The Dutch Cybersecurity Act (NIS2): does it apply to you, and what do you need to arrange?
5 min read · Updated on 20 October 2026
The Cyberbeveiligingswet (Cbw) is the Dutch implementation of the European NIS2 Directive. The act has applied since 15 August 2026. This article explains whether your organisation is covered and which duties then apply.
What has changed?
The Dutch Senate approved the Cybersecurity Act on 7 July 2026. The Cybersecurity Decree was published in the Staatsblad (Bulletin of Acts and Decrees) on 10 July 2026. It states that the act and the decree enter into force on 15 August 2026.
The Cbw replaces the Network and Information Systems Security Act (Wbni). According to the Dutch government, around 8,000 organisations fall under the new act. You have to determine yourself whether your organisation is one of them.
The official government announcements do not mention a separate phase-in period for the duty of care or the reporting duty. Registration has been mandatory since 15 August 2026.
Is your organisation covered?
That depends on your sector and your size. The act has two annexes listing sectors. Annex 1 includes energy, transport, banking, healthcare, drinking water, wastewater, digital infrastructure, ICT service management (business-to-business), public administration and space. Annex 2 includes postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research.
- Medium-sized: 50 to 250 employees, or annual turnover above 10 million euros and a balance sheet total above 10 million euros.
- Large: from 250 employees, or annual turnover above 50 million euros and a balance sheet total above 43 million euros.
- Essential entity: among others, large organisations in an Annex 1 sector, government organisations, DNS service providers, TLD registries and qualified trust service providers.
- Important entity: among others, medium-sized organisations in Annex 1 and medium-sized and large organisations in Annex 2.
Small organisations are only covered if they provide certain services, such as DNS services or public electronic communications. A minister can also designate a small organisation. Ondernemersplein, the Dutch government business portal, offers a quick scan and a self-assessment to determine your situation.
The main duties
- Registration duty: you register your organisation with the NCSC via mijn.ncsc.nl and keep the details up to date.
- Duty of care: you carry out a risk analysis and take appropriate measures. The minimum measures cover, among other things, incident handling, business continuity, supply chain security, cyber hygiene and training, cryptography and multi-factor authentication.
- Reporting duty: you report a significant incident to the CSIRT and the supervisory authority.
- Board: the board is ultimately responsible, approves the measures and completes training.
The reporting duty works in steps:
- Early warning: as soon as possible, and no later than 24 hours after the incident.
- Notification with an initial assessment of severity and impact: no later than 72 hours.
- Intermediate report: when the CSIRT or the supervisory authority asks for one.
- Final report: no later than one month. If the incident is still ongoing, a progress report is sufficient.
Who supervises?
Supervision differs by sector. Examples of supervisory authorities are the RDI, the ILT, DNB, the AFM, the IGJ and the NVWA. For many sectors the NCSC is the CSIRT. There are also sector CSIRTs, such as Z-CERT for healthcare.
For essential entities supervision is proactive, even without an incident. For important entities supervision mainly follows an incident or a signal that the rules are not being met.
You are not covered, but your customers are
Supply chain security is one of the required measures. Organisations covered by the act therefore also look at their suppliers. Advice: expect questions from customers, even if you are too small to be covered yourself. Make sure you can answer them.
- Use the quick scan to check whether you are covered by the Cbw yourself.
- Turn on multi-factor authentication for all accounts.
- Keep systems up to date and test your backups.
- Write down who does what during an incident and who informs your customers.
- Describe your measures briefly in writing, so you can show them to customers.