NIS2, ISO 27001 and vCISO guides.
Practical guides to NIS2, ISO 27001, incident reporting and supply-chain risk, written by the people who run the platform.
Does NIS2 apply to SMEs? Who is in scope, and what smaller suppliers still have to do
NIS2 applies to medium-sized and large companies in the sectors it lists: 50 or more employees, or more than EUR 10 million in both turnover and balance sheet. Small companies are mostly out of scope, but their NIS2-regulated customers pass the requirements on.
NIS2 encryption requirements: what Article 21 asks for cryptography, and when encryption is expected
NIS2 requires every essential and important entity to have a cryptography policy, and encryption where appropriate to the risk. What Article 21(2)(h) says, what Regulation 2024/2690 adds, a policy outline, key management, post-quantum plans and the telecom rules.
NIS2 for the food sector: which food businesses are in scope (wholesale, processing, production)
NIS2 covers food businesses engaged in wholesale distribution and industrial production and processing, if medium-sized or larger. Who is in and out, from dairies and drinks makers to retailers, restaurants and farms, essential or important, and what applies.
NIS2 Article 28: domain registration data (WHOIS) obligations for registries and registrars
NIS2 Article 28 requires TLD registries, registrars and resellers to keep accurate and complete domain registration data, verify it, publish non-personal data and answer access requests within 72 hours. Scope, data fields, GDPR and a verification checklist.
NIS2 in Germany: what the NIS2UmsuCG and the new BSIG require, who is in scope and the BSI deadlines
NIS2 has applied in Germany since 6 December 2025 through the NIS2UmsuCG and a new BSIG. Who is in scope under § 28, the § 33 registration deadline that has passed, § 32 reporting, § 30 measures, § 38 management duties and § 65 fines, mapped to NIS2.
NIS2 training requirements: who must be trained, on what, and how often
NIS2 requires members of the management body to follow cybersecurity training and makes staff training a minimum risk-management measure. It sets no hours, certificate or approved provider. What the law says, what the implementing rules add, a training plan and a record template.
NIS2 in Belgium: what the law of 26 April 2024 requires, who is in scope and the CCB deadlines
Belgium's NIS2 law, the Law of 26 April 2024, has applied since 18 October 2024, with the CCB as national authority. Scope, Safeonweb@work registration, incident reporting, the CyberFundamentals and ISO 27001 routes, the 2026 and 2027 deadlines, and fines.
NIS2 jurisdiction: which Member State supervises you, and how the main establishment rule works
Under NIS2 you are supervised by the Member State where you are established. Telecoms answer to each country they serve; cloud, MSP and other digital providers to their main establishment. The rules, the main establishment test, non-EU providers, mutual assistance and groups.
NIS2 in Luxembourg: the Law of 5 May 2026 explained (scope, ILR registration, reporting and fines)
Luxembourg transposed NIS2 through the Law of 5 May 2026, in force since 10 May 2026. Who is in scope, how to register with the ILR, the ten Article 12 measures, the 24-hour reporting clock and fines of up to EUR 10 million or 2% of turnover.