Cyberbeveiligingswet (Cbw): a step-by-step compliance guide

The Cbw and the Cyberbeveiligingsbesluit have applied since 15 August 2026. This guide takes you from scoping and NCSC registration to the zorgplicht, meldplicht and board duties.

This guide is for CISOs, compliance officers, counsel and directors of Dutch organisations, and of groups with Dutch entities. At the end you will have a scoping decision, a confirmed registration, a gap analysis against the Cbb, a working incident reporting procedure and a board governance record a supervisor can follow.

The Cbw replaces the Wet beveiliging netwerk- en informatiesystemen (Wbni) and transposes NIS2. According to the government, more than 8,000 organisations in 18 sectors have obligations under it, while the Wwke (the CER Directive) covers around 500 designated critical entities^[1].

Before you start

Appoint one accountable owner for the programme (often the CISO or the compliance lead) and one sponsoring director. Gather your legal entity structure, Chamber of Commerce (KvK) numbers, headcount and financial figures per entity, a list of services you provide, and your public network details. MijnNCSC uses eHerkenning at level EH2+ with a mandate, so check who holds that authorisation^[4].

Step 1: Determine whether you are in scope, and as which entity type

The Cbw relies on self-assessment: the organisation decides whether it falls under the law and whether it is an essential (essentiële entiteit) or important entity (belangrijke entiteit). Nobody will send you a letter first. The test combines sector and size (EU SME definition). As a rule, small enterprises (fewer than 50 employees and turnover or balance sheet total under EUR 10 million) are out of scope, but some types of entity are covered regardless of size^[7]. Municipalities, provinces, water boards and joint arrangements (gemeenschappelijke regelingen) are classed as essential entities.

• Map each legal entity to the sectors and sub-sectors in NIS2 Annexes I and II. Use the NCSC decision tool as a cross-check.
• Apply the size test per entity, taking partner and linked enterprises into account as the SME definition requires.
• Check whether any entity is designated as a critical entity under the Wwke; critical entities are essential entities under NIS2.

Step 2: Register in the NCSC entity register

The registratieplicht (registration duty) has applied since 15 August 2026, and the NCTV states that organisations themselves are responsible for registering on time^[5]. Registration takes place in the national entity register held by the NCSC, through MijnNCSC. You provide organisation details, contact details and network details such as public IP ranges, domain names and AS numbers. The Cbb (article 27) adds items such as the entity category and the KvK number or equivalent; government bodies use their code in the Register van Overheidsorganisaties^[2]. Changes must be reported through MijnNCSC within 14 days^[4].

• If you have not registered yet, do it now: the obligation is already in force.
• Assign an owner for keeping the registration current, and add a register check to your change process for new domains and IP ranges.

Step 3: Identify your supervisor and your CSIRT

Supervision in the Netherlands is sectoral. The NCSC overview lists, among others, the Rijksinspectie Digitale Infrastructuur (RDI) for digital infrastructure, energy, government, digital providers, ICT service management, space, postal services and manufacturing; the Inspectie Leefomgeving en Transport (ILT) for transport, drinking water, wastewater, waste management, chemicals and meteorology; DNB for banking; AFM for financial market infrastructure; NVWA for food; and ANVS for the nuclear sector^[6]. For healthcare, the Ministry of VWS refers to supervision by the Inspectie Gezondheidszorg en Jeugd (IGJ). The NCSC acts as CSIRT for most sectors and explicitly is a point of contact for support, not for supervision. The NCTV is responsible for the law and its national interpretation.

• Record your supervisor and CSIRT per entity.
• Read your sector’s Cyberbeveiligingsregeling (ministerial regulation), which sets incident thresholds and can add requirements. For government, the Baseline Informatiebeveiliging Overheid (BIO2) elaborates the duty of care.

Step 4: Run a gap analysis against the Cbb measures

The zorgplicht (duty of care) requires appropriate and proportionate measures, based on a risk analysis, to manage risks to your network and information systems. The Cbb turns this into a concrete minimum: article 5 obliges entities to take at least the measures in articles 6 to 18^[3]. These cover an information security policy with defined roles (art. 6), risk management with methodology and acceptance criteria (art. 7), incident handling and logging (art. 8), business continuity, backups and crisis management (art. 9), supply chain security (art. 10), secure acquisition, development and change management (art. 11), cyber hygiene and training (art. 12), cryptography (art. 13), personnel security (art. 14), access control (art. 15), asset management (art. 16), handling vulnerability and threat information (art. 17) and periodic evaluation of the measures (art. 18).

The structure follows the annex to Implementing Regulation (EU) 2024/2690. For the digital providers that regulation covers (such as cloud, data centre and managed (security) service providers), Cbb article 4 disapplies articles 6 to 18 because the EU regulation applies directly.

• Assess each Cbb article (or 2024/2690 requirement) as met, partly met or not met, with evidence, adding sector requirements.
• Prioritise gaps by risk, not by article order.

The companion template includes the full checklist, with one line per Cbb measure and the matching NIS2 and 2024/2690 references.

Step 5: Build the risk analysis that drives the measures

Cbb article 7 requires a risk management policy with a methodology, acceptance criteria, a risk analysis and a risk overview from which security requirements follow. In practice: a living, all-hazards risk register in which each risk links to the measures that treat it, so proportionality can be explained.

Step 6: Set up the incident reporting procedure (meldplicht)

Significant incidents must be reported through the central reporting point on MijnNCSC, which forwards the report to both your CSIRT and your supervisor^[8]. Deadlines run from the moment you become aware of the incident.

Report	Deadline	Content
Early warning	Within 24 hours	Whether the incident is likely caused by malicious action and whether it may have cross-border impact; contact details. The Cbb (art. 24) adds items such as likely start time, expected recovery time and mitigation steps.
Incident notification	Within 72 hours (24 hours for trust service providers)	Update of the early warning, initial assessment of severity and impact, indicators of compromise where available.
Progress report	After one month, if the incident is still ongoing	Status at that point.
Final report	Within one month	Description, root cause, measures taken, cross-border impact.

The CSIRT or supervisor can also ask for intermediate updates. Significance depends on sector thresholds in the ministerial regulations; DORA entities may report through the DORA route instead.

• Embed your sector thresholds in the incident procedure and name who decides on significance and who submits, with deputies.
• Run a tabletop exercise through the full 24h/72h/one-month cycle.

Step 7: Put the board in charge, on paper and in practice

Cbw article 24 makes the management body responsible for approving the duty of care measures and overseeing their implementation. Each board member must have sufficient knowledge and skills to assess cyber risks and measures, keep that knowledge up to date and be able to show a training certificate. Serving board members must meet this within two years of entry into force, so by 15 August 2028, and new board members within two years of appointment^[9]. The Cbb (articles 20 to 22) sets the training content: risk identification and the risk management measures of the law. The certificate must state the board member’s name, the date or dates, the topics and the provider, in Dutch or English^[3].

Personal enforcement against board members is possible: an order subject to a penalty (last onder dwangsom) and an administrative fine (bestuurlijke boete) of up to EUR 25,000 for breaching the knowledge, update or certificate duties, and, for essential entities that fail to carry out an imposed measure in time, a court-ordered suspension of a board member^[9].

• Have the board formally approve the measures and remediation plan, and minute it.
• Make cyber a recurring agenda item and keep training certificates centrally.

Step 8: Prepare for supervision

Essential entities face proactive (ex ante) supervision; important entities are supervised reactively (ex post), typically after an incident or signal^[7]. Maximum administrative fines are EUR 10 million or 2% of worldwide annual turnover for essential entities and EUR 7 million or 1.4% for important entities, whichever is higher. Supervisors can also give binding instructions and set deadlines to remedy shortcomings.

• Build an evidence file per Cbb article that an outsider can follow, with a log of proportionality choices.
• Schedule the periodic evaluation required by Cbb article 18, at least annually.

In Secrato, Steps 4 to 8 map to one control set: a Cbb measure assessed once also serves as evidence for the related NIS2, ISO 27001 and CyFun requirements.

How this connects to other frameworks

The Cbb measures track Article 21 of NIS2 and the 2024/2690 annex, which draw heavily on ISO 27001 Annex A. A working ISMS covers most of articles 6 to 18; check board training, the meldplicht timelines and supply chain specifics separately. DORA entities follow DORA for ICT risk management and incident reporting.

Frequently asked questions

Is there a grace period for registration or compliance?

Not for registration: the NCTV states it applies from 15 August 2026. The only explicit transition we found is the two-year window for board training. Supervisors may set priorities in practice, but at the time of writing there is no general published grace period.

Do we need to report to both the CSIRT and the supervisor?

You submit once through MijnNCSC, and the report goes to both automatically. Voluntary reports go to the CSIRT only.

We are a cloud or managed service provider. Which measures apply?

Implementing Regulation (EU) 2024/2690 applies directly to you, and Cbb articles 6 to 18 do not. The other Cbw obligations, such as registration, reporting and board duties, still apply.