.be (accessed 7 Oct 2026)
- CCB guidance: what essential entities must have in place by 18 April 2026 — ccb.belgium.be (accessed 7 Oct 2026)
- Regulation (EU) 2022/2554 (DORA), supervised in Belgium by the National Bank of Belgium — nbb.be (accessed 7 Oct 2026)
Talk to a consultant
Plan your certification with the Enschede team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
netherlands@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice