BelgiumLoi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance
Loi du 26 avril 2024 établissant un cadre pour la cybersécurité des réseaux et des systèmes d'information d'intérêt général pour la… sécurité publique, Artt. 30-33
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://www.ejustice.just.fgov.be/eli/loi/2024/04/26/2024202344/justelIn force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- This binds an essential entity or an important entity drawn from Annex I or Annex II; Annex II's digital-provider entry names an online marketplace, an online search engine and a social-networking-services platform, and Annex I's digital-infrastructure entry separately names a DNS service provider, a top-level-domain name registry, a cloud-computing-service provider, a data-centre-service provider, a content-delivery-network provider, a managed service provider and a managed security service provider, so a service in any of those lines is reached at the medium-enterprise size threshold or above; the wider sector classes (energy, transport, banking, health, drinking water, public administration and the rest of the Annexes) are reached too, by declaring that you are an essential or important entity.
- Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems you use in the course of your activities or to provide your services.NIST CSF 2.0ID.RA-06
- Cover at minimum: policies on risk analysis and information-system security; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including the direct suppliers and service providers you rely on; security in the acquisition, development and maintenance of your network and information systems, including vulnerability handling and disclosure; policies to assess the effectiveness of your risk-management measures; basic cyber-hygiene practices and cybersecurity training; policies on the use of cryptography and, where applicable, encryption; personnel security, access-control policies and asset management; multi-factor or continuous authentication and secure voice, video, text and emergency communications where needed; and your own coordinated vulnerability-disclosure policy.NIST CSF 2.0GV.PO-01
- Have your management body approve these risk-management measures, supervise their implementation, and answer for a violation of this duty; you remain responsible for your own risk analysis and for the choice and implementation of the measures.NIST CSF 2.0GV.RR-01
These lines are LexLint's reading of the law's text. Also read by: Centre for Cybersecurity Belgium (CCB), Safeonweb at Work (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Title 4, Chapter 2 of the NIS2 law ("Les mesures et amendes administratives") is the Act's own sanction for a violation of Article 30: an administrative fine under Article 59, doubled on recidivism for the same facts within three years. The Act creates no criminal offence for an Article 30 violation.
Penalty structure
Article 59, 5 sets the ceiling for an essential entity that does not comply with the Article 30 risk-management or Article 34-38 notification obligations at EUR 10,000,000 or 2 percent of the undertaking's total worldwide annual turnover for the preceding financial year, whichever is higher; Article 59, 4 sets the ceiling for an important entity at EUR 7,000,000 or 1.4 percent of that turnover, whichever is higher; both fines start at a floor of EUR 500 and are doubled on recidivism for the same facts within three years (Article 59, final paragraph).
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The national cybersecurity authority, the Centre for Cybersecurity Belgium (CCB), or the competent sectoral authority for the entity's sector; the Belgian Institute for Postal Services and Telecommunications (BIPT) holds a parallel instruction and supervisory power specifically over a digital-infrastructure provider.
Settledness
- As of
- Guidance link
- https://atwork.safeonweb.be/nis2
- Guidance body
- Centre for Cybersecurity Belgium (CCB), Safeonweb at Work
- Open questions
- Does the reference-framework Royal Decree of (conformity-evaluation frameworks such as CyberFundamentals) or a sector-specific Royal Decree under Article 33 create a duty going beyond what Article 30 itself already states for a given sector or subsector?
What this law does
Article 30 requires an essential entity or an important entity to take appropriate and proportionate technical, operational and organisational measures to manage the risks threatening the security of the network and information systems it uses for its activities or to provide its services, on an all-hazards approach covering at minimum eleven points: risk-analysis and information-system-security policy, incident handling, business continuity (backup management, disaster recovery and crisis management), supply-chain security, security in the acquisition, development and maintenance of network and information systems including vulnerability handling and disclosure, policies to assess the effectiveness of the risk-management measures, basic cyber-hygiene practices and training, cryptography and encryption policy, human-resources security and access-control and asset management, multi-factor or continuous authentication and secure voice, video, text and emergency communications, and the entity's own coordinated vulnerability-disclosure policy.
Article 31 requires the management body of an essential or important entity to approve the cybersecurity risk-management measures it takes to comply with Article 30, supervise their implementation, and answer for that entity's violation of Article 30, without prejudice to the liability rules that otherwise apply to a public institution. Article 32 makes the entity itself responsible for the risk analysis it performs and for the choice and implementation of the Article 30 measures.
Article 33 lets the King, after consulting the national cybersecurity authority, any sectoral authority concerned and the federated entities concerned, impose additional appropriate and proportionate sector- or subsector-specific risk-management measures by decree deliberated in the Council of Ministers. This Act's own Article 97 repeals the predecessor Loi du 7 avril 2019, the original NIS Directive transposition, effective the same date.
Article 6(3) disapplies Titles 3 to 5, which hold these measures, to an entity of the banking or financial-market-infrastructure sector in Annex I that falls within the scope of Regulation (EU) 2022/2554 (DORA).
When LexLint raises it
When your app profile says your app handles health records, runs an essential service or operates a social platform.
Back to the example · Lint your app
Page updated .