NIS2 raises the cybersecurity expectations for organizations that provide essential and important services across the European Union. For IT and security teams, the directive has practical implications for how organizations manage cybersecurity risk, control access, respond to incidents, address vulnerabilities, and demonstrate that security measures are consistently applied.
Those requirements are becoming increasingly concrete as EU member states implement NIS2 through national legislation. In the Netherlands, the Cyberbeveiligingswet implementing NIS2 took effect on August 15, 2026, bringing new cybersecurity, registration, and incident-reporting obligations into force for organizations within its scope.
IT teams need to understand which cybersecurity practices they must implement and how their technology stack can help them maintain those controls over time.
What is NIS2?
The Network and Information Security 2 Directive, commonly known as NIS2, is an EU cybersecurity directive designed to strengthen cybersecurity and resilience across critical and important sectors.
NIS2 expands on the original NIS Directive by applying cybersecurity risk-management and incident-reporting requirements to a broader range of organizations. It also increases expectations around areas such as vulnerability management, access security, business continuity, supply-chain security, incident handling, and organizational accountability.
EU member states implement NIS2 through national legislation. While the underlying directive establishes common cybersecurity objectives across the EU, organizations should review the specific requirements that apply in each country where they operate.
Who needs to comply with NIS2?
NIS2 applies to organizations classified as essential or important entities across a wide range of sectors. Applicability depends on factors including the services an organization provides, its size, its sector, and the national legislation implementing the directive.
Covered sectors include areas such as:
Energy
Transport
Banking and financial market infrastructure
Healthcare
Digital infrastructure
ICT service management
Public administration
Manufacturing of certain critical products
Digital providers
Postal and courier services
Waste management
Food production and distribution
Chemicals
Research
Organizations should evaluate their specific circumstances rather than relying solely on industry or company size to determine whether NIS2 applies.
What cybersecurity requirements does NIS2 introduce?
NIS2 requires covered organizations to take appropriate and proportionate technical, operational, and organizational measures to manage cybersecurity risks. Article 21 of the directive identifies several areas that organizations need to address.
For IT teams, several requirements have direct implications for day-to-day security operations:
1. Cybersecurity risk management
Organizations need processes for identifying cybersecurity risks and implementing appropriate measures to reduce them.
Effective risk management depends on ongoing visibility into systems, users, endpoints, vulnerabilities, and security configurations. IT teams also need processes for assessing whether their security controls continue to operate effectively as environments and threats change.
2. Incident prevention, detection, and response
NIS2 requires organizations to prepare for cybersecurity incidents and establish processes for handling them.
That makes visibility particularly important. IT and security teams need enough information about systems and activity to identify potential problems, investigate incidents, take remediation actions, and provide the evidence needed for incident reporting and post-incident analysis.
3. Vulnerability handling and software security
Vulnerability management is another important element of the NIS2 framework.
Organizations need processes for identifying vulnerabilities in their technology environments and addressing them before they create unnecessary exposure. This includes maintaining operating systems and applications, applying security updates, tracking remediation progress, and evaluating whether security measures remain effective.
A repeatable patch management process can help reduce the time between identifying a vulnerability and remediating affected systems.
4. Identity, authentication, and access control
NIS2 specifically addresses access control and identity-related security measures.
IT teams should be able to determine who can access systems and resources, apply appropriate permissions, remove access when it is no longer needed, and use strong authentication mechanisms where appropriate.
These practices become especially important for remote administration and support, where privileged users may be able to access systems from outside the organization's traditional network perimeter.
5. Security monitoring and auditability
Organizations also need ways to evaluate the effectiveness of their cybersecurity measures.
Centralized logs, activity records, endpoint information, and security reporting can help teams investigate events and demonstrate how controls are being applied. Maintaining accessible evidence also makes it easier to review security processes and prepare for audits.
Logging alone does not satisfy NIS2 requirements, but reliable records are an important component of a broader compliance program.
6. Business continuity and supply-chain security
NIS2 extends well beyond endpoint and access security. The directive also addresses areas including:
Business continuity
Backup management and disaster recovery
Crisis management
Supply-chain security
Security policies
Cybersecurity training
Cryptography and encryption
Human resources security
Asset management
Organizations therefore need a coordinated compliance program involving technology, processes, policies, employees, suppliers, and leadership.
What does NIS2 mean for IT teams?
For many IT teams, NIS2 reinforces the need to make existing cybersecurity practices more consistent, visible, and repeatable.
Important operational priorities include:
Maintaining visibility into devices, applications, vulnerabilities, and security status.
Keeping operating systems and applications patched through defined processes.
Controlling and regularly reviewing access to systems.
Applying strong authentication and appropriate access permissions.
Maintaining useful logs and activity records for investigations and audits.
Identifying security issues quickly and establishing repeatable remediation processes.
Automating security and maintenance workflows where appropriate.
Maintaining accurate hardware and software inventories.
Evaluating whether cybersecurity controls continue to function as intended.
Producing evidence that demonstrates how security controls are applied.
For organizations already following mature cybersecurity practices, NIS2 may reinforce many existing processes. The challenge is ensuring those processes operate consistently across the environment and can be demonstrated when needed.
NIS2 implementation across the European Union
NIS2 establishes a common cybersecurity framework across the European Union, but each member state implements the directive through its own national legislation.
As a result, organizations should review the specific requirements that apply in each country where they operate. These may include national rules relating to entity registration, cybersecurity risk management, incident reporting, supervisory authorities, and enforcement.
While implementation details vary by country, the underlying cybersecurity objectives of NIS2 remain broadly consistent across the EU.
How Splashtop approaches NIS2 compliance
Splashtop complies with applicable NIS2 requirements and has implemented more than 150 controls mapped to requirements applicable to cloud service providers. These controls help establish a structured approach to managing the cybersecurity responsibilities associated with providing cloud-based services.
Because NIS2 is implemented through national legislation, some obligations are country-specific. For example, Splashtop has registered with the Netherlands National Cyber Security Centre (NCSC-NL) in accordance with applicable Dutch requirements.
For organizations evaluating technology providers as part of their own NIS2 programs, a provider’s cybersecurity practices and regulatory posture can also factor into broader supplier and supply-chain risk assessments.
How Splashtop can support NIS2 cybersecurity requirements
Organizations can also use Splashtop capabilities to support several of the technical practices involved in maintaining a NIS2 compliance program.
1. Secure remote access and authentication
Remote access needs to be tightly controlled when employees, IT administrators, vendors, and support technicians can connect to business systems from different locations.
Splashtop provides security and administrative capabilities, including encrypted remote connections, multi-factor authentication, SSO/SAML integration, granular permissions, and centralized management.
These controls help organizations manage who can remotely access systems and apply stronger authentication to remote workflows.
2. Access control and least privilege
Users should receive the level of access required for their responsibilities without unnecessarily broad access to systems.
Splashtop enables administrators to centrally manage users, groups, computers, and permissions. Organizations can use these controls to determine which users can access specific systems and modify access as responsibilities change.
Centralizing these controls also makes it easier for IT teams to review remote access permissions and remove access when it is no longer required.
3. Logging and audit evidence
Understanding who accessed a system and when is important for security investigations and audit readiness.
Splashtop provides session and activity logging capabilities that can help organizations maintain records of remote access activity. Depending on the Splashtop solution and configuration, organizations can also use additional logging and SIEM capabilities to incorporate relevant activity into broader security-monitoring workflows.
These records provide another source of evidence when IT teams investigate security events, review access activity, or demonstrate how controls are operating.
4. Vulnerability and patch management with Splashtop AEM
Unpatched vulnerabilities can leave endpoints unnecessarily exposed. Splashtop AEM helps IT teams make vulnerability and patch management more continuous by providing centralized visibility and automation.
With Splashtop AEM, IT teams can:
Identify vulnerabilities affecting managed endpoints.
Use CVE insights to help prioritize remediation.
Patch supported operating systems and third-party applications.
Apply patching policies across groups of endpoints.
Monitor patch status and identify failures.
Maintain hardware and software inventory.
Use automation to reduce repetitive remediation work.
Instead of relying primarily on periodic manual reviews, IT teams can continuously monitor endpoint conditions and take action when vulnerabilities or missing updates are identified.
5. Endpoint monitoring and remediation
Maintaining cybersecurity controls also requires teams to recognize when endpoint conditions fall outside expected policies and respond appropriately.
Splashtop AEM provides centralized endpoint visibility, proactive alerts, policy-based management, scripts, tasks, and remediation capabilities. These tools can help IT teams identify issues and apply corrective actions across managed endpoints without addressing each device individually.
Automation can also make recurring security and maintenance processes more repeatable, helping reduce inconsistencies that develop when tasks depend heavily on manual intervention.
Build a more repeatable approach to NIS2 compliance
NIS2 increases the importance of cybersecurity controls that organizations can consistently apply, monitor, document, and improve. Secure access, strong authentication, vulnerability remediation, endpoint visibility, and reliable activity records can all contribute to that foundation.
Splashtop helps IT teams centralize secure remote access and support while extending visibility, patching, automation, and endpoint management through Splashtop AEM. Splashtop's own NIS2 compliance and NCSC-NL registration also provide customers with additional information to consider when evaluating the security posture of their technology providers.
Learn more about how Splashtop can help your organization strengthen secure access, endpoint management, and NIS2 readiness.
