Meet Polar Risk at the Cyber Security & Cloud Expo, November 19 and 20 at the RAI Amsterdam. Discover how to translate cyber risks into financial impact.
NIS2 its duty of care requires organisations to demonstrably manage their cyber risk. A quantitative risk analysis shows you which measures are appropriate and proportionate, in the language of the board: Euros.
RansomwareData breachOutage IT supplierMalicious Insder
€ 0€ 350.000€ 1.000.000
How much risk you are willing and able to carry
Amount of cyber risk you must take measures for
— The directive
What does the NIS2 require?
NIS2 requires you to carry out a risk analysis an, on that basis, take appropriate and proportionate measures. The cost of implementation is explicitly part of that judgement.
Art. 21.1
Appropriate and proportionate technical, operational and organisational measures.
Art. 21.2
Risks and vulnerabilities associated with suppliers and service providers.
Art. 21.1
Security appropriate to the risks and the cost of implementation.
Art. 20
The board is accountable for managing cyber risk and for assessing the consequences.
The duty of care is risk-based
“The whole starting point of the NIS2 is really risk management.”
One assessment forms the foundation: your cyber risks in the language of your board. Add modules for board training and periodic reassessment.
Cyber Risk Assessment
We identify the cyber risks relevant to you and quantify them in euros using the FAIR Methodology. That is how you show which measures are appropriate and proportionate.
EVERY OUTCOME MEETS A CONCRETE OBLIGATION
Art. 21.1
Insight into the cyber risks relevant to you
Art. 21.1
Likelihood and financial impact per cyber risk
Art. 21.1
Insight into which cyber risks the organisation can and will carry
Art. 21.1
Transparent evidence for 'appropriate measures' under NIS2
Modules
Choose what you add
Board training
Training for board members on identifying cyber risk and making well-informed choices.
Art. 20
Follow-up assessment
Turn risk management into a continuous process: measure what your measures deliver and reassess your risk analysis periodically.
Art. 21
— Outcome
What does it deliver?
After the assessment you know which cyber risks you are running, what they cost and which measures demonstrably fit them. That is the evidence a regulator expects for your duty of care.
The risk analysis the duty of care calls for
Know which cyber risks you are running
Decide how much cyber risk you want to carry
Take appropriate measures
Prepare board members for NIS2
Do more with less
Spend your security budget on measures that demonstrably reduce risk.
Raise your resilience
Reduce both the likelihood and the financial impact of cyber incidents.
Build confidence
Show your board, customers and regulators that cyber risk is demonstrably under control.
Our services for quantitative cyber risk management
Complete
Cyber Risk Assessment
A quantified picture of your most important risk scenarios.
What is NIS2 and what is the Dutch Cybersecurity Act?
NIS2 is the European directive on the security of network and information systems. The Dutch Cybersecurity Act (Cyberbeveiligingswet, Cbw) is the Dutch law that implements the directive and has applied since 15 August 2026. The Cbw replaces the Network and Information Systems Security Act (Wbni).
Who does the Dutch Cybersecurity Act apply to?
The Cbw applies to essential and important entities in eighteen sectors, including energy, digital infrastructure, ICT service management, postal and courier services, research, healthcare and government. In practice this means organisations with 50 employees or more, or an annual turnover or balance sheet total above €10 million. It is your own responsibility to check whether you fall within scope; the Dutch regulator RDI offers a self-assessment for this.
What does the duty of care actually involve?
The duty of care requires you to take appropriate and proportionate technical, operational and organisational measures to manage your cyber risk. The law sets out ten categories of measures you must take as a minimum. How you meet them is not prescribed: the duty of care is risk-based. So you first need insight into your risks and then decide, on that basis, what is appropriate. Article 21.2 makes the cost of implementation an explicit part of that judgement.
How do you demonstrate that you meet the duty of care under NIS2 and the Cbw?
By recording the judgement itself, not by handing over a list of measures. A regulator wants to be able to follow which risks you identified, how large you assessed them to be, which risk you consciously accept and why the measures you chose fit. A quantified risk analysis provides that chain of evidence.
What is a good order to start with the duty of care?
Four steps. One: establish which services and systems are critical to you. Two: carry out a risk identification and risk analysis, including your supply chain dependencies. Three: decide which risk you carry and which measures you take, with the costs in the balance. Four: record it and reassess periodically, so you can show that risk management is a continuous process.
Is a risk matrix enough for the Cbw?
A risk matrix gives you an at-a-glance overview of dozens of risks side by side, but it is less useful for making decisions. Two risks that both score 'high' can differ enormously in expected loss, and it is precisely that difference that determines which measure is appropriate and proportionate. To evidence the cost judgement under article 21.2 you want a quantitative risk analysis: likelihood and financial impact per scenario, in euros.
Is ISO 27001 enough for NIS2 and the Cbw?
No. ISO 27001 is a standard; the Cbw is a law. Under ISO 27001 you set the scope yourself, even if that is a single application or a single department. The Cbw applies to the network and information systems your organisation uses for its operations or its services. A management system based on ISO 27001 or NEN 7510 is, however, a good foundation for meeting the duty of care.
What happens if you do not comply with the Cbw?
There is no transition period: the duty of care, the reporting obligation and the registration obligation have been enforceable since 15 August 2026. Regulators can impose fines of up to €10 million or 2% of global annual turnover on essential entities. For important entities, regulators can impose fines of up to €7 million or 1.4% of global annual turnover.
.svg)
.svg)