GRC software
GRC software for the Benelux
What organisations in Belgium, the Netherlands and Luxembourg need from a GRC platform for NIS2, DORA, ISO/IEC 27001 and the Cyber Resilience Act, and how Secrato approaches it.
In short: Belgium, the Netherlands and Luxembourg each apply NIS2 through their own national law, supervisor and reporting channels, so a GRC platform for the Benelux has to run one control set against several rule sets. Secrato is a Belgian GRC platform hosted in Antwerp that covers NIS2, DORA, ISO/IEC 27001 and the Cyber Resilience Act, plus the Belgian CyFun® framework and the Dutch Cyberbeveiligingswet. This page is written by Secrato. It is a buyer’s guide, not legal advice.
Belgium and the Netherlands at a glance
Based on Secrato’s own step-by-step guides, checked in November 2026. Check the official texts and your supervisor for binding requirements.
| Topic | Belgium | Netherlands |
|---|---|---|
| National NIS2 law | NIS2 Law of 26 April 2024, in force since 18 October 20241 | Cyberbeveiligingswet (Cbw), now in force3 |
| Authority and registration | Centre for Cybersecurity Belgium (CCB), the national authority and CSIRT. Registration on Safeonweb@Work: 18 December 2024 for some digital entities, 18 March 2025 for all others1 | In-scope organisations register with the NCSC via MijnNCSC2 |
| Scope | Medium-sized and larger entities in the Annex I and II sectors, and some entity types regardless of size1 | Self-assessment: the organisation decides whether it is in scope. As a rule, small enterprises (under 50 employees and under EUR 10 million turnover or balance sheet total) are out of scope, but some entity types are covered regardless of size2 |
| Incident reporting | Early warning within 24 hours, notification within 72 hours, final report within one month1 | Significant incidents within 24 hours, 72 hours and one month2 |
| Route to show compliance | CyFun® (BASIC, IMPORTANT or ESSENTIAL) or ISO/IEC 27001, assessed by bodies accredited by BELAC and authorised by the CCB1 | Duty of care (zorgplicht) under Cbb articles 6 to 18, plus sector rules where they apply2 |
| Financial entities | DORA applies as lex specialis for ICT risk management and incident reporting1 | DORA applies as lex specialis for ICT risk management and incident reporting5 |
Luxembourg
Luxembourg is part of the Benelux picture, especially for financial services and cross-border groups. Secrato’s incident reporting playbook covers who to notify in Belgium, the Netherlands and Luxembourg4, and the DORA guide for the Benelux covers financial entities5. We do not yet have a dedicated Luxembourg guide, so confirm national details with your Luxembourg supervisor.
What a Benelux GRC platform should do
- One control set, several rule sets. A control and its evidence should count towards NIS2, DORA, ISO/IEC 27001, the CRA and national schemes at the same time. Mapping shows correspondence, not equivalence, so scope decisions stay with you.
- The national route you actually use. In Belgium that is CyFun® or ISO/IEC 27001 with maturity targets per control. In the Netherlands it is a documented duty of care.
- Incident notification workflows. Clear steps for the 24-hour, 72-hour and one-month reports.
- EU hosting you can name. Country, data centre and operator, including backups and support access.
- Local languages. Dutch, French and English for the interface and support.
- Audit-ready evidence. A dated trail that stands up to an assessor.
How Secrato approaches it
- One Unified Control Library connects controls, evidence, risks, policies and audits across frameworks8
- CyFun® support from BASIC (34 controls, maturity target 2.5) to IMPORTANT and ESSENTIAL6
- Hosted on self-managed infrastructure in a Tier IV data centre in Antwerp, Belgium7
- Free NIS2 Starter on CyFun® BASIC (early access, limited places); Core, Pro and Enterprise on quote9
- Multiple entities and workspaces for groups and MSPs10
When another approach may fit
Organisations that need one certification with a small scope may be well served by templates and a consultant. Start with our free templates. Large financial institutions with a very specialised supervisory regime may prefer a platform built for that sector. See our comparisons for how Secrato differs from other platforms.
Questions to ask any GRC vendor
- In which country, data centre and cloud provider is our data stored, including backups and support access?
- Which of our frameworks (NIS2, DORA, CRA, ISO/IEC 27001, national schemes) are maintained by the vendor, and how fast are updates?
- Can one control and one piece of evidence count for several frameworks?
- Which languages do the interface, policies and support use?
- How is pricing calculated (users, frameworks, entities), and what does onboarding cost?
Frequently asked questions
What are the best GRC tools in the Benelux?
It depends on your sector, size and frameworks. Compare vendors on hosting location, framework coverage, local languages and pricing. We list the criteria above and publish factual comparisons with other platforms on our comparison pages.
Do I need separate tools for Belgium and the Netherlands?
Not necessarily. The national laws differ, but a platform with one control library can map the same controls and evidence to both. Registration, supervisors and reporting channels stay national.
Which GRC platform keeps data in Belgium?
Secrato hosts all customer data on self-managed infrastructure in a Tier IV data centre in Antwerp, Belgium.
Is there a free way to start?
Yes. The NIS2 Starter runs on CyFun® BASIC and is free during early access, for one user and one workspace. Places are limited.
Sources
Information from secrato.io, checked in November 2026.
- secrato.io/nis2-belgium-step-by-step-guide/
- secrato.io/cyberbeveiligingswet-cbw-step-by-step-guide/
- secrato.io/nis2-netherlands-cyberbeveiligingswet-cbw/
- secrato.io/incident-reporting-playbook-nis2-dora-cra-gdpr/
- secrato.io/dora-step-by-step-guide-benelux/
- secrato.io/cyfun/
- secrato.io/sovereign-enterprise-security/
- secrato.io/frameworkmapping/
- secrato.io/plans/
- secrato.io/multi-tenant-workspace-management/
About this page. Written by Secrato, a GRC software vendor. It summarises Secrato’s own guidance and is not legal advice. Check the official legal texts and the competent authorities, such as the CCB in Belgium and the NCSC in the Netherlands, for binding requirements. Spotted something out of date? Let us know.
See Secrato with your own frameworks
EU-hosted GRC for NIS2, DORA, ISO/IEC 27001, the CRA and more. Start free with NIS2 Starter or book a 30-minute demo.
