Example: a NIS2 status note for the board
The note QoBot writes when a mid-sized company must report on NIS2 to its board: the position, the status of each measure, what is verified and what is only declared, and the decisions the board is asked to take. The company is fictional; the format is the one QoBot uses.
What you’re looking at
Halvorsen Components is a fictional manufacturer of hydraulic parts in Eindhoven, the Netherlands: 420 people, two plants, an IT team of five. Its supervisory board asked for a NIS2 status before its December meeting. Pieter, the IT manager, worked through QoBot’s questions over two weeks; Marieke, the CFO, presents the note.
The note fits on one page. Each statement points to a fact in QoBot’s workspace; what IT reports and what has been checked are kept apart, because the board approves on that basis.
The note
Cybersecurity and NIS2: status for the board
For the supervisory board and the management board · Presented by Marieke de Vries, CFO · Meeting 9 December 2026 · Status as of 20 October 2026
In short
Halvorsen is likely an important entity under NIS2. Four of the ten measures are in place and verified; the largest gap is the recovery of the plants’ production systems after an attack, which today would stop deliveries for one to two weeks, by IT’s estimate. We ask the board to approve the roadmap, the training of the management board, a budget, and a quarterly review.
Our NIS2 position
Manufacturer of machinery parts (Annex II), more than 250 people: likely an important entity, a hypothesis to confirm with counsel. The directive asks the management body to approve the security measures, oversee them and follow training (article 20). The Netherlands applies NIS2 through its own law: registration, deadlines, who counts as the management body and liability are to be confirmed with counsel.
Status by measure (article 21(2))
| Measure | Status | Basis | |
|---|---|---|---|
| a | Risk analysis and security policies | In place | Verified: policy approved in June |
| b | Incident handling | Partial | Plan written, never tested |
| c | Business continuity, backups, crisis management | Partial | Office backups restored in September; production systems not covered |
| d | Supply chain security | Not started | 14 critical suppliers identified, none assessed |
| e | Secure acquisition, maintenance, vulnerabilities | Declared | Reported by IT, not yet checked |
| f | Assessing effectiveness | Not started | |
| g | Basic hygiene and training | In place | Verified: training records, 92% of staff |
| h | Cryptography and encryption | In place | Verified: laptop encryption report |
| i | HR security, access control, assets | Declared | Account review reported by IT, to check |
| j | Multi-factor authentication, secure communications | In place | Verified: sign-in report, all staff |
Since the last report
One phishing incident in August: one mailbox taken over, contained within two hours, no data sent out. The notification assessment was done and recorded.
Decisions for the board
| # | Decision | Basis | Cost (estimate) | Owner | By |
|---|---|---|---|---|---|
| 1 | Approve the measures and the next steps below | Art. 20(1) | Covered by decision 3 | Marieke | 9 Dec |
| 2 | Cybersecurity training for the management board, format to choose | Art. 20(2) | Quote requested | Marieke | Q1 2027 |
| 3 | 24/7 monitoring of 350 devices by a provider, and an offline backup of the production systems | Measures b, c | €2,800–8,750 a month, plus €15,000–40,000 one-off; 2 quotes requested | Pieter | 31 Jan |
| 4 | A one-page status each quarter, any significant incident reported at once | Art. 20(1) | None | Pieter | From Q1 |
Next steps
- Pieter (IT manager): test the restore of one production line’s systems · by 30 Nov.
- Sanne (procurement): send the security questionnaire to the 14 critical suppliers · drafted · by 15 Dec.
- Pieter: evidence for measures e and i (patch report, account review) · by 15 Nov.
- Marieke: confirm the Dutch obligations and the registration with counsel · by 30 Nov.
Example of a deliverable: fictional company. Written in QoBot's board report format · qobot.io
What happens next
After the meeting, QoBot asks Marieke what the board decided and records each decision with its date. A recorded approval is evidence: the next customer questionnaire asking “Is security approved by management?” reuses it, and the next quarterly note starts from these four decisions.
FAQ
Is this a real company?
No. Halvorsen Components, its people and its figures are invented. The structure follows the rules QoBot uses for a board report: bottom line first, verified and declared kept apart, four decisions at most.
Why does the note say "to confirm with counsel" about Dutch law?
Each EU country applies NIS2 through its own law. QoBot's verified knowledge covers the directive and France; for another country it lists the national points to check instead of guessing them.
Does a note like this make the company compliant?
No. It tells the board where the company stands and what it is asked to decide. The measures still have to be carried out, and an auditor or the authority assesses them.
Sources
- Directive (EU) 2022/2555 (NIS2), articles 20 and 21EUR-Lex · management approves and oversees the measures, follows training (art. 20); the ten measures (art. 21(2))Official text
- Directive (EU) 2022/2555 (NIS2), article 3 and Annex IIEUR-Lex · essential and important entities; manufacturing of machinery and equipmentOfficial text
This page explains the rules in plain words. It isn't legal advice: for a borderline case, ask a lawyer. Report an error