NIS2 principles in practice
We apply NIS2 principles through concrete security measures in anonimize. Reduce sensitive information in documents and control access, processing and export. The platform helps your organisation reduce risk.
The Belgian context
NIS2 concerns the security of network and information systems. Whether Belgian law applies to your organisation depends on factors including sector, activity, size and establishment, taking account of group relationships, exceptions and designations. Registration may also be required. Check the criteria with Belgium’s CCB.
Customers may also set security requirements for suppliers that fall outside the legal scope. Anonimize supports a defined part of this approach: secure document processing and controlled sharing.
Our own approach
We substantiate our approach with existing features and controls. Below, we explain what the platform does and what your organisation must arrange. MFA, retention periods, export approval and your own vault key require configuration or activation.
Protecting information
Verification and maintenance
From requirement to practice
Article 21 of the NIS2 Directive sets out ten areas of risk management. Belgium’s implementation also requires a coordinated vulnerability disclosure policy. A document platform provides specific measures; the organisation manages the whole. Read Article 21.
Policies to identify and manage risks to systems and information.
Detect, assess and handle incidents.
Arrange backups, disaster recovery and crisis management.
Assess risks involving direct suppliers and service providers.
Secure acquisition, development and maintenance, including vulnerability handling and disclosure.
Check whether security measures work in practice.
Good security habits and appropriate staff training.
Appropriate policies for cryptography and the use of encryption.
Align access with roles and manage information and systems.
Use multifactor authentication and secure communication where appropriate.
When something goes wrong
For significant incidents subject to notification in Belgium, the following sequence generally applies, without undue delay. The initial deadlines run from awareness of the incident; the month runs from the incident notification.
An initial warning to the competent authority.
An initial assessment of severity, impact and available indicators.
Due within one month after the incident notification; an ongoing incident first requires a progress report.
Trust service providers must also submit the incident notification within 24 hours. Your organisation determines whether an incident must be reported and arranges notification; anonimize does not submit it automatically. Consult the Belgian CCB guidance.
Good to know
NIS2 compliance covers your whole organisation: management, people, processes, systems and suppliers. Anonimize provides demonstrable technical measures for document processing. Your organisation must configure them appropriately and include them in its broader security policy.
We link existing safeguards to specific NIS2 themes, including access control, encryption and traceability. A full assessment also requires evidence about scope, governance, procedures and operation in practice. This page substantiates our technical approach; full legal NIS2 compliance has not been established by this explanation.
Removing unnecessary identifying data before sharing a document or using an AI tool reduces exposure if unintended access occurs. This supports risk management. Re-identifiable pseudonyms remain personal data; detections and context still need review. Read GDPR Article 4(5) and Recital 26.
Enable two-step verification, set suitable project permissions and retention periods, and choose export approval and your own vault key where needed. Without configured retention periods, results and reversal keys are not automatically deleted. Pseudonyms and context still need human review.
This explanation connects the requirements to our document features. Read more about processing and practical limits on our security page.
Assess it together
Share your intended document process or supplier assessment questions. We can discuss which measures fit.