Normatik helps you meet NIS2 obligations under the Dutch NIS2 implementation (Cyberbeveiligingswet), as well as supply chain requirements, independently and step by step. Behind the platform is 42 BV: a software company that has built business-critical systems for organisations such as ANWB and VZVZ since 2003. These two things belong together. Anyone building software that enables others to demonstrate their information security must be able to show that they have mastered that discipline themselves.
NIS2 affects far more than just large organisations. Even if the law does not apply to you directly, you may encounter supply chain requirements: customers covered by the law must impose verifiable requirements on their suppliers. Increasing numbers of SMEs and suppliers therefore face questionnaires, audit requests and contractual security requirements — often without a security department of their own to respond.
The usual responses do not convince us. Struggling with spreadsheets and separate Word templates rarely produces a controlled management system. And a consultancy engagement costing €10,000 or more is disproportionate to the size of many SMEs.
Our mission is therefore simple: compliance should be a workable process, not a project that requires hiring an external party. In plain language, without security jargon, Normatik guides you through the ten cybersecurity risk-management measures of Article 21 — from risk analysis and policies to incident handling and supplier management.
The result: a working information security system that you understand and maintain yourself, and that lets you demonstrate to customers, auditors and regulators that everything is in order. Not as a paper exercise, but as an integral part of your operations.
42 BV (Dutch Chamber of Commerce number 24293804) was founded in 2003 and operates from Zilverstraat 1 in Zoetermeer. For more than twenty years, the company has built robust custom software: enterprise Java applications, complex system integrations and, in recent years, carefully designed, secure AI applications. We use technology where it demonstrably adds value, rather than chasing hype.
This approach has led to long-term partnerships with organisations whose software cannot afford to fail:
The DienstVerlener Beheer application for the emergency assistance centre, coordinating assistance in the Netherlands and abroad.
Supportal, the national platform for healthcare communication.
Systems for licensing television use in businesses.
A registration and communication platform for healthcare.
42 BV is ISO 27001-certified and employs its own Security Officers. This means we run an information security system ourselves, undergo annual audits and experience first-hand what works and what remains paperwork. That practical experience feeds directly into Normatik: the platform's steps, templates and checks reflect how an ISMS works in practice, not simply how it appears in a standard.
It also means continuity for you. Normatik is not a startup that might disappear from the market next year. It is a product of an established organisation with a sound business, loyal customers and twenty years of experience maintaining software built to last.
As the CBG, we’ve been working with 42 for years on custom software. It was therefore a logical step to join Normatik. Our National Register of Deceased Persons is not officially subject to the new NIS2 directive, but we believe it’s important to do everything we can to keep our data as secure as possible.
We opted for the most comprehensive package, with 42 guiding us step by step through all the components. And it doesn’t stop at simply filling out forms, because that alone doesn’t change anything. 42 advises us on the best ways to handle matters in practice and provides training for our executive team. This way, we know exactly where we stand — not just on paper, but in practice as well.
Floris Houniet — CTO, CBG | Centrum voor familiegeschiedenis
Normatik is developed and maintained by 42's permanent team in Zoetermeer: software engineers, Security Officers and designers who work on the platform every day. Two people guide that work.
Robert oversees Normatik's technical quality. At 42, he is responsible for software quality and robust architecture, and for the controlled use of AI: only where it demonstrably helps users, and always within strict privacy and security boundaries.
Jeffrey is responsible for information security at 42 and oversees its own ISMS, including the annual ISO 27001 audits. He brings that daily experience into Normatik: the platform's measures, templates and checks are tested against how information security works in a real organisation.
The 42 team during a team day in Scheveningen
In Normatik, you record how your organisation handles risks, incidents and suppliers. That information is confidential, and we treat it accordingly. Our choices around hosting and data processing are deliberately conservative.
Security promises are easy to write. That is why we have ours assessed: 42 BV's management system is ISO 27001-certified and regularly audited externally. In-house Security Officers oversee compliance in daily development, from access management and encryption to reviewing every change to the platform. Normatik follows the same principle we ask of our users: information security is not a document in a drawer, but a demonstrably functioning process.
All data is stored in data centres on Dutch soil, powered by sustainable energy and subject entirely to Dutch and European law.
Data processing is documented in a data processing agreement. Your data never leaves the European Union.
The management system of developer 42 BV is regularly audited externally, with in-house Security Officers overseeing compliance.
Your data remains yours and can be exported in standard formats at any time.
We believe you should be able to verify who is behind a compliance platform. Normatik is a product of 42 BV, registered with the Dutch Chamber of Commerce under number 24293804, with an office at Zilverstraat 1 in Zoetermeer. You are welcome to visit for coffee and an on-site demonstration.
Would you like to see how Normatik works first? Request a no-obligation demo. In half an hour, we will show you how to move from an initial risk analysis to a demonstrably functioning ISMS — then you decide whether it suits your organisation.
Request a free demo and discover how to meet NIS2 requirements step by step. No obligations or commitments.
Request a free demo →