Cyberbeveiligingswet: What NIS2 in the Netherlands Requires Now
NIS2 is law in the Netherlands. The Cyberbeveiligingswet (Cbw), the Dutch Cybersecurity Act, entered into force on 15 August 2026, together with its implementing decree. There was no general transition period. Since that date, organisations in scope must be registered, must meet the duty of care and must report significant incidents within 24 hours.
Much of what ranks for "NIS2 Netherlands" was written before the law passed and still speculates about dates. This article covers where the Cbw stands now, who falls under it, what the duty of care and the reporting obligation require, how supervision and fines work, and how the Dutch approach differs from Belgium's. It ends with a 90-day plan for a mid-market IT team of a few people.
Where the Cyberbeveiligingswet stands now
The Cbw is in force. The Tweede Kamer (House of Representatives) adopted it on 15 April 2026 and the Eerste Kamer (Senate) on 7 July 2026. The law and the Cyberbeveiligingsbesluit (Cbb, the implementing decree) were published in the Staatsblad as 2026, 187 and 2026, 189, and both apply from 15 August 2026. The Cbw replaces the older Wbni.
| Milestone | Date |
|---|---|
| EU deadline to transpose NIS2 | 17 October 2024 |
| European Commission letter of formal notice to the Netherlands (and 22 other member states) | 28 November 2024 |
| Adopted by the Tweede Kamer (dossier 36764) | 15 April 2026 |
| Adopted by the Eerste Kamer, together with the Wet weerbaarheid kritieke entiteiten (Wwke) | 7 July 2026 |
| Law and decree dated; published as Staatsblad 2026, 187 and 189 | 8 July 2026 (published 10 July) |
| Entry into force of the Cbw and the Cbb | 15 August 2026 |
| Deadline for board members to complete cybersecurity training | 15 August 2028 |
Sources: Staatsblad 2026, 187 and 189 (officielebekendmakingen.nl), Eerste Kamer dossier 36764, European Commission.
Three exceptions to "no transition period" matter. Board members get two years to complete the required training. Higher education institutions get 36 months after designation for the duty of care. Notifications and decisions under the old Wbni carry over.
The start was slow. Of the roughly 8,000 organisations the government expects in scope, fewer than 3,000 had registered by the day before entry into force, according to NCSC figures reported in Binnenlands Bestuur. The RDI, the main digital supervisor, has said it will spend the first year getting to know its sectors through letters, questionnaires and introductory meetings. That is a window to prepare, not an exemption.
Who falls under the Cbw
The Cbw applies to medium and large organisations in 18 sectors, plus some organisations regardless of size. Medium means at least 50 employees, or both turnover and balance sheet above €10 million. Large organisations in the highly critical sectors are essential entities (essentiële entiteiten); the rest in scope are important entities (belangrijke entiteiten).
The size test follows the EU definition of small and medium-sized enterprises, which counts linked and partner companies. A 65-person company owned by a larger group can therefore be classified as large. Check the group structure before you assume you are out of scope.
| Classification | Who | Supervision |
|---|---|---|
| Essentiële entiteit (essential) | Large organisations (250+ employees, or turnover above €50 million and balance sheet above €43 million) in highly critical sectors such as energy, transport, banking, health, drinking water, digital infrastructure, ICT service management and government; plus size-independent cases such as qualified trust service providers, TLD registries, DNS providers and critical entities under the Wwke | Proactive and reactive |
| Belangrijke entiteit (important) | Medium organisations in the highly critical sectors, and medium or large organisations in the other critical sectors, such as postal services, waste, chemicals, food, manufacturing, digital providers and research | Mainly after the fact |
| Supplier to an entity in scope | Not regulated directly, but bound by customer contracts under the supply chain measure | Contractual, through customers |
Source: Cyberbeveiligingswet (Staatsblad 2026, 187), articles 8 and 12; EU Recommendation 2003/361/EC.
The third row is where most Dutch mid-market companies will feel the law first. Entities in scope must manage the security of their supply chain, and they do that through questionnaires, contract clauses and audit rights. A 120-person software supplier or logistics firm can be out of scope legally and still need to show multi-factor authentication, access control and an incident process to keep a customer. The guide to NIS2 supply chain obligations covers what those requests usually contain.
Registration (registratieplicht)
Organisations in scope had to be registered from 15 August 2026, through MijnNCSC (mijn.ncsc.nl) with eHerkenning at level EH2+. The law asks for your name, address and contact details including e-mail addresses, phone numbers and public IP ranges, your sectors and subsectors, and the EU countries where you provide services. The decree adds your KvK number, whether you are essential or important, and your domain names. Changes must be reported within two weeks.
The duty of care (zorgplicht): what you must do
The zorgplicht, or duty of care, in article 21 of the Cbw requires appropriate and proportionate technical, operational and organisational measures to manage the risks to your network and information systems. It lists ten areas that every organisation in scope must cover. The Cbb works them out in more detail.
- Risk analysis and information security policy
- Incident handling
- Business continuity, backup management and crisis management
- Supply chain security
- Security in acquisition, development and maintenance, including vulnerability handling
- Assessing whether the measures work
- Basic cyber hygiene and training
- Cryptography and encryption
- Personnel security, access control and asset management
- Multi-factor authentication, secured communication and emergency communication
The Cbw does not prescribe one standard. ISO 27001, the BIO 2.0 for government and NEN 7510 for healthcare can all serve as structure. The Auditdienst Rijk and NOREA, the Dutch body for IT auditors, published a Cbw (NIS2) Control Framework that maps these standards to the ten areas, now with a healthcare module and an English version.
A certificate is not proof of compliance. The RDI says so directly in its FAQ: "Nee, het voldoen aan een eigen normenkader betekent niet dat een organisatie aan de zorgplicht voldoet." In English: meeting your own standards framework does not mean you meet the duty of care. Its supervision page adds: "Ook mogen we ter plekke uw systemen inkijken." The supervisor may look at your systems on site.
That second sentence is the gap in most Dutch guidance. Government pages list the measures. Law firms explain the fines. Neither says what an inspector will look at when they sit down next to your administrator. In practice the questions are concrete: does active access match the current organisation chart, is multi-factor authentication enforced everywhere it should be, how do administrators and suppliers connect remotely, can a compromised laptop reach the servers, and are the logs there to show what happened. The mapping of NIS2 measures to technical controls goes through these one by one.
The reporting obligation (meldplicht)
Under the meldplicht, or reporting obligation, a significant incident must be reported in three steps through MijnNCSC: an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours, and a final report one month after the notification. One report reaches both your sector's CSIRT and your supervisor.
| Step | Dutch term | Deadline | Contents |
|---|---|---|---|
| Early warning | Vroegtijdige waarschuwing | Within 24 hours of awareness | Whether malicious activity is suspected and whether there may be cross-border impact |
| Incident notification | Incidentmelding | Within 72 hours of awareness | Update of the early warning, first assessment of severity and impact, indicators of compromise where available |
| Interim report | Tussentijds verslag | On request | Status update for the CSIRT or supervisor |
| Final report | Eindverslag | One month after the notification | Detailed description, likely root cause, measures taken, cross-border impact; a progress report if the incident is still ongoing |
Source: Cyberbeveiligingswet, articles 26 to 29; NCSC, Meldplicht.
What counts as significant is set per sector. The Cbb lets each responsible ministry set thresholds in a ministeriële regeling (ministerial regulation), and several have been published, including for economic affairs, government, healthcare and infrastructure. For central government, for example, a service disruption of four hours or more counts as significant. Find the regulation for your sector and write its thresholds into your incident procedure.
Your IT provider can help triage and draft, but the report is filed under your organisation's identity and the responsibility stays with you. The NIS2 incident reporting guide has templates for each step.
Supervision, fines and management accountability
Supervision is split across existing regulators by sector. The RDI covers most digital sectors and manufacturing; the IGJ health, the ILT transport, water and chemicals, the NVWA food, and DNB and the AFM finance. Fines reach €10 million or 2% of worldwide turnover for essential entities, and board members can be fined personally.
Which supervisor is yours
The Netherlands chose a sectoral model, coordinated by the NCTV. The doorverwijsboom, a referral tree published on ncsc.nl, tells you which supervisor and which CSIRT apply to your sector.
- RDI (Rijksinspectie Digitale Infrastructuur): energy, digital infrastructure, ICT service management, government (except water boards), space, postal and courier services, manufacturing (except medical devices) and digital providers.
- IGJ: healthcare and manufacturers of medical devices.
- ILT: transport, drinking water, waste water, waste, chemicals and water boards.
- NVWA: food.
- DNB and AFM: finance, where DORA applies.
Essential entities face proactive supervision: inspections and audits without a prior incident. For important entities, supervision is mainly after the fact, triggered by an incident, a report or a tip. Once an investigation starts, the powers are the same.
Fines
| Who | Breach | Maximum | Cbw article |
|---|---|---|---|
| Essential entity | Duty of care and reporting obligation | €10 million or 2% of worldwide annual turnover, whichever is higher | 80(3)(a) |
| Important entity | Duty of care and reporting obligation | €7 million or 1.4% of worldwide annual turnover, whichever is higher | 87(3)(a) |
| Essential or important entity | Other breaches, such as registration | €1 million | 80(3)(b), 87(3)(b) |
| Individual board member | Board duties in article 24, including training | €25,000, plus a possible order subject to penalty payments (last onder dwangsom) | 92, 93 |
Source: Cyberbeveiligingswet, Staatsblad 2026, 187.
The board's own obligations
Article 24 puts cybersecurity with the leidinggevend orgaan, the management body. The board approves the risk management measures, oversees their implementation and can be held to account for them. Board members must have sufficient knowledge and skills, backed by a training certificate, within two years of entry into force: by 15 August 2028, or two years after appointment for later board members. The training does not have to make directors engineers. It has to let them judge risks and the measures proposed to them.
The Netherlands versus Belgium
Belgium transposed NIS2 on time, with one national framework and a certification route. The Netherlands transposed it almost two years late, with sector supervisors and no prescribed framework. For companies active in both countries, the obligations overlap but the evidence each supervisor expects differs.
| Netherlands (Cbw) | Belgium (NIS2 law) | |
|---|---|---|
| Law | Cyberbeveiligingswet and Cyberbeveiligingsbesluit, Staatsblad 2026, 187 and 189 | Law of 26 April 2024 and Royal Decree of 9 June 2024 |
| In force | 15 August 2026 | 18 October 2024 |
| Coordination | NCTV; NCSC for registration and reporting | Centre for Cybersecurity Belgium (CCB), national authority and CSIRT |
| Supervision | Sector supervisors (RDI, IGJ, ILT, NVWA, DNB, AFM and others) | CCB, with sectoral authorities for some sectors |
| Framework | Open: ten areas, any suitable standard; ADR/NOREA control framework as audit baseline | CyberFundamentals (CyFun) or ISO 27001 |
| Proof | Supervisor inspects running systems; a certificate is not proof of compliance | Certification gives a presumption of conformity; essential entities must certify by April 2027 |
| Registration | MijnNCSC with eHerkenning, from 15 August 2026 | Safeonweb@work, by 18 March 2025 |
| Reporting | 24 hours, 72 hours, one month, via MijnNCSC | 24 hours, 72 hours, one month, via the CCB |
| Board training | Certificate within two years; personal fine up to €25,000 | Training required for the management body |
Sources: Staatsblad 2026, 187 and 189; NCSC; Belgian Official Gazette of 17 May 2024; CCB.
The practical difference is the question you have to answer. In Belgium, it is "which CyFun level, and are we certified by the deadline", covered in CyFun Essential and the 2027 milestone. In the Netherlands, it is "can we show an inspector that these measures actually run". A company in both countries can use one control set for both, which is where CyFun versus ISO 27001 helps. On enforcement in Belgium, see what NIS2 fines in Belgium look like.
What to do in the next 90 days
A team of three to ten people cannot build a full programme in three months. It can close the gaps a supervisor or customer will see first.
- Weeks 1 to 2: scope and registration. Confirm your classification, including group companies. Register in MijnNCSC if you have not, and find your supervisor and CSIRT in the doorverwijsboom.
- Weeks 2 to 4: incident readiness. Find your sector's ministerial regulation, write its thresholds into an incident procedure, and decide who files the 24-hour warning, including at weekends.
- Weeks 3 to 8: access. Enforce multi-factor authentication on every remote and administrative entry point. Review who has access to what, and remove what does not match the organisation chart. Replace broad network access for staff and suppliers with access per application.
- Weeks 6 to 10: evidence. Make sure access, authentication and administrative actions are logged centrally with reliable time stamps, and that you can retrieve them.
- Weeks 8 to 12: suppliers and board. Tier your suppliers by the access they have, start with the ones that reach your systems remotely, and put board training on the calendar well before August 2028.
The NIS2 plan for mid-market teams covers the longer programme once these basics are in place.
Where technology helps, and where it cannot
Six of the ten areas are about governance, people and process: risk analysis, continuity, supplier management, assessment, training and board accountability. No product does those for you. A tool that claims to make you Cbw-compliant is selling a document.
Technology matters for the measures an inspector will test on screen: access control, multi-factor authentication, network separation, secure remote access for staff and suppliers, and the logs that prove all of it. Those are also the measures that most often fail in mid-market networks, because they grew around a VPN that gives every user the whole network.
This is the part a platform can make simpler. Jimber is a European SASE platform that combines zero trust network access and network isolation with web security and firewalling, with data handled in the EU. It gives staff and suppliers access to specific applications instead of the network, and records who reached what. That helps with several technical measures and with the evidence for them. It does not replace your risk analysis, your incident procedure or your board's decisions. If you want to see what that looks like for your network, book a demo.
IT service providers advising Dutch customers on the Cbw can also look at Jimber's partner programme.
The sceptical director's view
A Dutch managing director with limited budget will raise three fair objections.
"The supervisors cannot inspect 8,000 organisations." Correct, and the RDI has said its first year is about getting to know the sectors. For an important entity, an unannounced inspection is unlikely. But supervision of important entities is triggered by incidents, and the 24-hour report is what triggers it. After a ransomware incident, the first questions will be about multi-factor authentication, remote access and segmentation. That is when missing measures turn into fines.
"Our customers send questionnaires, but they buy on price." Sometimes, for now. But the customer's own board carries the supply chain duty and can be fined for it, so procurement teams are turning security answers into entry criteria. A supplier that cannot show basic controls risks dropping off the shortlist before price is discussed.
"We run on Microsoft 365 and Entra ID; that is secure." The platform is secure; your configuration is your responsibility. Who has admin rights, how suppliers connect, whether a stolen session reaches more than one application: those are customer settings, and they are exactly what an inspector looks at. The cloud helps a lot. It does not tick the box by itself.
Conclusion
The Cyberbeveiligingswet has applied since 15 August 2026. Registration, the duty of care and the 24-hour reporting obligation apply now; board training has until August 2028. Unlike Belgium, the Netherlands does not hand you a framework to certify against. The supervisor wants to see that the measures run, and your customers increasingly want the same.
Start with scope, registration and incident readiness, then fix access and evidence. If you want to discuss how access control and network isolation can be shown in practice, book a demo. If you would rather test it yourself first, Try Free.
Frequently asked questions
When did the Cyberbeveiligingswet enter into force?
On 15 August 2026, together with the Cyberbeveiligingsbesluit. There is no general transition period: registration, the duty of care and the reporting obligation apply from that date. Board members have until 15 August 2028 to complete the required training.
What is the difference between NIS2 and the Cyberbeveiligingswet?
NIS2 is an EU directive (2022/2555) that member states must turn into national law. The Cyberbeveiligingswet is the Dutch law that does so. It replaces the Wbni and sets the Dutch details, such as the supervisors, the fines and the registration through MijnNCSC.
Who falls under the Cyberbeveiligingswet?
Medium and large organisations in 18 sectors, roughly 8,000 in total. Medium means at least 50 employees, or turnover and balance sheet both above €10 million, counting group companies. Some organisations, such as DNS providers and qualified trust service providers, are in scope regardless of size.
What does the duty of care (zorgplicht) require?
Appropriate and proportionate measures in ten areas: risk analysis, incident handling, continuity, supply chain security, secure development and vulnerability handling, effectiveness checks, cyber hygiene and training, cryptography, access control and asset management, and multi-factor authentication with secured communication.
How quickly must an incident be reported under the Cbw?
A significant incident needs an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours and a final report one month after the notification, all through MijnNCSC. Which incidents count as significant is set per sector in ministerial regulations.
How high are the fines under the Cyberbeveiligingswet?
Up to €10 million or 2% of worldwide turnover for essential entities, and €7 million or 1.4% for important entities, for breaches of the duty of care or reporting obligation. Other breaches carry up to €1 million. Board members can be fined up to €25,000 personally.
Is ISO 27001 certification enough to comply with the Cbw?
No. The RDI states that meeting your own standards framework does not mean you meet the duty of care. ISO 27001 is a useful structure, but supervisors can inspect your systems on site and will look at how the measures actually work.
Where do we register for the Cyberbeveiligingswet?
In MijnNCSC (mijn.ncsc.nl), using eHerkenning at level EH2+ linked to your KvK registration. You provide contact details, public IP ranges, domain names, sectors and the EU countries you serve, and report changes within two weeks.
Can our IT service provider take over the reporting obligation?
It can help triage the incident and draft the reports, but the report is filed under your organisation and the legal responsibility stays with your board. Agree in advance who does what within the 24-hour window.
How does the Dutch approach differ from Belgium's?
Belgium has one national authority, the CCB, and a certification route through CyFun or ISO 27001. The Netherlands uses sector supervisors, prescribes no framework and inspects how measures work. Companies in both countries register and report in both systems.