NIS2 and the RIPE NCC

NIS2 is the EU Directive which establishes measures that aim to achieve a common level of cybersecurity across the EU for the entities falling within its scope. The Directive has been transposed into the Dutch legal system via the Cyberbeveiligingswet (Cbw), which has been in force since 15 August 2026.

As a result of our authoritative DNS and RPKI services, the RIPE NCC falls within the scope of the Cbw. We have therefore registered as an essential entity with the National Cyber Security Center (NCSC) in the Netherlands.

As an essential entity, we are required to take appropriate and proportionate cybersecurity risk-management measures according to Article 21 of NIS2 and the Cbw, and as those are further specified for DNS service providers and trust service providers in Commission Implementing Regulation (EU) 2024/2690. To that end, we have policies, security controls and other capabilities in place to ensure the security, integrity and availability of our network and information systems, and of the services we provide. Read more on the Trust Portal.

Our Resource Public Key Infrastructure (RPKI) service has successfully obtained its SOC 2 Type II assurance report and we are in the process of attaining the ISO/IEC 27001 certification for certain of our critical services. Upon request, we will make the most recent available audit reports and certificates relating to our services available to our members and other interested parties, subject to a standard non-disclosure agreement.

We have also adjusted our Incident Management processes to be able to notify the relevant authorities and affected recipients of our services of significant incidents in a timely manner, in accordance with Article 23 of NIS2 and the Cbw. Read more on the Trust Portal.

In this document, we provide more information to support our members and other recipients of our services with their supply chain requirements when they regard us as their supplier or service provider.