{"id":103391,"date":"2026-08-31T08:55:28","date_gmt":"2026-08-31T07:55:28","guid":{"rendered":"https:\/\/www.ictrechtswijzer.be\/?p=103391"},"modified":"2026-08-31T09:03:15","modified_gmt":"2026-08-31T08:03:15","slug":"nis2-cybersecurity-in-government-organizations","status":"publish","type":"post","link":"https:\/\/www.ictrechtswijzer.be\/en\/nis2-cyberveiligheid-overheidsorganisaties\/","title":{"rendered":"Is your government agency legally prepared for a cyberattack?"},"content":{"rendered":"

When hackers breached the City of Antwerp\u2019s systems on the night of December 5\u20136, 2022, service counters, email systems, and even the medication registry of the Zorgbedrijf were down for weeks. Since then, the legal framework for cybersecurity at Belgian government organizations has been significantly tightened. Anyone who heads a local government, an agency, or another public organization today must ensure four things are in order: knowing whether the organization falls under the NIS2<\/a>-act, meet the basic security requirements that are also mandatory outside the scope of that law, have two parallel reporting schedules ready for the day of the incident, and ensure that contracts with IT vendors are watertight. In this article, we\u2019ll walk through those four steps.<\/p>\n\n\n\n

The threat is no longer just a theory<\/h3>\n\n\n\n

The figures and case studies speak for themselves. The attack on Antwerp was a ransomware attack carried out by the hacker collective Play, which, according to VRT News<\/a> stole more than 500 gigabytes of data and threatened to publish it on the dark web. The restoration of the last applications was completed by the end of January 2023. Also in December 2022, Diest and Zwijndrecht<\/a> were affected. Smaller local governments have not been spared either: in 2025 and 2026, Walloon municipalities and PCSWs, among others, appeared on ransomware groups\u2019 publication sites.<\/p>\n\n\n\n

The Belgian Cybersecurity Center (CCB) had already recorded 120 reports of ransomware or extortion following data theft at private and public organizations combined in 2023, according to its Guideline No. 1\/2024<\/a> to government agencies. The same guideline requires every government agency to enable two-factor authentication on all external connections and explicitly advises against ever paying a ransom.<\/p>\n\n\n\n

Meanwhile, legal action is also underway. In a report on the attack on Antwerp - which VRT NWS was able to review in June 2024<\/a> - the Flemish Supervisory Commission for the Processing of Personal Data concluded that the city\u2019s departments were insufficiently prepared: there was barely a recovery plan, important security updates had not been implemented, and two-factor authentication was largely absent. The report describes this as literally \u201cembarrassing\u201d for an organization of that size. A cyber incident is therefore not just an operational crisis; it is also the moment when a regulator scrutinizes the security measures in place prior to the incident.<\/p>\n\n\n\n

Does your organization fall under the NIS2 Act?<\/h3>\n\n\n\n

The first legal question concerns the scope of application of the Act of April 26, 2024<\/a> establishing a framework for the cybersecurity of network and information systems of public interest for public safety, known as the NIS2 Act. This Act implements the European NIS2 directive<\/a> It came into effect on October 18, 2024. In the public sector, it operates according to its own logic, which leads to surprising outcomes.<\/p>\n\n\n\n

Government Agencies of the Federal State and the Subregions<\/h4>\n\n\n\n

Government agencies under the jurisdiction of the Federal State are subject to the law regardless of their size (Art. 3, \u00a7 3 of the NIS2 Act), and they qualify as critical entities. The same applies to the emergency response zones and the Brussels-Capital Region Fire and Emergency Medical Services. Government agencies under the jurisdiction of the federated entities, such as Flemish agencies, are only subject to the law after formal identification by the national cybersecurity authority (Art. 11, \u00a7 2 of the NIS2 Act). Therefore, any organization that receives such an identification decision does not need to assess the size thresholds itself: the decision itself brings the organization within the scope of the law.<\/p>\n\n\n\n

Local governments: not automatic, but not secure either<\/h4>\n\n\n\n

Municipalities, provinces, public social welfare centers (PCSWs), and intermunicipal associations are not listed as such in the appendices to the law. The CCB takes the position that, in light of the local autonomy provided for in Article 162 of the Constitution, they do not \u201cdepend\u201d on the Federal State or the regions, and therefore do not automatically belong to the public sector. However, that is not the end of the story, and this is the most common error in judgment made in practice.<\/p>\n\n\n\n

A local government is subject to the NIS2 Act if it provides at least one service from another sector listed in the annexes to the Act\u2014such as drinking water distribution, waste management, or the operation of a public hospital\u2014and meets the size thresholds (50 full-time equivalents or 10 million euros in annual revenue or total assets). The fact that this service constitutes only a small part of the organization\u2019s operations is, in principle, irrelevant: a single service listed in the annexes is sufficient, and the organization as a whole is then subject to the Act for all of its network and information systems. In addition, the CCB may still individually designate any governing body as an essential or important entity (Art. 11, \u00a7 1 of the NIS2 Act).Anyone who has been identified was required to register on the Safeonweb@Work portal<\/a> by March 18, 2025, at the latest, and has been subject to all obligations since then: the risk management measures under Article 30, the reporting requirement, and oversight.<\/p>\n\n\n\n

Not falling under NIS2 is not an exemption<\/h3>\n\n\n\n

For boards that fall outside the scope of the NIS2 Act, there is a second, lesser-known set of obligations. The Flemish Government stipulated in its Flemish Digital Security Policy Strategy<\/a> that every Flemish government agency and every local government not covered by NIS2 must, by January 1, 2030, implement at least the \u201cbasic\u201d security level of the CCB\u2019s CyberFundamentals(CyFun) framework, or, alternatively, the ISO 27001 standard, by January 1, 2030. The Flemish Center for Digital Security<\/a>, established within Digital Flanders on May 1, 2025, will oversee this and set an initial reporting milestone for 2026. Digital hygiene will thus become a requirement for every Flemish government body, large or small.<\/p>\n\n\n\n

And then there's the layer that's always been there. The General Data Protection Regulation (GDPR)<\/a> requires every data controller\u2014including every board\u2014to implement appropriate technical and organizational security measures (Art. 32 of the GDPR). A board processes national registration numbers, PCSW files, and personnel data, and bears a duty of accountability in this regard that the Data Protection Authority (DPA) enforces strictly. Just how strictly was evident from the decision we previously analyzed in our article on the question whether a municipality is liable when a public official unlawfully accesses the National Registry<\/a>: Management remains ultimately responsible, even when an employee disregards strict instructions, as soon as the control systems fail.<\/p>\n\n\n\n

The day of the incident: two incident logs side by side<\/h3>\n\n\n\n

When things go wrong, two legal timelines run simultaneously, each with different deadlines, recipients, and content. If you don\u2019t monitor both tracks in parallel from the moment the issue is detected, you will inevitably miss a deadline.<\/p>\n\n\n\n

The first channel is the NIS2 notification, for organizations subject to the law. They must report every significant incident to the national CSIRT at the CCB in three phases (Art. 35 of the NIS2 Act): an early warning within 24 hours of becoming aware of the incident, an incident report with an initial assessment within 72 hours, and a final report no later than one month after that incident report. In addition, the governing body must immediately inform the recipients of its services\u2014in practice, citizens and partner organizations\u2014if the incident could adversely affect their service provision (Art. 34 of the NIS2 Act). The law explicitly states that the report itself does not result in increased liability, which is an argument for reporting incidents in a timely and complete manner.<\/p>\n\n\n\n

The second track is the data breach notification under the GDPR: as soon as the incident affects personal data and poses a risk to the data subjects, the notification must be submitted to the DPA within 72 hours (Art. 33 GDPR), and in the event of a high risk, the data subjects themselves must also be informed (Art. 34 GDPR). The CCB explicitly states that the NIS2 notification does not replace the GDPR notification. A single ransomware attack on a municipal server can therefore quickly result in three or four separate notifications within the first week. An administration that, following an incident, has doubts about the classification or content of those notifications would be well advised to seek assistance from a lawyer specializing in data protection<\/a>: today's report is part of the file for tomorrow's investigation.<\/p>\n\n\n\n

The board is responsible, not the IT department<\/h3>\n\n\n\n

The NIS2 Act explicitly places ultimate responsibility with top management. The governing body of an essential or important entity must approve the risk management measures, oversee their implementation, and is liable for any breaches of that obligation by the entity (Art. 31 of the NIS2 Act). Furthermore, members of the governing body must undergo training to be able to assess cyber risks. In addition, any natural person who represents the entity or exercises control over it is personally responsible for ensuring compliance with the Act (Art. 61 of the NIS2 Act). For a mayor, a general director, or the chairperson of an intermunicipal association, cybersecurity is therefore no longer a delegable IT issue, but a governance matter.<\/p>\n\n\n\n

The sanctions regime does, however, provide for some leniency in the public sector. Against a government agency as defined by law, the competent authorities may take basic measures, such as issuing warnings and binding orders to remedy deficiencies (Art. 58 of the NIS2 Act), but they may not impose administrative fines (Art. 62 of the NIS2 Act). These fines are, however, substantial: up to 7 million euros or 1.4 percent of global annual revenue for a significant entity, and up to 10 million euros or 2 percent for a critical entity (Art. 59 of the NIS2 Act). Please note the limits of this exception. An entity of an industrial or commercial nature falls outside the definition of a public authority and may therefore be fined; this applies to some intermunicipal associations and public enterprises. Furthermore, immunity from fines does not affect the liability of the governing body and executives, nor does it preclude claims for damages from citizens or contracting parties following a preventable incident.<\/p>\n\n\n\n

The weakest link is often the supplier<\/h3>\n\n\n\n

The risk management measures set forth in Article 30 of the NIS2 Act explicitly include supply chain security. A board must therefore not only secure its own systems but also manage the risks introduced by its IT suppliers, cloud partners, and software vendors. This is reflected in the specifications and the contract: security requirements and certifications as conditions for awarding the contract, audit rights, obligations to immediately report incidents at the supplier\u2019s site, agreements regarding backups and recovery times, and a clear division of liability when an incident occurs at the supplier\u2019s site. For a processor of personal data, the data processing agreement under Article 28 of the GDPR applies in addition to these requirements.<\/p>\n\n\n\n

For public authorities, all of this takes place within the constraints of public procurement law, where poorly written specifications can have a lasting impact for years. We previously analyzed how a contracting authority can avoid these pitfalls\u2014and why overreliance on a single supplier also poses a security risk\u2014in our article on Vendor lock-in in government IT procurement<\/a>. Cyber insurance can round out the picture, but it does not replace the investment in cybersecurity<\/a> : in the event of a claim, the insurer first verifies whether the basic measures were in place.<\/p>\n\n\n\n

Frequently asked questions (FAQ)<\/h3>\n\n\n\n

Does my municipality need to register under the NIS2 Act?<\/strong>
Only if it falls under the law. This is the case when the municipality or its privatized entity provides at least one service listed in the appendices to the law, such as drinking water, waste management, or a public hospital, and meets the size thresholds, or when the CCB has individually identified it as an essential or important entity. Registration takes place on the Safeonweb@Work portal; for most entities, the deadline passed on March 18, 2025, so anyone who has not yet registered should do so as soon as possible.<\/p>\n\n\n\n

Is a board of directors allowed to pay a ransom after a ransomware attack?<\/strong>
There is no explicit legal prohibition, but the CCB strongly advises against payment in its Guideline No. 1\/2024: paying perpetuates the criminals\u2019 revenue model and offers no guarantee whatsoever of recovery or the destruction of stolen data. In 2022, the city of Antwerp publicly refused to make any payments or engage in negotiations. Furthermore, any administration considering payment must realize that such a payment does not affect reporting obligations or liability issues.<\/p>\n\n\n\n

We are not subject to NIS2. Do we need to take any action?<\/strong>
Yes. For Flemish government agencies and local governments outside of NIS2, the Flemish digital security policy strategy applies: by January 1, 2030, at a minimum, the CyFun \u201cbasic\u201d security level or ISO 27001 must be implemented. In addition, the security and reporting obligations under the GDPR apply in full to every government body, regardless of its size.<\/p>\n\n\n\n

Conclusion<\/h3>\n\n\n\n

Under Belgian law, a government organization no longer has a choice as to whether or not to invest in cybersecurity; the law now only specifies the manner in which this obligation is imposed. Large and service-providing public authorities are subject to the NIS2 Act, which requires registration, risk management measures, a phased reporting obligation, and personal accountability on the part of the governing body. Those who fall outside this scope will still face the Flemish requirement to achieve the CyFun baseline level by January 1, 2030, and, in any case, the security obligations under the GDPR. The attack on Antwerp shows that the regulator will look back mercilessly at what was not properly addressed in advance. Legal preparations\u2014from defining the scope and the incident response plan to supplier contracts\u2014are therefore best done today, not on the morning of the incident.<\/p>\n\n\n\n

\n\n\n\n
\n
Would you like to know whether your board is subject to the NIS2 Act, have your reporting procedures and IT contracts reviewed, or is your organization dealing with a cyber incident? Contact our lawyers specializing in cybersecurity and data protection for an initial assessment of your case.<\/a><\/div>\n<\/div>\n\n\n\n

<\/p>\n\n\n\n

<\/p>","protected":false},"excerpt":{"rendered":"

Toen hackers in de nacht van 5 op 6 december 2022 de systemen van de stad Antwerpen binnendrongen, vielen loketten, mails en zelfs de medicatieregistratie van het Zorgbedrijf wekenlang uit. Sindsdien is het juridische kader voor de cyberveiligheid van Belgische overheidsorganisaties grondig verstrengd. Wie vandaag een lokaal bestuur, een agentschap of een andere publieke organisatie […]<\/p>\n","protected":false},"author":1,"featured_media":103392,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[104],"tags":[],"class_list":["post-103391","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyberbeveiliging"],"yoast_head":"\nCyberveiligheid en NIS2 voor overheden | ICT Rechtswijzer<\/title>\n<meta name=\"description\" content=\"Valt uw lokaal bestuur onder de NIS2-wet en wat moet u juridisch regelen tegen een cyberaanval? Van meldplicht tot bestuurdersaansprakelijkheid.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.ictrechtswijzer.be\/en\/nis2-cybersecurity-in-government-organizations\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Is uw overheidsorganisatie juridisch voorbereid op een cyberaanval?\" \/>\n<meta property=\"og:description\" content=\"Valt uw lokaal bestuur onder de NIS2-wet en wat moet u juridisch regelen tegen een cyberaanval? Van meldplicht tot bestuurdersaansprakelijkheid.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.ictrechtswijzer.be\/en\/nis2-cybersecurity-in-government-organizations\/\" \/>\n<meta property=\"og:site_name\" content=\"ICT Rechtswijzer Advocaat\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-31T07:55:28+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-31T08:03:15+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.ictrechtswijzer.be\/wp-content\/uploads\/2026\/08\/pexels-julio-lopez-75309646-34258667-scaled.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1707\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Joris Deene\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Joris Deene\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"11 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/nis2-cyberveiligheid-overheidsorganisaties\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/nis2-cyberveiligheid-overheidsorganisaties\\\/\"},\"author\":{\"name\":\"Joris Deene\",\"@id\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/#\\\/schema\\\/person\\\/29025dc007e8d33a89422580a534d685\"},\"headline\":\"Is uw overheidsorganisatie juridisch voorbereid op een cyberaanval?\",\"datePublished\":\"2026-08-31T07:55:28+00:00\",\"dateModified\":\"2026-08-31T08:03:15+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/nis2-cyberveiligheid-overheidsorganisaties\\\/\"},\"wordCount\":1998,\"publisher\":{\"@id\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/nis2-cyberveiligheid-overheidsorganisaties\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/pexels-julio-lopez-75309646-34258667-scaled.jpg\",\"articleSection\":[\"Cybersecurity\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/nis2-cyberveiligheid-overheidsorganisaties\\\/\",\"url\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/nis2-cyberveiligheid-overheidsorganisaties\\\/\",\"name\":\"Cyberveiligheid en NIS2 voor overheden | ICT Rechtswijzer\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/nis2-cyberveiligheid-overheidsorganisaties\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/nis2-cyberveiligheid-overheidsorganisaties\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/pexels-julio-lopez-75309646-34258667-scaled.jpg\",\"datePublished\":\"2026-08-31T07:55:28+00:00\",\"dateModified\":\"2026-08-31T08:03:15+00:00\",\"description\":\"Valt uw lokaal bestuur onder de NIS2-wet en wat moet u juridisch regelen tegen een cyberaanval? Van meldplicht tot bestuurdersaansprakelijkheid.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/nis2-cyberveiligheid-overheidsorganisaties\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.ictrechtswijzer.be\\\/nis2-cyberveiligheid-overheidsorganisaties\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/nis2-cyberveiligheid-overheidsorganisaties\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/pexels-julio-lopez-75309646-34258667-scaled.jpg\",\"contentUrl\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/pexels-julio-lopez-75309646-34258667-scaled.jpg\",\"width\":2560,\"height\":1707},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/nis2-cyberveiligheid-overheidsorganisaties\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Is uw overheidsorganisatie juridisch voorbereid op een cyberaanval?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/#website\",\"url\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/\",\"name\":\"ICT Rechtswijzer Advocaat\",\"description\":\"Advocaten in IP, AI, IT, privacy & media\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Organization\",\"LegalService\"],\"@id\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/#organization\",\"name\":\"ICT Rechtswijzer\",\"alternateName\":\"ICT Rechtswijzer, kennisplatform van Everest Advocaten\",\"url\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/wp-content\\\/uploads\\\/2018\\\/08\\\/joris-deene-auteursrecht-in-een-digitale-omgeving-1-638.jpg\",\"contentUrl\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/wp-content\\\/uploads\\\/2018\\\/08\\\/joris-deene-auteursrecht-in-een-digitale-omgeving-1-638.jpg\",\"width\":638,\"height\":479,\"caption\":\"ICT Rechtswijzer\"},\"image\":{\"@id\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/be.linkedin.com\\\/company\\\/everest-law\",\"https:\\\/\\\/www.everest-law.eu\\\/\"],\"description\":\"Kennisplatform van het departement intellectuele eigendom, IT-recht, AI-recht, gegevensbescherming en mediarecht van Everest Advocaten, onder leiding van mr. Joris Deene.\",\"parentOrganization\":{\"@type\":\"LegalService\",\"name\":\"Everest Advocaten\",\"url\":\"https:\\\/\\\/www.everest-law.eu\",\"address\":{\"@type\":\"PostalAddress\",\"streetAddress\":\"Bollebergen 2A bus 20\",\"postalCode\":\"9052\",\"addressLocality\":\"Gent\",\"addressCountry\":\"BE\"}}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/#\\\/schema\\\/person\\\/29025dc007e8d33a89422580a534d685\",\"name\":\"Joris Deene\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/7073c8d7ef4db19fbc2d462ac2571a2b0a3e5c89329cba99b4d3caf0bcd7cfc1?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/7073c8d7ef4db19fbc2d462ac2571a2b0a3e5c89329cba99b4d3caf0bcd7cfc1?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/7073c8d7ef4db19fbc2d462ac2571a2b0a3e5c89329cba99b4d3caf0bcd7cfc1?s=96&d=mm&r=g\",\"caption\":\"Joris Deene\"},\"description\":\"Mr. Joris Deene is advocaat-partner bij Everest Advocaten en leidt het departement intellectuele eigendom, IT-recht, AI-recht, gegevensbescherming en mediarecht. ICT Rechtswijzer is het kennisplatform van dat departement. Joris publiceert en doceert over auteursrecht, merkenrecht, softwarerecht, de AVG, de AI-Act, de DSA en het mediarecht.\",\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/joris-deene-5144096\\\/\"],\"honorificPrefix\":\"Mr.\",\"knowsAbout\":[\"intellectuele eigendom\",\"auteursrecht\",\"merkenrecht\",\"IT-recht\",\"AI-recht\",\"gegevensbescherming\",\"AVG\",\"mediarecht\",\"digitaledienstenverordening\",\"AI-verordening\"],\"knowsLanguage\":[\"Nederlands\",\"Engels\",\"Frans\"],\"jobTitle\":\"Advocaat-partner, hoofd departement intellectuele eigendom, IT-recht, AI-recht, gegevensbescherming en mediarecht\",\"worksFor\":\"Everest Advocaten\",\"url\":\"https:\\\/\\\/www.ictrechtswijzer.be\\\/en\\\/author\\\/joris-deene\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Cybersecurity and NIS2 for Government Agencies | ICT Legal Guide","description":"Does your local government fall under the NIS2 Act, and what legal measures do you need to take to protect against a cyberattack? From reporting requirements to directors\u2019 liability.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.ictrechtswijzer.be\/en\/nis2-cybersecurity-in-government-organizations\/","og_locale":"en_US","og_type":"article","og_title":"Is uw overheidsorganisatie juridisch voorbereid op een cyberaanval?","og_description":"Valt uw lokaal bestuur onder de NIS2-wet en wat moet u juridisch regelen tegen een cyberaanval? Van meldplicht tot bestuurdersaansprakelijkheid.","og_url":"https:\/\/www.ictrechtswijzer.be\/en\/nis2-cybersecurity-in-government-organizations\/","og_site_name":"ICT Rechtswijzer Advocaat","article_published_time":"2026-08-31T07:55:28+00:00","article_modified_time":"2026-08-31T08:03:15+00:00","og_image":[{"width":2560,"height":1707,"url":"https:\/\/www.ictrechtswijzer.be\/wp-content\/uploads\/2026\/08\/pexels-julio-lopez-75309646-34258667-scaled.jpg","type":"image\/jpeg"}],"author":"Joris Deene","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Joris Deene","Est. reading time":"11 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.ictrechtswijzer.be\/nis2-cyberveiligheid-overheidsorganisaties\/#article","isPartOf":{"@id":"https:\/\/www.ictrechtswijzer.be\/nis2-cyberveiligheid-overheidsorganisaties\/"},"author":{"name":"Joris Deene","@id":"https:\/\/www.ictrechtswijzer.be\/#\/schema\/person\/29025dc007e8d33a89422580a534d685"},"headline":"Is uw overheidsorganisatie juridisch voorbereid op een cyberaanval?","datePublished":"2026-08-31T07:55:28+00:00","dateModified":"2026-08-31T08:03:15+00:00","mainEntityOfPage":{"@id":"https:\/\/www.ictrechtswijzer.be\/nis2-cyberveiligheid-overheidsorganisaties\/"},"wordCount":1998,"publisher":{"@id":"https:\/\/www.ictrechtswijzer.be\/#organization"},"image":{"@id":"https:\/\/www.ictrechtswijzer.be\/nis2-cyberveiligheid-overheidsorganisaties\/#primaryimage"},"thumbnailUrl":"https:\/\/www.ictrechtswijzer.be\/wp-content\/uploads\/2026\/08\/pexels-julio-lopez-75309646-34258667-scaled.jpg","articleSection":["Cybersecurity"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.ictrechtswijzer.be\/nis2-cyberveiligheid-overheidsorganisaties\/","url":"https:\/\/www.ictrechtswijzer.be\/nis2-cyberveiligheid-overheidsorganisaties\/","name":"Cybersecurity and NIS2 for Government Agencies | ICT Legal Guide","isPartOf":{"@id":"https:\/\/www.ictrechtswijzer.be\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.ictrechtswijzer.be\/nis2-cyberveiligheid-overheidsorganisaties\/#primaryimage"},"image":{"@id":"https:\/\/www.ictrechtswijzer.be\/nis2-cyberveiligheid-overheidsorganisaties\/#primaryimage"},"thumbnailUrl":"https:\/\/www.ictrechtswijzer.be\/wp-content\/uploads\/2026\/08\/pexels-julio-lopez-75309646-34258667-scaled.jpg","datePublished":"2026-08-31T07:55:28+00:00","dateModified":"2026-08-31T08:03:15+00:00","description":"Does your local government fall under the NIS2 Act, and what legal measures do you need to take to protect against a cyberattack? From reporting requirements to directors\u2019 liability.","breadcrumb":{"@id":"https:\/\/www.ictrechtswijzer.be\/nis2-cyberveiligheid-overheidsorganisaties\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.ictrechtswijzer.be\/nis2-cyberveiligheid-overheidsorganisaties\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.ictrechtswijzer.be\/nis2-cyberveiligheid-overheidsorganisaties\/#primaryimage","url":"https:\/\/www.ictrechtswijzer.be\/wp-content\/uploads\/2026\/08\/pexels-julio-lopez-75309646-34258667-scaled.jpg","contentUrl":"https:\/\/www.ictrechtswijzer.be\/wp-content\/uploads\/2026\/08\/pexels-julio-lopez-75309646-34258667-scaled.jpg","width":2560,"height":1707},{"@type":"BreadcrumbList","@id":"https:\/\/www.ictrechtswijzer.be\/nis2-cyberveiligheid-overheidsorganisaties\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.ictrechtswijzer.be\/"},{"@type":"ListItem","position":2,"name":"Is uw overheidsorganisatie juridisch voorbereid op een cyberaanval?"}]},{"@type":"WebSite","@id":"https:\/\/www.ictrechtswijzer.be\/#website","url":"https:\/\/www.ictrechtswijzer.be\/","name":"ICT Lawyer","description":"Lawyers in IP, AI, IT, privacy & media","publisher":{"@id":"https:\/\/www.ictrechtswijzer.be\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.ictrechtswijzer.be\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Organization","LegalService"],"@id":"https:\/\/www.ictrechtswijzer.be\/#organization","name":"ICT Legal Guide","alternateName":"ICT Rechtswijzer, kennisplatform van Everest Advocaten","url":"https:\/\/www.ictrechtswijzer.be\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.ictrechtswijzer.be\/#\/schema\/logo\/image\/","url":"https:\/\/www.ictrechtswijzer.be\/wp-content\/uploads\/2018\/08\/joris-deene-auteursrecht-in-een-digitale-omgeving-1-638.jpg","contentUrl":"https:\/\/www.ictrechtswijzer.be\/wp-content\/uploads\/2018\/08\/joris-deene-auteursrecht-in-een-digitale-omgeving-1-638.jpg","width":638,"height":479,"caption":"ICT Rechtswijzer"},"image":{"@id":"https:\/\/www.ictrechtswijzer.be\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/be.linkedin.com\/company\/everest-law","https:\/\/www.everest-law.eu\/"],"description":"Knowledge platform of the Intellectual Property, IT Law, AI Law, Data Protection, and Media Law department at Everest Advocaten, led by Joris Deene, Esq.","parentOrganization":{"@type":"LegalService","name":"Everest Advocaten","url":"https:\/\/www.everest-law.eu","address":{"@type":"PostalAddress","streetAddress":"Bollebergen 2A bus 20","postalCode":"9052","addressLocality":"Gent","addressCountry":"BE"}}},{"@type":"Person","@id":"https:\/\/www.ictrechtswijzer.be\/#\/schema\/person\/29025dc007e8d33a89422580a534d685","name":"Joris Deene","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/7073c8d7ef4db19fbc2d462ac2571a2b0a3e5c89329cba99b4d3caf0bcd7cfc1?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/7073c8d7ef4db19fbc2d462ac2571a2b0a3e5c89329cba99b4d3caf0bcd7cfc1?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/7073c8d7ef4db19fbc2d462ac2571a2b0a3e5c89329cba99b4d3caf0bcd7cfc1?s=96&d=mm&r=g","caption":"Joris Deene"},"description":"Mr. Joris Deene is a partner at Everest Attorneys and heads the department of intellectual property, IT law, AI law, data protection, and media law. ICT Legal Guide is that department\u2019s knowledge platform. Joris publishes and teaches on copyright law, trademark law, software law, the GDPR, the AI Act, the DSA, and media law.","sameAs":["https:\/\/www.linkedin.com\/in\/joris-deene-5144096\/"],"honorificPrefix":"Mr.","knowsAbout":["intellectuele eigendom","auteursrecht","merkenrecht","IT-recht","AI-recht","gegevensbescherming","AVG","mediarecht","digitaledienstenverordening","AI-verordening"],"knowsLanguage":["Nederlands","Engels","Frans"],"jobTitle":"Advocaat-partner, hoofd departement intellectuele eigendom, IT-recht, AI-recht, gegevensbescherming en mediarecht","worksFor":"Everest Advocaten","url":"https:\/\/www.ictrechtswijzer.be\/en\/author\/joris-deene\/"}]}},"_links":{"self":[{"href":"https:\/\/www.ictrechtswijzer.be\/en\/wp-json\/wp\/v2\/posts\/103391","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ictrechtswijzer.be\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ictrechtswijzer.be\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ictrechtswijzer.be\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ictrechtswijzer.be\/en\/wp-json\/wp\/v2\/comments?post=103391"}],"version-history":[{"count":4,"href":"https:\/\/www.ictrechtswijzer.be\/en\/wp-json\/wp\/v2\/posts\/103391\/revisions"}],"predecessor-version":[{"id":103398,"href":"https:\/\/www.ictrechtswijzer.be\/en\/wp-json\/wp\/v2\/posts\/103391\/revisions\/103398"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ictrechtswijzer.be\/en\/wp-json\/wp\/v2\/media\/103392"}],"wp:attachment":[{"href":"https:\/\/www.ictrechtswijzer.be\/en\/wp-json\/wp\/v2\/media?parent=103391"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ictrechtswijzer.be\/en\/wp-json\/wp\/v2\/categories?post=103391"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ictrechtswijzer.be\/en\/wp-json\/wp\/v2\/tags?post=103391"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}