# Eduard Meelhuysen

Eduard Meelhuysen shares practical commentary on NIS2 cybersecurity compliance, focusing on whether organizations are in scope, how to choose risk-based security measures, and how to manage supplier risks.

- Profile: https://b2binfluencer.marketing/creators/eduard-meelhuysen/
- LinkedIn: https://www.linkedin.com/in/eduardmeelhuysen
- LinkedIn followers: 4,458
- Topics: supply-chain, cybersecurity, risk-management
- Based on 12 dated posts, latest 2026-09-22

## Summary

Most useful for concise NIS2 compliance commentary on scope, risk-based security measures, and supplier risk.

- Best for: A NIS2 compliance consultancy wanting a named expert voice for outreach and co-marketing.
- Not for: A security product vendor wanting a paid, performance-measured launch for technical practitioners.
- Check first: Confirm terms, deliverables, link routing, and recent post results before contacting them.

### Takeaways

- Assuming you are out of scope is the risk, not non-compliance.
- Waiting repeats the GDPR mistake; the goal is provable readiness.
- Vendors are the least structured part of NIS2 readiness.

## Main ideas

- **Assuming you are out of scope is the risk, not non-compliance**: Meelhuysen's most repeated argument is that companies rarely have a compliance problem; they have an awareness problem. The biggest exposure, in this view, is never checking whether an obligation applies. The posts explain why scope is wider than many assume, contrast it with NIS1, and urge readers to replace intuition with an actual check.
- **Waiting repeats the GDPR mistake; the goal is provable readiness**: Meelhuysen argues that the dismissals now heard about NIS2 echo those heard about GDPR—and did not hold then. The point, they say, is not the fine but being operationally ready when something happens and able to prove that readiness. The instinct to deal with it when it becomes relevant, they warn, arrives too late.
- **Adequate security means defensible, risk-based decisions**: Meelhuysen argues that NIS2 does not ask companies to follow generic standards. It asks for measures appropriate to a specific risk exposure, which means two companies in the same industry can face different requirements. The practical demand pressed hardest is documentation: an organisation must be able to justify why its chosen measures are sufficient, and "we follow industry standards" is characterised as a shortcut rather than a strategy.
- **Vendors are the least structured part of NIS2 readiness**: Meelhuysen extends the scope argument to vendors, which may represent a company's largest NIS2 exposure because responsibility does not stop at its own infrastructure. The obligations described cover supply chain and supplier security risks, including direct service providers and critical partners; an incident at a third party can become the buyer's own reportable incident. The post frames the uncomfortable issue as questions most organisations cannot answer.

## Work to read

- [“We're probably not affected by NIS2” — the scope-check post](https://www.linkedin.com/posts/eduardmeelhuysen_nis2-cybersecurity-compliance-activity-7440382977135562753-KmHk)
- [The GDPR parallel on NIS2 fines and delay](https://www.linkedin.com/posts/eduardmeelhuysen_nis-2-what-matters-now-activity-7449781886148558848-IzEO)
- [What counts as “adequate security” under NIS2](https://www.linkedin.com/posts/eduardmeelhuysen_nis2-cybersecurity-riskmanagement-activity-7442552175794274304-Qq50)
- [Supply-chain and third-party risk under NIS2](https://www.linkedin.com/posts/eduardmeelhuysen_nis2-supplychainsecurity-thirdpartyrisk-activity-7447650002891497472-qcoO)

## Brand relationships

- **Pently** (disclosed_partnership)

## Partnerships

The posts here do not contain a documented partnership offer. Eduard Meelhuysen's four available LinkedIn posts are NIS2 commentary, and each one closes with a call to action pointing readers to a free NIS2 scope self-assessment rather than to a sponsorship page, media kit, rate card, or contact route for brands. One recurring branded hashtag, Pently, appears alongside the links, but a hashtag alone does not establish a paid or formal partnership arrangement, and neither the posts nor any page here describes formats, deliverables, pricing, or terms. The practical consequence for a buyer is that there is no published menu to plan against: any collaboration would have to be scoped directly and confirmed with Meelhuysen before it is presented as available. One operational detail does affect planning. The self-assessment link is a repeated, first-party call to action tied to NIS2 scope, so a partner would be sharing attention with an existing prompt rather than inheriting an open or neutral slot, and any co-marketing would need to agree in advance on which link, tool, or landing page the audience is sent to. No official partnership or inquiry route is published here, so no inquiry link is published in this section. Whether Meelhuysen accepts sponsored work at all is not established either way by the posts here; the absence of a documented offer does not mean sponsorship is refused.

## Alternatives

- Sandra Roberts, CSM, CySA: Choose Sandra Roberts when the campaign should make the board-level case for cybersecurity investment. In a post on CISO priorities, Roberts links security spending to business goals and includes regulatory compliance among leaders’ concerns. That framing can make a readiness conversation more relevant to executives.
- Yasamin Fatemian: Choose Yasamin Fatemian when the campaign is about aligning security work with business priorities, rather than explaining NIS2 rules. In a post about project alignment, Fatemian suggests asking what business risk a project addresses, who it affects, and how success will be measured. A separate post about AI and security teams considers how AI might help teams prioritize information and make decisions faster.
- Anne Bisagno: Choose Anne Bisagno when the campaign should move from regulation to device security for hybrid work. In a BYOD post, Bisagno frames personal-device security as a governance issue involving policy, education, identity security, and ongoing oversight. A second post on Device Trust describes checking device posture and taking a phased approach toward Zero Trust.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/