The NIS2 Entity Register is a mandatory national register in which organizations covered by the European NIS2 directive must enrol. This directive aims to strengthen the digital resilience of critical sectors across the EU. By registering, public authorities gain insight into vital infrastructures and can respond more effectively to cyber threats.
Who must register?
Registration is required for so-called essential and important entities. These are organizations with a key role in society or the economy, such as energy providers, hospitals, transport networks, cloud providers, and digital infrastructure operators.
Classification depends on sector, size, and societal impact. As a rule of thumb, organizations with more than 250 employees or over €50 million in annual revenue may fall under this obligation.
What information is submitted?
Entities must submit data via the Dutch NCSC portal, including:
- Company name and address
- Contact details for incident reporting
- Technical data such as IP ranges
- Sector and cross-border service presence
This information allows the government to issue targeted alerts, track cyber risks, and coordinate incident response through the CSIRT.
When and why?
While the Cybersecurity Act (Dutch implementation of NIS2) is expected to take effect in late 2025, voluntary registration has been possible since 17 October 2024. Early registration offers benefits such as:
- Early access to cyber threat intelligence
- Automated alerts on vulnerabilities
- Priority support in case of incidents
RiskStudio and the NIS2 Register
For NIS2 entities, registration is just the start. RiskStudio helps organizations operationalize digital resilience—internally and across the supply chain. You can group suppliers by risk or sector, assign internal stakeholders, and receive alerts for vulnerabilities or incidents.
RiskStudio shows which of your suppliers fall under NIS2 and helps prioritize the actions you need to take. This way, you’re not only compliant but in control.
