How to Combine NIS2, NEN 7510, and Quantum Security

NIS2, NEN 7510 and quantum security are best combined by treating them as one integrated security strategy rather than three separate compliance tracks. The three frameworks overlap significantly in the areas of risk management, access control and encryption. For organisations in critical sectors such as healthcare, transport and data centre infrastructure, a combined approach is not only more efficient, but also necessary to remain future-proof and compliant. The sections below answer the most frequently asked questions about how to put this into practice.

Where do NIS2 and NEN 7510 overlap?

NIS2 and NEN 7510 overlap in four core areas: risk management, incident response, access security and the protection of sensitive information. Both frameworks require organisations to document, periodically test and demonstrably implement their security measures. For healthcare organisations already working towards NEN 7510 certification, this work largely covers the NIS2 obligations as well.

The fundamental difference lies in scope. NEN 7510 was developed specifically for the healthcare sector and focuses on the protection of patient data and medical information systems. NIS2 has a broader scope and applies to all providers of essential and important services, from energy companies to transport operators and digital infrastructure providers.

In practical terms, the overlap means that a risk analysis carried out for NEN 7510 can be used directly as input for your NIS2 documentation. Measures relating to protection of sensitive data count towards both frameworks. This saves time and prevents duplication of effort in your compliance process.

What are the specific obligations under NIS2 for networks?

NIS2 requires organisations within the scope of the directive to take specific technical and organisational measures for their network and information systems. Concretely, these include: encryption of data in transit and at rest, network segmentation, access management based on the least-privilege principle, continuous monitoring, and a demonstrable incident response process.

For network managers and IT directors, this means that the physical and logical network infrastructure explicitly becomes part of the compliance dossier. Network segmentation is no longer a nice-to-have, but a requirement. The same applies to the ability to detect and report significant incidents to the competent authority within 24 hours.

Encryption deserves particular attention here. NIS2 stipulates that data transfers must be adequately secured, but does not specify which technology to use. This leaves room to choose encryption at layer 1 or layer 2 of the OSI model, which for many critical environments is the most robust and latency-friendly option. View our encryption solutions for an overview of what is technically possible within your infrastructure.

How does layer 1/2 encryption protect against future quantum threats?

Layer 1/2 encryption protects against quantum threats by securing data traffic at the physical and data link level of the network, before data reaches the higher protocols. Modern layer 1/2 encryptors can be equipped with quantum-safe key exchange, making them resistant to attacks from future quantum computers.

The risk of quantum computing for encryption is concrete: quantum computers can solve the mathematical problems on which current asymmetric encryption algorithms such as RSA and ECC are based. This makes it possible to decrypt encrypted traffic that is intercepted today at a later point in time. This is known as the “harvest now, decrypt later” scenario and is a real risk for organisations that transport sensitive data today.

Layer 1/2 encryption offers a practical answer to this, because it operates independently of the higher application layers and is therefore easier to upgrade to quantum-safe algorithms. By implementing encryption as deep as possible in the network stack, you also minimise the attack surface. No application code needs to be modified; the security is embedded in the infrastructure itself.

For organisations in critical sectors such as energy, transport and healthcare, this is particularly relevant. They process data whose confidentiality must be guaranteed for decades, well beyond the point at which quantum computers become operational. Protection against quantum threats therefore starts now, not when the threat materialises.

When will post-quantum cryptography be mandatory under compliance frameworks?

Post-quantum cryptography is not yet formally required under NIS2 or NEN 7510 in 2026, but both frameworks contain a dynamic risk management obligation that already compels organisations to include quantum threats in their security analysis. Governments and regulators expect critical sectors to have a migration strategy for the transition to quantum-safe algorithms.

The American NIST published the first post-quantum standards in 2024, including CRYSTALS-Kyber for key exchange and CRYSTALS-Dilithium for digital signatures. The European Union and national regulators are actively following these standards and translating them into sector-specific guidelines. For organisations under NIS2 supervision, it is wise to already take future obligations into account in the procurements and investments you make today.

The practical rule of thumb is simple: if your current encryption infrastructure has a lifespan of more than five years, include quantum resilience as a criterion now. Infrastructure you procure today must still be compliant tomorrow.

How do you build a combined NIS2/NEN 7510/quantum strategy?

You build a combined strategy by starting with an integrated risk analysis that maps the requirements of all three frameworks simultaneously. Identify the overlapping measures, implement these as a foundation, and then supplement with the framework-specific requirements. This prevents silos and duplicated efforts.

Step 1: Integrated risk analysis

Start with a risk analysis that treats the scope of NIS2, the information security requirements of NEN 7510 and the quantum threat landscape as a single whole. Map out which systems process sensitive data, which connections are critical to business continuity, and which encryption technologies you currently use. This immediately reveals the gaps you need to close for all three frameworks at once.

Step 2: Phased implementation

Prioritise measures that score for multiple frameworks simultaneously. Network segmentation, access management and layer 1/2 encryption are good examples: they are required under NIS2, align with NEN 7510 requirements and form the foundation for quantum resilience. Plan the transition to post-quantum cryptography as a phased migration track, linked to the replacement of existing hardware and software.

Real-time monitoring of your network infrastructure is an element that recurs in all three frameworks. Real-time fibre monitoring helps you to detect and report anomalies immediately, which aligns with the incident response obligations of NIS2.

Which technologies simultaneously support NIS2, NEN 7510 and quantum resilience?

Four technology categories simultaneously support the requirements of NIS2, NEN 7510 and quantum resilience: layer 1/2 encryptors with quantum-ready key exchange, continuous network monitoring, out-of-band management and network segmentation via modern switching architectures. Together they form a layered security infrastructure that meets all frameworks.

Layer 1/2 encryption and quantum-ready key exchange

Encryptors operating at the physical or data link level offer high throughput with minimal latency and are relatively straightforward to upgrade to post-quantum algorithms. They secure the connection at the most fundamental level, regardless of which applications or protocols run on top. This makes them future-proof and compliant at the same time.

Continuous monitoring and out-of-band management

NIS2 requires you to quickly detect and report significant incidents. For this you need continuous monitoring of your network management, combined with an out-of-band management environment that remains available even during an incident or attack. Out-of-band management ensures you always have access to your infrastructure, even if the primary network is compromised. This is a requirement that also recurs in NEN 7510 guidelines for healthcare organisations.

Would you like to know which approach best suits your organisation and sector? We are happy to think along with you about a strategy that realises NIS2 compliance, NEN 7510 certification and quantum resilience as one coherent infrastructure. Contact our experts for a no-obligation conversation.