NIS2 and DORA: why your company needs specialised IT consultants in 2026

Two European frameworks now shape IT priorities in Belgium. NIS2 raises cybersecurity requirements across a wide range of sectors and was transposed into Belgian law with supervision by the Centre for Cybersecurity Belgium. DORA sets digital operational resilience rules for the financial sector and for the IT providers serving it. Both moved from paper to inspection in the past two years.

Two regulations, one reality

The practical consequence is the same in both cases: security is no longer only a technical topic. It has become a governance obligation with documented processes, evidence, reporting deadlines and personal responsibility for management bodies.

Who is concerned in Belgium

• NIS2 essential and important entities: energy, transport, banking, health, drinking water, waste water, digital infrastructure, public administration, postal services, manufacturing, food, chemicals and digital providers.
• Suppliers of those entities, through supply chain security requirements passed down in contracts.
• DORA: banks, insurers, payment institutions, investment firms, crypto asset providers and their critical IT third parties.

What the texts actually require

• A documented risk analysis and a set of proportionate technical and organisational measures.
• Incident detection, handling and notification within short deadlines, with an early warning followed by a full report.
• Business continuity, backup, crisis management and, for DORA, resilience testing.
• Supply chain and third party risk management, including a register of IT contracts for DORA entities.
• Access control, multi factor authentication, encryption, asset inventory and vulnerability management.
• Awareness training for staff and for the management body itself.

The profiles in demand

Companies are looking for people who combine regulation and engineering. The roles most frequently requested in 2026 are security architects, GRC consultants able to write and defend the documentation, identity and access management specialists, cloud security engineers, SOC and incident response analysts, business continuity and DORA testing leads, and data protection profiles working next to the DPO.

These skills are scarce. A permanent recruitment on this market often takes three to six months, which rarely matches a compliance deadline or an audit date.

Staffing without a permanent hire

Most compliance work has a defined horizon: a gap analysis, a remediation programme, a testing cycle, an audit preparation. That shape fits a consultant assignment better than a permanent contract.

With BSH the consultant is employed under CP200 by BSH. You sign one service contract, receive one monthly invoice and keep no payroll, benefits or end of contract exposure. The cost is predictable, fully deductible and stops when the assignment stops. Availability is confirmed before we commit to a start date.