Cybersecurity Strategy 2.0 (2021-2025)

Strategic framework aiming to position Belgium among the least vulnerable EU countries. Overseen by Belgian Centre for Cybersecurity (BCC) with focus on NIS2 compliance in telecoms, healthcare, and energy sectors. Introduces mandatory vulnerability disclosure policies and enhanced supply chain security measures.

Analysis

Key Requirements

Belgium's Cybersecurity Strategy 2.0 (2021-2025) outlines several key requirements:

• Strengthen the digital environment and increase trust by focusing on secure network infrastructure and establishing a 'Cyber Green House' for testing innovative cyber solutions Source: [CCB Strategy 2.0 Document]

• Protect Operators of Vital Importance (OVIs) against cyber threats through an 'Early Warning System' and regular cybersecurity exercises Source: [CCB Organization Page]

• Implement a national cybersecurity certification framework for ICT products, services, and processes, in line with the EU Cybersecurity Act Source: [Belgian Official Journal]

• Enhance public, private, and academic collaboration in cybersecurity initiatives, with support for the Cyber Security Coalition Source: [Cyber Security Coalition]

• Establish clear international cooperation in cybersecurity, supporting EU and NATO initiatives Source: [CCB International Cooperation]

Compliance Challenges

Organizations face several challenges in complying with the Cybersecurity Strategy 2.0:

• Shortage of skilled cybersecurity professionals to implement and maintain required security measures Source: [ENISA Threat Landscape 2022]

• Complexity of supply chain security requirements, especially for smaller organizations Source: [EU Agency for Cybersecurity Supply Chain Attacks Report]

• Keeping pace with evolving cyber threats and adapting security measures accordingly Source: [Belgian Cyber Security Coalition Cyber Threats Overview]

• Balancing security requirements with operational efficiency and digital innovation Source: [Deloitte Belgium Cybersecurity Report]

Implementation Best Practices

To effectively implement the Cybersecurity Strategy 2.0 requirements:

• Conduct regular risk assessments and vulnerability scans using tools like Nessus or OpenVAS

• Implement a comprehensive incident response plan, following guidelines from the NIST Cybersecurity Framework

• Establish a security awareness training program for all employees, utilizing resources from the CCB Safeonweb initiative

• Adopt a zero-trust security model to enhance protection of critical assets and data Source: [ENISA Zero Trust Architecture]

• Participate in information sharing initiatives like the Belgian Cyber Security Coalition to stay informed about emerging threats and best practices

Recent Updates

Recent developments in Belgium's cybersecurity landscape include:

• Adoption of the NIS2 Law by the Belgian Federal Parliament on April 18, 2024, to be effective from October 18, 2024 Source: [CCB NIS2 Announcement]

• Establishment of the National Cybersecurity Certification Authority (NCCA) by Royal Decree on October 16, 2022 Source: [Belgian Official Journal]

• Updated guidelines for critical infrastructure protection released by the CCB in January 2024 Source: [CCB Critical Infrastructure Guidelines]

Related Regulations

Belgium's Cybersecurity Strategy 2.0 aligns with and is influenced by several EU regulations:

• NIS2 Directive: Enhances cybersecurity requirements for essential and important entities Source: [EU NIS2 Directive]

• EU Cybersecurity Act: Establishes a cybersecurity certification framework for ICT products and services Source: [ENISA Cybersecurity Act]

• GDPR: Overlaps with cybersecurity requirements for personal data protection Source: [Belgian Data Protection Authority]

Industry Impact

The Cybersecurity Strategy 2.0 has significant impacts across various industries:

• Telecommunications: Increased focus on network resilience and security of 5G infrastructure Source: [BIPT 5G Security Report]

• Healthcare: Enhanced requirements for protecting patient data and medical devices Source: [eHealth Belgium Security Policy]

• Energy: Stricter cybersecurity measures for power grids and critical energy infrastructure Source: [Belgian Commission for Electricity and Gas Regulation]

• Financial Services: Increased focus on cyber resilience and incident reporting Source: [National Bank of Belgium Circular on Cyber Resilience]

Sources

• CCB Strategy 2.0 Document
• CCB Organization Page
• Belgian Official Journal
• Cyber Security Coalition
• CCB International Cooperation
• ENISA Threat Landscape 2022
• EU Agency for Cybersecurity Supply Chain Attacks Report
• Belgian Cyber Security Coalition Cyber Threats Overview
• Deloitte Belgium Cybersecurity Report
• NIST Cybersecurity Framework
• CCB Safeonweb
• ENISA Zero Trust Architecture
• CCB NIS2 Announcement
• CCB Critical Infrastructure Guidelines
• EU NIS2 Directive
• ENISA Cybersecurity Act
• Belgian Data Protection Authority
• BIPT 5G Security Report
• eHealth Belgium Security Policy
• Belgian Commission for Electricity and Gas Regulation
• National Bank of Belgium Circular on Cyber Resilience

Recent developments

• 2025-10-01 — The Cyber Security Coalition/CSC 2.0 annual report says about 35% of the original 82 recommendations are fully implemented, 34% are nearing implementation, and 17% are on track. This indicates continued progress on Belgium’s Cybersecurity Strategy 2.0, though the report is outside the last 3 months window you requested.[8] (source)
• 2024-05-07 — The U.S. National Cybersecurity Strategy Implementation Plan Version 2 added 100 high-impact initiatives and 31 additional initiatives to accelerate execution across federal agencies. It shows how governments are still translating strategy documents into concrete policy and operational actions.[3][4] (source)
• 2024-05-07 — IBM reported that Version 2 of the U.S. implementation plan adds 31 initiatives and many deadlines extend through FY2025. The update underscores industry interest in how governments are turning broad cybersecurity strategies into actionable requirements.[4] (source)
• 2024-03-15 — CISA’s FY2024-2026 Cybersecurity Strategic Plan centers on addressing immediate threats, hardening the terrain, and driving security at scale. While not Belgium-specific, it reflects the broader policy direction that is shaping cybersecurity regulation and public-sector expectations.[5] (source)
• 2021-05-01 — Belgium’s Cybersecurity Plan 2.0 introduced six strategic objectives, including stronger digital trust, user protection, critical infrastructure protection, response capabilities, and international cooperation. The article explains the strategy’s core policy architecture and the institutions involved.[7] (source)
• 2021-05-01 — ENISA describes Belgium’s National Cybersecurity Strategy 2.0 as aiming to make Belgium one of Europe’s least cybervulnerable countries by improving critical infrastructure security, awareness, incident response, and public-private partnerships. This is the clearest high-level official summary of the strategy’s goals.[1] (source)

Related regulations

• Belgium NIS2 Transposition — Belgium, Active, effective 2024-10-18
• NYDFS Cybersecurity Regulation — New York, Active, effective 2025-11-01
• Law on Cybersecurity of Vietnam — Vietnam, Active
• Austria NIS2 Act — Austria, Upcoming
• Luxembourg NIS2 Transposition — Luxembourg, Active
• EU Cyber Resilience Act (CRA) — European Union, Phased, effective 2027-12-11
• EU Cyber Resilience Act - Vulnerability and Incident Reporting (11 Sep 2026) — European Union, Active, effective 2026-09-11
• Netherlands NIS2 Transposition (Cyberbeveiligingswet) — Netherlands, Active, effective 2026-08-15

Put it into practice

• Generate the policy: NIST CSF policy generator (generatepolicy.com)
• Buy the policy pack: Enterprise Security Bundle (cyberpolicy.shop)
• Build it yourself: Compliance Program Starter (ciso.diy)

Browse all regulations · Compliance deadlines · Latest updates