6 min read
Last updated
The Cybersecurity Act Netherlands, Cbw [Cyberbeveiligingswet], implements the European NIS2 Directive into Dutch law. The Act entered into force on August 15, 2026 and introduces cybersecurity obligations for organisations within its scope.
AT A GLANCE
NIS2 Netherlands: Dutch Cybersecurity Act
The Cybersecurity Act Netherlands [Cyberbeveiligingswet, Cbw] is the Dutch law implementing the European NIS2 Directive. Its purpose is to enhance resilience against cyber threats such as distributed denial-of-service (DDoS) attacks and cybercrime.
The Act imposes strict cybersecurity obligations on organisations that operate in critical industries, where service disruptions could cause significant societal or economic harm. These industries include, but are not limited to the Dutch public sector, banking and financial markets, energy, transport and logistics, health care, digital and IT providers.
Cybersecurity Act Entered into Force August 2026
The Cybersecurity Act (Cbw) entered into force in the Netherlands on August 15, 2026. Organisations within its scope must comply with its registration, cybersecurity risk management and incident reporting obligations.
The Cbw is the Dutch implementation of the EU’s Network and Information Security Directive 2 (NIS2 Directive), which entered into force on January 16, 2023. EU Member States were required to transpose the Directive into national law by October 17, 2024. NIS2 replaces the original NIS Directive.
Update Important: The Act is now in force. Organisations should confirm whether they fall within its scope and ensure compliance. Businesses outside its direct scope may also face cybersecurity requirements through contracts with regulated customers.
Who Must Comply Under the Cybersecurity Act
The Cybersecurity Act primarily targets organisations that are critical to national security and public interest, such as:
-
Banking and financial markets
-
Energy providers
-
Transport and logistics
-
Public sector and government entities
-
Healthcare organisations
-
Digital infrastructure providers
-
IT service providers
These industries are categorised as critical where service disruptions due to cyberattacks would have serious national consequences.
Generally, organisations operating in the sectors and carrying out the activities covered by the Act meet the size threshold if they have:
- 50 or more employees, calculated in full-time equivalents; or
- both annual turnover and a balance sheet total exceeding EUR 10 million.
Partner and linked enterprises may need to be included when calculating these figures. Sector-specific rules and exceptions also apply
However, small businesses may also fall under the Act if their activities are deemed essential to national security by the responsible sector minister.
Certain types of organisations fall within scope regardless of size, including:
- providers of trust services;
- DNS service providers;
- top-level domain name registries;
- providers of public electronic communications networks or services.
Domain name registration service providers also have registration obligations, but should not automatically be described as subject to every cybersecurity obligation under the Act.
Additionally, suppliers to Cbw-regulated companies may be indirectly affected because regulated companies must assess and manage cybersecurity risks associated with their direct suppliers and service providers. This may result in contractual security requirements for suppliers.
Cybersecurity Obligations for Suppliers
Even if a business itself is not directly subject to the Cybersecurity Act, it may still face contractual cybersecurity requirements if it supplies products or services to a Cybersecurity Act regulated entity.
Such suppliers may be required to demonstrate cybersecurity readiness and could be asked to answer questions such as:
-
Do you adhere to and maintain compliance with internationally recognised information security standards, such as ISO/IEC 27001?
-
Do you maintain up-to-date, written documentation detailing your policies and procedures for identifying, assessing, and managing digital security risks?
-
Do you implement robust user authentication controls, including mandatory two-factor authentication (2FA) for all user accounts and administrative access?
-
Are all information systems, software, and infrastructure subject to regular updates and patch management, and are they protected by industry-standard anti-malware and antivirus solutions?
-
Do you maintain a comprehensive data backup strategy and a formal business continuity plan (BCP) to ensure operational resilience in the event of a cybersecurity incident?
-
Do you provide regular cybersecurity awareness and training programmes to all employees to mitigate security risks?
-
Do you conduct regular testing to assess system vulnerabilities and ensure remedial actions are taken where necessary?
-
Do you maintain and regularly test an incident response plan, including the ability to detect, report, and respond to phishing attacks and other cyber threats?
Key Legal Obligations Under the Cybersecurity Act, NIS2 Netherlands
Companies directly subject to the Cybersecurity Act will face the following legal obligations:
Step 1. Registration Obligation
Register in the national entities register administered by the National Cyber Security Centre (NCSC), through Mijn NCSC.
Step 2. Duty of Care
Assess cybersecurity risks and implement proportionate measures to mitigate them, including cybersecurity controls in the supply chain.
Management Responsibilities
Management body must approve the cybersecurity risk management measures and oversee their implementation. They must also undertake training to develop the knowledge needed to identify cybersecurity risks and assess the organisation’s response.
Step 3. Incident Reporting Obligation
Notify the competent Computer Security Incident Response Team (CSIRT) and sector regulator of significant incidents without undue delay. The reporting process generally requires an early warning within 24 hours of becoming aware of the incident, an incident notification within 72 hours and a final report within one month of the incident notification. Specific reporting rules apply to trust service providers.
Step 4. Supervision and Enforcement
Supervision will be carried out by sector-specific regulators such as the Rijksinspectie Digitale Infrastructuur (RDI) for IT companies and the Inspectorate for the Environment and Transport (ILT) for transportation companies.
Cybersecurity Act: Actions for Employers
The Cybersecurity Act has been in force since August 15, 2026. Organisations should assess their legal obligations, complete the required registration and address any gaps in their cybersecurity measures and incident reporting procedures.
In addition, cybersecurity standards are already tightening in practice due to contractual requirements from larger clients and critical infrastructure operators.
Step 1. NIS2 Self Assessment Tool
For more guidance, consult the NIS2 self-assessment tool by the Dutch Authority for Digital Infrastructure’s NIS2 self-assessment tool (in Dutch). Or use the Quick scan (in Dutch) to determine where you stand in preparing for the NIS2 Directive.
Additional general information can be found on the website of National Cyber Security Centre (NCSC) Netherlands.
Step 2. Inform the Works Council Netherlands
Assess whether the cybersecurity measures establish, amend or withdraw arrangements concerning the processing or protection of employees’ personal data, or introduce systems intended or suitable for monitoring employees’ attendance, behaviour or performance.
- Where Article 27(1)(k) or (l) of the Works Councils Act [WOR] applies, obtain the Works Council’s consent before implementing the proposed arrangements.
- Where consent is not required, inform and involve the Works Council as appropriate through regular consultation.
Not every technical cybersecurity measure automatically requires Works Council consent.
