NIS2 for government bodies, with data kept under EU control
Public administration entities of central government are in NIS2 scope regardless of size, and Member States decide how far regional and local government is covered. Public bodies hold sensitive citizen data and must show where it is processed and who controls it.
In short: NIS2 covers public administration entities of central government and, depending on national law, regional and local government. In Belgium, federal public administration entities are essential; in the Netherlands, ministries, provinces, municipalities and water boards are essential entities under the Cyberbeveiligingswet. Secrato runs NIS2, CyFun®, ISO/IEC 27001 and frameworks such as BIO2 on infrastructure in Belgium, under EU law.
Public administration is a sector of high criticality
NIS2 excludes the judiciary, parliaments and central banks, and bodies that mainly work on national security, public security, defence or law enforcement. A public body whose main activity falls in another sector, such as a public hospital or a utility, is covered under that sector. Check your scope →
Accountable security for public services
Hosted in Belgium, under EU law
All GRC data is processed on self-managed infrastructure in a Tier IV data centre in Antwerp, so controls, evidence and incident records stay under European jurisdiction.
Board and council oversight, documented
NIS2 makes the management body responsible for approving and overseeing the measures. Keep decisions, training and reporting on record, from the department to the council or board.
CyFun®, BIO2, ISO/IEC 27001 and NIS2 together
Map CyFun® or ISO/IEC 27001 to the NIS2 measures, and add national baselines such as the Dutch BIO2 as a custom framework mapped to the same controls.
BUILT FROM BELGIUM
What applies to government in Belgium and the Netherlands
In Belgium, public administration entities that depend on the federal state are essential regardless of size; entities of the federated entities are covered after identification by the CCB, as essential or important; municipalities, provinces and CPAS/OCMW are not covered automatically. In the Netherlands, BIO2 is the framework that gives substance to the duty of care for government bodies under the Cyberbeveiligingswet.
Secrato is built and hosted in Belgium. See sovereign enterprise security and the NIS2 Belgium step-by-step guide.
Common questions
Are municipalities in scope of NIS2?
It depends on the country. In the Netherlands, municipalities are essential entities under the Cyberbeveiligingswet. In Belgium, municipalities, provinces and CPAS/OCMW are not covered automatically, only when they provide a service listed in NIS2 and are larger than a small enterprise, or when the CCB identifies them.
Are government bodies essential or important entities?
Public administration entities of central government are essential regardless of size. For regional and local government, national law decides; in Belgium, federated entities are classified after identification by the CCB.
Which parts of government are excluded?
The judiciary, parliaments and central banks, and bodies that mainly carry out activities in national security, public security, defence or law enforcement.
Can we use BIO2 in Secrato?
National baselines that are not in the framework library, such as BIO2, can be added as a custom framework and mapped to the NIS2 measures and your other frameworks. See custom frameworks.
See how Secrato supports your public organisation
Show us your organisation and frameworks, and we will map them to NIS2 in Secrato.
