NIS2 is no longer a project: the European directive has been in force in Belgium since 18 October 2024 via the law of 26 April 2024. For an SME, the topic remains opaque however: between technical obligations, personal director accountability and legal reporting deadlines, where do you start? This checklist groups in 12 actionable steps, classified in 4 pillars, what a Belgian SME must put in place to reasonably consider itself compliant.

1. NIS2 in 2 sentences: what you need to know

NIS2 (Network and Information Security Directive 2) replaces the 2016 NIS directive and largely expands the perimeter of companies subject to cybersecurity obligations. It mandates written cyber governance, minimum technical measures, an incident response plan, mandatory reporting of significant incidents, and supply chain security.

In Belgium, transposition was done through the law of 26 April 2024, in force since 18 October 2024. The competent authority is the Centre for Cybersecurity Belgium (CCB). Any significant incident must be reported to it according to three legal milestones: early warning within 24 hours, intermediate report within 72 hours, final report within one month.

2. Are you subject in 30 seconds

Three cumulative criteria trigger the obligation:

See our NIS2 service page for the full decision matrix and edge cases: NIS2 for Belgian SMEs.

3. The NIS2 checklist in 12 actionable steps

Four pillars, three steps each. The proposed order is progressive: install governance before deploying technical controls, manage incidents before testing the plan, secure the supply chain before training management.

Pillar 1 — Governance

Step Concrete action Expected deliverable
1. Appoint a cybersecurity officer Appoint an internal CISO or cyber delegate with a written mandate Mission letter signed by management
2. Map critical IT assets Inventory workstations, servers, applications, sensitive data, providers Dated and signed asset register
3. Have a written security policy validated Draft an information security policy (ISP) and have it signed by the director Signed ISP document v1.0

Pillar 2 — Risk management

Step Concrete action Expected deliverable
4. Conduct a formal risk analysis Assess probability and impact of threats on assets (EBIOS, ISO 27005 or simplified NIS2 methods) Scored risk matrix + treatment decisions
5. Deploy minimum technical controls MFA on all critical accounts, EDR on workstations, automated patch management, daily and tested backups Configuration screenshots + implementation evidence
6. Document protection measures Maintain a register of security measures with implementation date, owner and evidence Updated measures register

Pillar 3 — Incident management

Step Concrete action Expected deliverable
7. Set up an incident response plan Define roles, detection, containment, eradication and recovery procedures Written response plan + team distribution
8. Master mandatory CCB reporting Know and trace legal deadlines: 24h early warning, 72h intermediate report, 1 month final report Written reporting procedure + pre-filled CCB contacts
9. Test the recovery plan Annual exercise minimum: table-top or ransomware simulation Exercise report + corrective action plan

Pillar 4 — Supply chain and training

Step Concrete action Expected deliverable
10. Secure the supply chain Include cyber clauses (GDPR Article 28, audit right, sub-processors) in critical supplier contracts Supplier list with clauses + signed DPAs
11. Train staff At minimum annual phishing awareness, exercises, cyber hygiene (passwords, MFA, USB) Training certificates + phishing test results
12. Train management Specific cybersecurity training for directors — NIS2 mandate Archived management training certificate
Practical battle order

Start with steps 1, 2, 5 and 11. Governance in place, baseline technical controls deployed, and staff awareness alone cover the bulk of daily risks. Other steps can follow without rush.

Want to assess where you stand on these 12 steps?
Free IT and cyber diagnostic, no commitment. You receive a clear report with the gaps and the priorities.
Request my diagnostic →

4. Sanctions and director accountability

NIS2 provides for two distinct sanction regimes:

Beyond fines, the directive engages the personal accountability of the director. In case of a serious incident with proof of negligence (no plan, no training, no minimum technical measures), the director can be hit with a temporary ban from management positions. This personal accountability makes management training (step 12) non-negotiable.

Key takeaway on accountability

A director who can prove having followed NIS2 training, validated the security policy and allocated reasonable resources retains the ability to invoke due diligence as defence. A director who has done nothing loses that protection.

5. How much NIS2 compliance costs

Costs vary based on the size and maturity of the company. Below are orders of magnitude observed on the 2026 Belgian market.

SME size Initial setup (audit + plan + doc) Recurring IT + cyber package
1-10 users €2,500 - €6,000 VAT excl. €25 - €50 VAT excl. / user / month
10-30 users €5,000 - €12,000 VAT excl. €50 - €80 VAT excl. / user / month
30-100 users €10,000 - €25,000 VAT excl. €50 - €120 VAT excl. / user / month (depending on SLA)
100+ users or regulated sector Custom Hybrid in-house + outsourced

IT and cyber pricing details per user: Belgian SME IT support pricing 2026.

6. Available regional grants

Several Belgian public mechanisms co-finance NIS2 compliance projects.

7. The role of an IT partner in a NIS2 approach

An IT partner like KA IT covers the technical building blocks of the checklist: steps 2, 5, 6, 7, 8, 9 and 10 on the infrastructure and cyber perimeter. Governance (steps 1, 3), risk analysis (step 4) and management training (step 12) are usually carried out in-house or with a governance consultant.

Concretely, KA IT's Business and Managed packages (€50 and €80 VAT excl. per user per month) integrate the baseline technical building blocks: MFA, EDR, patch management, Microsoft 365 backup, monitoring, firewall management. Measure documentation and CCB reporting procedure are produced as part of the service. Details on the packages and pricing page.

8. Frequently asked questions

Is my Belgian SME subject to NIS2?

You are subject if you are an essential entity (250+ employees or €50M+ turnover in a critical sector) or an important entity (50+ employees or €10M+ turnover in a targeted sector). Subcontractors to critical sectors are subject regardless of size. See NIS2 for Belgian SMEs.

What are the sanctions for non-compliance?

Up to €10 million or 2% of global turnover for essential entities. €7 million or 1.4% of turnover for important entities. Plus personal director accountability, which can lead to a temporary ban from management positions.

What is the legal deadline to report an incident to the CCB?

Three legal milestones: early warning within 24 hours of detection, intermediate report within 72 hours, final report within one month. Deadlines set by the law of 26 April 2024 transposing NIS2.

How much does NIS2 compliance cost for a 15-person SME?

For 15 users, the indicative initial setup cost ranges from €5,000 to €12,000 VAT excl. (audit, plan, documentation), plus a recurring IT and cyber package between €50 and €80 VAT excl. per user per month.

Is antivirus enough to be compliant?

No. NIS2 requires a holistic approach: formal risk analysis, response plan, staff and management training, mandatory reporting, supply chain security. Antivirus is just one building block among about ten expected.

What are the 4 pillars of the checklist?

Pillar 1 governance (steps 1 to 3). Pillar 2 risk management (4 to 6). Pillar 3 incident management (7 to 9). Pillar 4 supply chain and training (10 to 12). The 12 steps cover the essentials of NIS2 obligations for an SME.