I don’t know about you, but subjectively I get a very uncertain feeling. It’s great to see the endeavors of the experts to assist and very happy to see more mature security companies willing to assist. What I do see is that many kinds of offers of assistance are largely geared toward compliance. Frankly, this compliance-driven approach scares me.

Compliance means conforming to a rule at a minimum level, such as a specification, policy, standard, or law. In Belgium, the NIS2 bill (transposing the European NIS 2 directive) was approved by the federal parliament on 19 April 2024 (as the second country in the EU). We now see a great many offers to assist in NIS 2 compliance.

What worries me is that compliance is geared towards a minimum requirement with the law instead of focusing on the spirit of the law, its purpose, the desired objectives, and the wanted effects. The idea behind NIS 2 is to force the targeted entities to (finally) strengthen their perimeter against ever-increasing threats. Ideally, this should have been done for a long time.

Legislation like NIS 2 is the result of wanting to address non-conformities.

Non-conformities against common sense, ethical behavior, and best practices, non-conformities against basic information security hygiene. We have seen that with the GDPR (companies that struggle most with the GDPR are the ones that do not or have not respected your privacy), DORA (requirements for financial institutions based on insufficient investment in security or governance and ownership in the financial sector), NIS 2 (essential entities that did not fall under NIS were reluctant to live up to basic security investments).