Most federal entities are unlikely to meet the 18 April deadline for complying with the NIS2 law on cybersecurity, as many remain insufficiently prepared, according to Belgium’s Court of Audit.
The law, which stems from the European directive of the same name, introduces strict cybersecurity checks as well as incident reporting and response requirements for organisations operating in critical sectors such as postal services, energy, transport, healthcare and ICT.
However, the Court of Audit says federal bodies covered by the rules still have a long way to go.
Its audit examined agencies such as the Belgian Institute for Postal Services and Telecommunications, the National Institute for Health and Disability Insurance, and the National Social Security Office.
To help prepare these bodies across the board, the government adopted a federal cybersecurity strategy in May 2024. The plan is led by the Policy and Support department, and also involves the Belgium Centre for Cybersecurity, which oversees the certification of the various bodies.
The Court of Audit says urgent action is needed. While most federal entities have introduced basic controls, these still fall well short of what NIS2 requires, it notes.
It warns that substantial human and financial resources will be needed to accelerate preparations.
The auditors say not all federal entities have a formal roadmap or the technological and human resources needed to achieve compliance within the deadline.
Although the government has allocated additional budget support, they say the lack of clarity over multiannual funding and, to some extent, the shortage of staff dedicated to cybersecurity within the federal administration are holding back medium-term commitments.
