Nobody's asking why Arnold Schwarzenegger has a newsletter.
They're too busy reading it.
Arnold Schwarzenegger. Codie Sanchez. Scott Galloway. Colin & Samir. Shaan Puri. Jay Shetty. They all figured out the same thing: owned audiences compound, rented ones disappear. beehiiv is where they built theirs.
30% off your first 3 months with code PLATFORM30. Start building today.
April 27, 2026 · 4 min read
NIS2 Enforcement Is Live — Belgium Hits First Audit Deadline, EU Inspections Ramp Up
Last week, Belgium became the first EU Member State to hit a hard NIS2 conformity assessment deadline. As of April 18, all essential entities operating in Belgium must have completed their first formal cybersecurity assessment through a BELAC-accredited body and submitted evidence to the Centre for Cybersecurity Belgium (CCB). Failure to comply exposes organizations to administrative measures and financial penalties.
NIS2 classifies cloud and hosting providers as essential entities under the strictest tier: 24-hour incident reporting, board-level accountability, supply chain security controls, and fines up to EUR 10 million or 2% of global turnover. The majority of EU Member States have now completed transposition. Germany's BSI registration deadline passed March 6, with up to 29,000 entities in scope. Auditors are focusing on MFA enforcement, incident detection, and supply chain controls.
Why it matters: This is no longer a transposition story — it's an enforcement story. Belgium has a hard audit deadline that just passed. Germany's registration window is closed. Yet according to a recent CyberSmart survey, only 16% of in-scope businesses feel fully prepared. DORA's designation of 19 Critical ICT Third-Party Providers underscores the concentration risk.
⏰ DEADLINE: NERC CIP-003-11 — May 26 (29 Days)
FERC Order No. 918 requires new password protocols for remote users, authentication information protection in transit, and intrusion detection for low-impact Bulk Electric System Cyber Systems. If you operate low-impact BES assets, your compliance posture needs to be locked by early May.
Also Today
EU CRA Conformity Assessment Deadline: 45 Days — Member States must designate notifying authorities and conformity assessment bodies by June 11, 2026. CRA vulnerability and incident reporting obligations — 24-hour early warnings and 72-hour full notifications for exploited vulnerabilities — follow on September 11. If you manufacture or distribute products with digital elements in the EU, conformity assessment body availability directly affects your compliance path.
→ Confirm your target Member States have designated conformity assessment bodies — and if not, escalate your timeline.
CIRCIA Final Rule Likely Delayed Past May — The DHS appropriations lapse continues. All seven CIRCIA town halls remain suspended, and CISA has confirmed the mandatory 72-hour incident reporting rule for 16 critical infrastructure sectors will likely miss its May 2026 target. Continue voluntary reporting to CISA while the timeline remains uncertain.
→ Maintain CIRCIA-ready incident reporting procedures — the obligation is coming, only the date moved.
Coast Guard Maritime Cybersecurity Plans Due July 2027 — The first-ever mandatory cybersecurity framework for ports, vessels, and offshore facilities is in force. Covered operators must designate a Cybersecurity Officer, conduct assessments, and submit Cybersecurity Plans to USCG for approval by July 16, 2027. Annual cybersecurity training is already required.
→ Confirm your Cybersecurity Officer designation and begin drafting your Plan.
One Thing to Do Today
Open your NIS2 compliance file and answer one question: can you demonstrate a 24-hour incident report capability to a national authority inspector today? If the answer involves a manual process, a phone tree, or "we'd figure it out," that's your Monday task.
Tomorrow's Focus: Privacy & Data Protection — State enforcement trends, GDPR enforcement updates, and cross-border data transfer mechanisms.
CyberEyeQ — Actionable Regulatory Intelligence · [email protected]