.jpg){kind=link}
The Dutch NIS2 law applies now
The Cyberbeveiligingswet, or Cbw, entered into force on 15 August 2026, as confirmed in the Dutch government notice. It replaced the previous Dutch network and information systems law and put NIS2 into Dutch law. It covers about 8,000 organisations across 18 sectors. Most covered entities are essential or important. Domain-name registration service providers can have registration duties without falling into either class. The Cyberbeveiligingsbesluit has no general transition period for the core duties.
What implementation teams are asking
These public posts are not legal guidance. They show where work can stall: early detection, proof that controls ran and too much confidence in an ISO certificate.
We hold ISO 27001 and I always assumed that would carry most of the weight … and boy was I wrong.Als Microsoft er zelf twee maanden overdoet om erachter te komen dat ze gehackt zijn. Waarom zouden Nederlandse bedrijven dit dan al binnen 24 uur weten?apart from policies and procedures you must show evidence of operating the controlsYour first five Cbw steps
These steps turn the legal duties into work with clear responsibility. Each output becomes part of the evidence a regulator can inspect. They do not guarantee compliance.
- 01
Record the scope decision for each entity
Check the sector, service, size, employee counts and financial totals across the company group, special categories and EU jurisdiction. Record the evidence and who approved the conclusion.
The director responsible for the program should work with legal or compliance and security.
Keep a dated scope and classification record for every legal entity.
- 02
Register and keep the details current
Use MijnNCSC with eHerkenning EH2+ or SSOnRijk. Collect the organisation, contact and network data before starting, and assign an owner to submit changes without delay and no later than 14 days after the change.
A decision-maker with cybersecurity knowledge should be responsible for the submission.
Keep the registration confirmation, submitted data and update process.
- 03
Where Article 24 applies, give the board what it needs to approve
Show the board the main risks, chosen measures, owners, deadlines and open decisions. Arrange the required training for executive directors and keep the certificates.
The board and project lead should approve the plan.
Keep the approval, training certificates, decisions and follow-up actions.
- 04
Where Article 21 applies, operate the ten care measures
Give each measure an owner, current evidence, missing work and a review date. Test backups, access, suppliers and other controls instead of stopping at policy approval.
Security, IT, operations, HR, procurement and service owners share the work.
Maintain a risk-based action plan and records from day-to-day work.
- 05
Where incident reporting applies, run a timed exercise
Use a realistic incident to test significance, escalation, weekend cover, approvals and the information available at 24 hours, 72 hours and one month.
The incident lead should work with legal, communications and the manager on call.
Keep the tested reporting process, draft notices and exercise findings.
Check each legal entity before you plan the work
The official NCSC scope guide starts with sector and size, but those are not the whole test. Services, employee counts and financial totals across the company group, special entity types and cross-border rules can change the answer. Use the NCTV answers and the relevant sector regulation before deciding.
Start with the service and sector
The Cbw lists the entity types and services covered in each sector. A company that sells to healthcare is not automatically a healthcare entity. Check the service the entity itself provides.
Apply the size test
An entity generally meets the basic test with 50 or more full-time equivalent employees (FTE). It can also meet the test with fewer than 50 FTE when both annual turnover and balance-sheet total exceed €10 million. Partner and linked enterprises can count in the calculation.
Annex I sectors
- Energy
- Transport
- Banking
- Financial market infrastructure
- Health
- Drinking water
- Wastewater
- Digital infrastructure
- Business-to-business ICT service management
- Public administration
- Space
Annex II sectors
- Postal and courier services
- Waste management
- Chemicals
- Food
- Manufacturing
- Digital providers
- Research
Essential and important entities
Large generally means 250 or more FTE, or an organisation above both the €50 million turnover and €43 million balance-sheet ceilings. An entity that meets the basic test without being large is generally medium. Large Annex I entities are usually essential. Medium Annex I entities and medium or large Annex II entities are usually important.
Some entities have no size threshold
Providers of public electronic communications networks or services, trust-service providers, top-level-domain registries, DNS providers other than root name servers, and qualifying national and local public authorities can be covered regardless of size. The Cbw generally excludes the Ministry of Defence, intelligence and security services, the Public Prosecution Service, the police and safety regions. It can still apply where one of those bodies provides a trust service that is not used only within a closed system. Critical entities designated under the Dutch Critical Entities Resilience Act (Wwke) fall under the Cbw.
A provider of domain-name registration services that is not also essential or important must still register, provide the required information for the national and European Union Agency for Cybersecurity registers, keep accurate and complete domain-registration data, publish its data-disclosure policy, and answer a lawful, properly reasoned access request without delay or, if that is impossible, within 72 hours.
The whole legal entity is covered
Once a legal entity is classified as essential or important, its Cbw duties apply across that entity, not only to the team that provides the listed service. An incident elsewhere in the entity is reportable only if it meets the significance test.
Cross-border groups may follow more than one law
Most entities follow the law in each country where they are established and provide services. Public authorities register in their own country. Providers of public electronic communications networks or services follow the country where they offer those services. The listed internet-service providers and domain-name registration service providers follow the country of their European Union main establishment or representative.
Other EU rules may replace some Cbw duties
The Digital Operational Resilience Act (DORA) and other European Union sector rules can replace parts of the general Cbw reporting or security duties. Certain digital providers also have detailed duties under EU Implementing Regulation 2024/2690. Designated higher-education entities have a 36-month delay for specified care and board duties after designation.
Register through MijnNCSC now
Registration has been mandatory since 15 August 2026. If an entity is covered, do not wait for an authority letter. Follow the current MijnNCSC registration instructions.
Use the right login and authority
Private organisations need eHerkenning EH2+ linked to the entity's Dutch Chamber of Commerce (KvK) number, plus authority to submit for that entity. Connected central-government organisations can use SSOnRijk.
Collect the data before you begin
Prepare the organisation, sector, services, classification, EU member states, contact people and network data. Network data can include public IP addresses or ranges, domains and autonomous system numbers.
Keep the register current
Review the information after changes to contacts, services, networks or legal details. Submit changes through MijnNCSC without delay and no later than 14 days after the change.
The ten care measures must work in practice
Measures must be appropriate and proportionate to the risks. The Cbw names ten core areas for essential and important entities. Check the entity's sector, designation status and whether an EU sector law replaces these Cbw duties. The NCSC care-duty guide explains all ten measures.
- 01
Risk analysis and information-system security policies
- 02
Incident handling
- 03
Business continuity, backups, recovery and crisis management
- 04
Security of direct suppliers and service providers
- 05
Secure acquisition, development and maintenance, including vulnerability handling
- 06
Checks that security measures work
- 07
Cyber hygiene and cybersecurity training
- 08
Cryptography and encryption
- 09
Personnel security, access control and asset management
- 10
Multi-factor or continuous authentication and secure communications where appropriate
The Cyberbeveiligingsbesluit adds practical expectations. These include written roles and policies, a security management system, risk criteria, incident records, tested recovery, supplier checks, patching, access reviews and periodic checks that measures still work.
The reporting clock starts before the investigation ends
The clock starts when the organisation becomes aware of a significant incident. Report without delay. If that is not possible, 24 and 72 hours are the outer limits. A complete investigation is not required first. Use the NCSC reporting instructions and the regulation for the entity's sector.
Early warning
State whether the incident was probably caused by a malicious or unlawful act and whether it could have cross-border effects. Include contact details for the person responsible for the report.
Incident notification
Update the warning with an initial view of severity, impact and available indicators of compromise.
Final report
Submit it within one month after the 72-hour notification. If the incident is still active, send a progress report. The final report is then due within one month after resolution.
A reportable incident causes or could cause severe operational disruption of the entity's services or financial loss for the entity, or affects or could affect other entities by causing significant material or non-material harm. Sector regulations add thresholds, so the incident team must know which rule applies before an incident occurs.
One report through MijnNCSC reaches the relevant sector computer security incident response team (CSIRT) and regulator. A trust-service provider still uses MijnNCSC, but its full notification is due within 24 hours when the trust service is affected. DORA or another European Union sector rule may require a different reporting process.
Where appropriate, inform service recipients who may be affected without delay about a significant incident that could adversely affect delivery of their services. Separately, tell recipients who may be affected by a significant cyber threat, without delay, what protective steps they can take.
Give the board a decision it can approve
Where Article 24 applies, cybersecurity can be delegated as work, but the management body keeps its legal responsibility. The NCTV board guide explains the approval, oversight and training duties.
Approve the measures
The management body must approve the measures used to meet the care duty and oversee their use. This duty does not apply where an equivalent European Union sector rule replaces the Cbw care duty or an exemption applies. Give the management body risks, options, owners, dates and evidence, not a policy bundle without a decision.
Train executive directors
Where Article 24 applies, executive directors must complete suitable cybersecurity training and receive a certificate. Existing directors have two years from the law's commencement to gain the required knowledge and skills. A director appointed later has two years from appointment.
Keep knowledge current
Board papers should show current risks, incidents, control results and overdue work. Keep training certificates, approvals, minutes and follow-up actions as evidence.
Use ISO 27001 without missing the Dutch duties
An ISO 27001 information security management system (ISMS) can organise much of the recurring security work. It does not replace Dutch scope decisions, registration or incident reporting.
An ISO 27001 ISMS can support
- An information security management system with named roles and controlled policies
- A repeatable risk method, risk register and approved treatment decisions
- Supplier, incident, continuity, access, asset and vulnerability controls
- Internal audits, management reviews, effectiveness checks and corrective action
- Records that show who approved work, when a control ran and what changed
Cbw work to handle separately
- The legal scope and classification of each entity, including whether it is essential, important or covered only as a domain-name registration service provider
- Registration and updates through MijnNCSC
- Where Cbw reporting duties apply, the Dutch 24-hour, 72-hour and one-month incident-reporting process
- Where required, board approval, oversight and the executive-director training certificate
- Sector thresholds, regulators and any EU sector law that replaces the usual Cbw duties
The RDI guidance states that using a framework or holding a certificate does not prove that the care duty has been met. The regulator looks at the organisation's risks, chosen measures and evidence that those measures work. The official Cbw control framework provides a detailed study aid.
The Cyberbeveiligingsregeling sector overheid requires essential entities in the government sector, except water boards, to apply NEN-EN-ISO/IEC 27001:2023 when they establish, implement, maintain and continually improve the required security management system and define its scope. It does not require every Cbw entity to obtain ISO certification.
Know the fines and how supervision works
Essential entities can face proactive and reactive supervision. Important entities are generally supervised after evidence or signs of non-compliance. The two larger maximums below apply to specified care, security and incident-reporting breaches.
Essential entities
€10m or 2%Up to the higher of €10 million or 2% of the prior financial-year worldwide turnover of the undertaking to which the entity belongs.
Important entities
€7m or 1.4%Up to the higher of €7 million or 1.4% of the prior financial-year worldwide turnover of the undertaking to which the entity belongs.
Under the Cyberbeveiligingswet, other violations can generally carry a fine of up to €1 million. A board member to whom Article 24 applies can face a personal fine of up to €25,000 for breaching the knowledge, training or certificate requirements, failing to keep their knowledge up to date, or failing to cooperate with a regulator's lawful demand. Regulators can also use warnings, binding directions, enforcement orders, periodic penalties and audits. Use the NCSC supervision guide to find the regulator for the entity's sector.
Your questions, answered.
Has NIS2 entered into force in the Netherlands?
Yes. The Cyberbeveiligingswet entered into force on 15 August 2026 and replaced the former Wet beveiliging netwerk- en informatiesystemen. Covered entities must meet the duties that apply to them now.
Which organisations fall under the Cyberbeveiligingswet?
The main test combines a listed service in one of 18 sectors with organisation size. An entity generally meets the basic size test with 50 or more full-time equivalent employees, or with fewer than 50 when both annual turnover and balance-sheet total exceed €10 million. Group-wide employee and financial totals, special categories and exclusions can change the answer.
Where does a Dutch NIS2 entity register?
Covered organisations register in the national entity register through MijnNCSC. A private organisation needs eHerkenning EH2+ and authority to act for the relevant Dutch Chamber of Commerce number. Connected central-government organisations can use SSOnRijk. Changes to registered data must be submitted without delay and no later than 14 days after the change.
When does the NIS2 incident-reporting clock start?
The clock starts when the organisation becomes aware of a significant incident. Report without delay. If that is not possible, the early warning is due within 24 hours and the incident notification within 72 hours. The final report is normally due within one month after the 72-hour notification.
Does ISO 27001 certification prove Cbw compliance?
No. ISO 27001 can organise risk management, controls, evidence and review, but a certificate does not decide Dutch legal scope, complete registration, submit incident reports or prove that every Cbw and sector requirement has been met.
What does the Dutch law require from the board?
Where Article 24 applies, the management body, usually the board, must approve the cybersecurity measures and oversee their use. Executive directors must complete suitable cybersecurity training, receive a certificate and keep their knowledge current. These board duties do not apply where an equivalent European Union sector rule replaces the Cbw care duty or an exemption applies.
Can a small Dutch supplier still be affected by NIS2?
Yes. Some entity types have no size threshold and a minister can designate other entities. A supplier outside direct scope may also receive security, evidence and incident-support requirements from a customer that must manage supply-chain risk.