NIS2 in the Netherlands: What the Cyberbeveiligingswet (Cbw) Means Now It Is in Force

The Netherlands' NIS2 law, the Cyberbeveiligingswet, took effect on 15 August 2026. Here is what it requires, who supervises it and where to start if you have not yet registered.

After several postponements, the Netherlands’ implementation of the NIS2 Directive is finally live. The Senate (Eerste Kamer) approved the Cyberbeveiligingswet (Cbw) on 7 July 2026, and it entered into force on 15 August 2026, together with the Wet weerbaarheid kritieke entiteiten (Wwke), which implements the EU CER Directive ^[1][2]. The Cbw replaces the earlier Wet beveiliging netwerk- en informatiesystemen (Wbni) ^[1][3].

Two months on, many organisations are still working out whether they are in scope. Here is what the law requires.

Who falls under the Cbw?

The government estimates that more than 8,000 organisations across 18 sectors are covered, including energy, drinking water, digital infrastructure, healthcare, public administration and transport ^[1]. There is no designation letter: organisations must assess for themselves whether the law applies ^[1][2].

The NCSC describes a two-step test ^[3]:

1. Sector and entity type. Does your organisation provide a type of service listed in Annex 1 (sectors of high criticality) or Annex 2 (other critical sectors)?
2. Size. Do you meet the size thresholds? In line with the directive, these are generally medium-sized organisations (50 or more employees, or above the EU turnover and balance-sheet thresholds) and large ones ^[7][9].

Entities that qualify are classed as either essential or important. Some are in scope regardless of size, such as qualified trust service providers, top-level domain registries and domain name registration services. Organisations designated as critical under the Wwke are automatically essential ^[4].

International group structures find this especially hard, according to press reports ^[11]. The RDI points organisations to a government self-assessment tool as a starting point ^[10].

Under the Cbw, cyber risk is no longer something the board delegates and forgets: it approves the measures, oversees them and answers for them.

Registration with the NCSC

Registration in the national entity register (entiteitenregister) has been mandatory since 15 August 2026 ^[1]. It is done through the NCSC portal, mijn.ncsc.nl, and the NCSC estimates that it takes about ten minutes if you have prepared ^[4]. You will need ^[4]:

• organisation name and address;
• up-to-date contact details, including email addresses, phone numbers and IP ranges;
• sector and subsector;
• the EU member states in which you provide services.

Registering also gives you access to the services of your sectoral CSIRT ^[1][3].

Uncertain: we found no separate statutory grace period for registration in official sources. Treat the obligation as already applicable. According to Het Financieele Dagblad, as reported in August, roughly 3,200 of the estimated 8,000-plus organisations had registered at that point ^[11]. That figure will have changed since.

The duty of care (zorgplicht)

Essential and important entities must take appropriate and proportionate technical, operational and organisational measures to protect their network and information systems, and the physical environment of those systems ^[5]. Proportionality depends on risk exposure, size, the likelihood of incidents and their potential societal and economic impact ^[5].

The NCSC sets out ten minimum measures ^[5]:

1. risk analysis;
2. personnel security, access control and asset management;
3. business continuity;
4. incident handling, including an incident response plan;
5. basic cyber hygiene and awareness training;
6. policies on the security of network and information systems;
7. supply chain security;
8. a cryptography and encryption policy;
9. multi-factor or other secure authentication;
10. ongoing assessment of how effective the measures are.

The Cyberbeveiligingsbesluit (Cbb), the implementing decree published in the Staatsblad in July 2026, sets out these obligations in more detail. It covers the duty of care, registration, board training and incident reporting ^[8][13]. Sector-specific ministerial regulations add further detail on top of the decree ^[2][13].

Incident reporting (meldplicht)

A significant incident is one that can cause serious operational disruption or financial loss to the organisation, or considerable material or immaterial damage to others ^[6]. The concrete thresholds are set per sector in ministerial regulations, so check the one that applies to you ^[2].

The reporting sequence is ^[6][9]:

Stage	Deadline	Content
Early warning	Without undue delay, within 24 hours of becoming aware	Whether malicious action is suspected and whether there may be cross-border impact
Incident notification	Within 72 hours	Initial assessment of severity and impact
Intermediate update	On request	Status update for the CSIRT or supervisor
Final report	Within one month	Root cause, impact and mitigation; a progress report if the incident is still ongoing

All reports go through one central reporting point at mijn.ncsc.nl, which forwards them to both the sectoral CSIRT and the competent supervisor ^[6]. Some entities face tighter timelines. According to the NCSC, entities also covered by DORA or the Dutch grid cybersecurity code (Netcode) must give an early warning within 4 hours, and trust service providers have a 24-hour notification deadline ^[6]. Voluntary reports of non-significant incidents and near misses go only to the CSIRT, not to the supervisor ^[6].

Management accountability

The Cbw makes cyber risk a board matter. The management body must ^[5][1]:

• approve the cyber risk management measures;
• oversee how they are implemented;
• complete training so that it can assess cyber risks itself, and make sure training is offered to staff;
• bear ultimate responsibility, and can be held liable for non-compliance.

For essential entities, supervisors can ask for a board member to be temporarily suspended. Board members of both essential and important entities can also face periodic penalty payments and administrative fines ^[7]. It is therefore worth recording board decisions on cyber risk properly. Weak documentation is itself a possible enforcement trigger ^[13].

Supervision and fines

Supervision is organised by sector. Ten supervisors share the task, including the RDI, ILT, DNB, AFM, IGJ, NVWA and the Dutch Data Protection Authority (AP). They coordinate through the Samenwerkend Toezicht Digitale Weerbaarheid (STDW) ^[12][13]. The RDI supervises sectors including energy, digital infrastructure, ICT service management, public administration, space, postal services, research and manufacturing ^[10].

The intensity of supervision depends on classification ^[3][7]:

• Essential entities face proactive supervision, so inspections can take place without any prior indication of a breach. The tools include audits, security scans, binding instructions, orders backed by penalty payments, public disclosure, suspension requests and administrative fines.
• Important entities face mainly reactive supervision, typically triggered by an incident or a signal, and most of the same enforcement tools apply.

Fines: under NIS2, member states must provide maximum fines of at least €10 million or 2% of worldwide annual turnover (whichever is higher) for essential entities, and €7 million or 1.4% for important entities ^[9]. Uncertain: we could not verify the exact Dutch maxima against the final Cbw text in the official sources we reviewed. Check the published law before relying on specific figures.

Practical first steps

1. Confirm your status. Work through the annexes and size thresholds, or use the self-assessment tool, for each legal entity in your group. Record the reasoning ^[3][10].
2. Register now at mijn.ncsc.nl if you are in scope, and keep your contact details and IP ranges up to date ^[4].
3. Identify your supervisor and sectoral regulation, including the incident thresholds that apply to you ^[2][12].
4. Run a gap analysis against the ten duty-of-care measures and the Cbb. The NCSC also points to the Cbw Control Framework and the RDI NIS2 Quickscan ^[3][5].
5. Rehearse reporting. Map who decides that an incident is significant and who submits the 24-hour early warning. If DORA also applies to you, plan for the 4-hour deadline ^[6].
6. Brief and train the board. Schedule training and set up a regular reporting line, and minute the board’s approvals ^[5].
7. Review your supply chain, starting with critical ICT providers ^[5].

Secrato helps organisations manage frameworks such as NIS2, DORA and ISO/IEC 27001 in one EU-hosted platform, with shared controls, evidence and audit trails.