NIS2 is now law.And it reaches more organisations than you think.
The Dutch NIS2 act applies from 15 August 2026 — and through the supply chain duty of care it also reaches the suppliers of the designated organisations. Universal makes you not just secure, but provably secure.
What the law requires of you
The Dutch Cyberbeveiligingswet — the national implementation of the European NIS2 directive — imposes a concrete duty of care on organisations across 18 designated sectors. And through supply chain requirements, the law reaches their suppliers too: the wider SME market.
Risk management
An up-to-date risk analysis and appropriate measures for your network and information systems.
Incident handling
Detect and handle incidents — and report them to the regulator within 24 hours.
Business continuity
Backup, recovery and crisis management that demonstrably work.
Supply chain security
Visibility into your suppliers' security — and they into yours.
Basic hygiene and training
From multi-factor authentication to awareness among staff and management.
Board accountability
The board is personally responsible for overseeing the measures — and liable in case of negligence.
Does this apply to me?
Do you supply to healthcare, industry, logistics, energy or government? Even if the law does not apply to you directly, your clients will start asking for proof. Whoever has the answer ready wins the trust — and the contract.
Paper compliance or real proof?
Many solutions cover the duty of care with questionnaires and documents. But when the regulator — or your biggest client — calls, you want to show more than policy. Universal connects your security directly to your evidence: incident handling, configuration status and security score automatically come together in an up-to-date audit file. From your own environment, always current.
Provably Secure — one bundle, one partner
The bundle combines two services that reinforce each other: security that tackles threats 24/7, and compliance that makes the result provable — managed by a single partner.
The secure part
Security as a Service
We protect and monitor your Microsoft environment continuously — with two fixed elements:
- uDefend — security incidents and recommendations are sent to you automatically. You handle the follow-up yourself, or have Universal carry it out under your support contract.
- A quarterly security briefing: an in-depth report with your secure status and concrete recommendations.
The provable part
uComply
Your duty of care, policies and evidence in one platform. Turns your security into an up-to-date audit file.
More about uComplyFrom €299 per month
Security as a Service with uDefend plus uComply, at a bundle discount versus the separate services. The price scales with the uComply tier that fits your organisation.
Already had an assessment done?
An assessment or baseline measurement is a good start — but a report starts ageing from day one. Universal turns your roadmap into a continuously demonstrable practice.
See Security as a ServiceFrequently asked questions
The law takes effect on 15 August 2026, without a transition period. From that date, the duty of care and the reporting obligation apply.
The law designates 18 sectors. But suppliers to those organisations also face requirements through the supply chain duty of care. In doubt? The free quickscan gives you clarity.
ISO 27001 is a strong foundation and largely overlaps with the duty of care. Universal is ISO 27001 certified itself and helps you cover both with a single approach.
Excellent — then the real question is whether you can prove it. We connect your existing environment to continuous evidence, without rebuilding everything from scratch.