Cyberbeveiligingswet, the Dutch NIS2 act

Dutch Cybersecurity Act: what the law requires and what you demonstrate

An estimated 8,000-plus organisations have been covered by the Dutch Cybersecurity Act since 15 August 2026. Anyone covered has to be able to show a supervisor, auditor or customer what has been arranged. This page lays out the act article by article, with the evidence that belongs to each measure: on paper and measured from the outside.

Take the self-check: does NIS2 apply to me?Free security scan

By Edward Hasekamp, founder of Exposentry · Published on October 25, 2026 · Updated on October 26, 2026

In brief

In force since 15 August 2026, without a general transition period (Cybersecurity Decree, article 35). The act implements the European NIS2 directive (2022/2555) and repeals the Wbni (article 106). The Critical Entities Resilience Act entered into force on the same day.
Applies to essential and important entities in eighteen sectors (articles 8 and 12, annexes 1 and 2). Usually from 50 employees or an annual turnover and balance sheet total both above 10 million euros; some categories regardless of size.
Four obligations: register with the NCSC (article 44), the duty of care with ten measures (article 21), report incidents within 24 hours, 72 hours and one month (articles 25 to 30), and a board that approves the measures and is trained (article 24).
Fines up to 10 million euros or 2 percent of worldwide annual turnover for essential entities (article 80) and up to 7 million euros or 1.4 percent for important entities (article 87).
The act requires measures that fit your risks, and the evidence that they exist and work. Which product or service you use for that, it leaves open.

What is the Dutch Cybersecurity Act?

The Cyberbeveiligingswet (Cbw) is the Dutch implementation of the European NIS2 directive. That directive (2022/2555) was adopted on 14 December 2022 and should have been transposed by 17 October 2024; the Netherlands was more than a year and a half late. The Senate adopted the act on 7 July 2026, it was published in the Bulletin of Acts and Decrees on 10 July 2026 (Staatsblad 2026, 187) and entered into force on 15 August 2026. On the same day it replaced the Wbni, the implementation of the first NIS directive, which applied to vital providers, a few digital service providers and central government. NIS2 widens that to eighteen sectors with a size threshold, adds the supply chain and the accountability of the board, and attaches higher fines.

The act states its goals: managing risks to network and information systems, preventing and limiting incidents, and sharing information about incidents and vulnerabilities (article 2). The detail is in the Cybersecurity Decree (Staatsblad 2026, 189), whose articles 6 to 18 set out per measure what must be in place as a minimum. Anyone who wants to know what "appropriate and proportionate" means reads the decree alongside the act.

Three names are used interchangeably in practice: NIS2 is the European directive, the Cyberbeveiligingswet is the Dutch act that transposes it, and Cbw is that act's abbreviation. Saying "NIS2 compliant" in the Netherlands means complying with the Cyberbeveiligingswet and the Cybersecurity Decree. The Critical Entities Resilience Act (Wwke, Staatsblad 2026, 188) is a separate act on the physical resilience of about 500 critical entities; whoever falls under it is automatically essential under the Cbw (article 8(1)(i)).

Who does the act apply to?

Two criteria together decide: your sector and your size. The act divides organisations into essential and important entities; the difference is mainly in supervision, the obligations are largely the same.

Essential entities (article 8)

Organisations from annex 1 (sectors of high criticality: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management, public administration, space) that are larger than medium-sized. Regardless of size, among others: DNS service providers, top-level domain registries, qualified trust service providers, providers of public electronic communications, critical entities under the Wwke, ministries, independent administrative bodies, provinces, municipalities and water boards. Supervision is proactive: the supervisor may inspect without a specific reason.

Important entities (article 12)

Medium-sized organisations from annex 1, and medium-sized or larger organisations from annex 2 (postal and courier services, waste management, chemicals, food, manufacturing including medical devices, digital providers and research). Supervision is reactive: after an incident or a signal.

Medium-sized follows the European SME definition (Recommendation 2003/361/EC): from 50 employees, or an annual turnover and balance sheet total both above 10 million euros, counted in full-time equivalents and including partner and linked enterprises. A small company inside a larger group therefore counts with that group. Higher education institutions follow their own route: designation by the Minister of Education (articles 11 and 13); the duty of care and the board duties then apply 36 months after that designation (article 97).

If you are not covered yourself, the act often still reaches you: under article 21(3)(d) your customers must secure their supply chain, and the Cybersecurity Decree (article 10(2)) instructs them to verify whether their direct suppliers meet their requirements, and to check this periodically. That supplier assessment lands on your desk as a questionnaire, NIS2 self-assessment, contract clause or audit.

Take the self-check: does NIS2 apply to me? →For buyers: how to set up the supply-chain duty of care →

The four obligations

Register (article 44)

You register in the NCSC entity register (mijn.ncsc.nl) your name, address, contact details (e-mail addresses, IP ranges, phone numbers), sectors and the member states where you provide services. The act sets no deadline for that first registration; changes are reported within two weeks (article 44(2)). Digital infrastructure providers and digital providers also register for the European register within one month of falling under the act (article 47).

Duty of care (article 21)

Appropriate and proportionate technical, operational and organisational measures, matched to your risks, the state of the art and the costs. Paragraph 3 lists ten mandatory elements; the table below walks through them. Paragraph 4 asks you to weigh the specific vulnerabilities of direct suppliers and service providers, and the quality of their products and cybersecurity practices, including secure development procedures.

Incident reporting (articles 25 to 30)

A significant incident is one that causes or may cause serious operational disruption or financial loss, or causes considerable damage to other entities (article 25). You report it to the CSIRT and the competent authority, in practice through one portal on mijn.ncsc.nl: an early warning within 24 hours (article 26), a notification within 72 hours (article 27) and a final report no later than one month after that notification (article 29). Recipients of your service who may be affected are informed by you (article 30). Near-incidents may be reported voluntarily (article 33).

Board (article 24)

The board approves the measures (paragraph 1), demonstrably has the knowledge to assess risks and measures (paragraph 2) and holds a certificate of a training course (paragraph 5). The deadline is two years after entry into force, so 15 August 2028 (paragraph 3). A board member who fails to do so can be fined personally up to 25,000 euros (article 93).

The ten measures of article 21, and how you demonstrate them

Article 21(3) of the act names ten elements (the same as article 21(2) of the directive); the Cybersecurity Decree details them in articles 6 to 18. Each element has two kinds of evidence: the document showing you have arranged it, and, where possible, a measurement showing it also works from the outside. A questionnaire or certificate records what you declare; a measurement records what is there. Anyone who can fill both columns has an answer to the follow-up question from an auditor, supervisor or customer.

Element (Cbw art. 21(3)) and detail (Decree)	On paper	Measured from outside
a. Risk analysis and security policy (Decree art. 6 and 7)	Adopted policy, risk management method, risk acceptance criteria, risk register	No direct measurement; what is visible from outside can be recorded in the risk register.
b. Incident handling (Decree art. 8)	Procedure for detecting, analysing, responding, documenting, reporting and learning	Presence of security.txt: can a reporter reach you?
c. Business continuity and crisis management (Decree art. 9)	Backup policy, recovery plan with tested recovery time, crisis plan	Not measurable from outside.
d. Supply chain security (Decree art. 10)	Written supply chain policy you demonstrably apply (art. 10(1)), a check whether direct suppliers meet your security requirements and periodic review (art. 10(2)), contracts	A dated scan report of their own external attack surface, supplied by the supplier. Without their cooperation it stays a passive measurement from public sources. If you are the supplier, this is what your customer wants to see from you.
e. Acquisition, development and maintenance, including vulnerability handling (Decree art. 11 and 17)	Procurement and development requirements, configuration and change management, written assessment of vulnerability alerts (art. 17)	Outdated software and known vulnerabilities (CVE) on what is reachable from the internet: vulnerability management.
f. Assessing effectiveness (Decree art. 18)	Periodic evaluation, recorded in writing; internal audit, management review	A repeated measurement shows the trend per severity level compared with the previous measurement.
g. Cyber hygiene and training (Decree art. 12)	Basic practices documented, training register; for the board the certificate of Cbw art. 24(5)	Mail security (SPF, DMARC and the presence of DKIM) and security headers are publicly testable.
h. Cryptography (Decree art. 13)	Policy: when, which types, who implements, who manages the keys	TLS versions, cipher suites and certificates of the publicly reachable services.
i. Personnel, access policy and assets (Decree art. 14 to 16)	Access reviews, onboarding and offboarding process, a complete and current asset inventory (art. 16(4))	Subdomains and systems missing from the inventory; management ports and interfaces reachable from the internet.
j. Multi-factor authentication and secure communication (Cbw art. 21(3)(j); Decree art. 15(3))	Evidence of MFA rollout, periodic check of authentication means	Which login screens are reachable from the internet. Whether MFA sits behind them cannot be established from outside.

The right-hand column is deliberately modest: an external measurement only sees the outside. It replaces no line in the left-hand column. It does show where paper and reality diverge, and that is exactly the question an auditor asks. How deep the measurement goes differs per plan: the NIS2 plans also scan actively for vulnerabilities and reachable login screens.

Supervision and fines

Supervision is organised per sector, among others at the RDI (digital infrastructure and various other sectors), the IGJ (health), the ILT (transport) and DNB and the AFM (financial sector). The NCSC runs the reporting portal and is not a supervisor itself. A supervisor can have a security scan performed (articles 71 and 82), enforce an audit (articles 72 and 83), issue a binding instruction (articles 74 and 85) and apply administrative coercion (articles 75 and 86).

For breaches of the duty of care or the reporting obligation, essential entities face a fine of up to 10 million euros or 2 percent of worldwide annual turnover, whichever is higher (article 80(3)); important entities up to 7 million euros or 1.4 percent (article 87(3)). Other breaches: up to 1 million euros (same articles, under b). If an essential entity fails to comply with an order with a deadline, the supervisor can also ask the civil court to suspend board members (articles 76 and 78). That suspension does not apply to public bodies (article 79).

Where do you start?

Five steps, in this order. The first two are quick, provided your eHerkenning login is in place; the rest is ongoing work.

Determine your position: sector and size (annexes 1 and 2, articles 8 and 12), or indirectly through customers covered by the act. The self-check and the Dutch government's decision aid walk you through this.
Register your organisation in the NCSC entity register (article 44), appoint an internal contact for incident reports and set up the reporting procedure: 24 hours, 72 hours and a final report via mijn.ncsc.nl.
Record your risk analysis and policy (Decree articles 6 and 7) and test the ten elements of article 21 against the minimum requirements of Decree articles 8 to 18. The checklist in the knowledge base follows that structure.
Have the board approve the measures and schedule the training with certificate before 15 August 2028 (article 24).
Build the evidence file: per element the document and, where possible, the measurement from outside. Repeat the measurement and record the evaluation (Decree article 18).

NIS2 compliance checklist →Step-by-step plan for public-sector boards →

What the act does not do

The act requires outcomes: know your risks, take measures that fit them, report incidents, and be able to demonstrate all of it. Which product, service or certificate you use for that is up to you, within the minimum requirements of the Cybersecurity Decree. A vendor selling a scan or a tool as "legally required" is selling urgency. Why even a good scan does not make you compliant is explained in the knowledge base.

Scanning is not NIS2 compliance →

Are you a supplier to an organisation covered by the act?

Then the check from article 10 of the Cybersecurity Decree lands on your desk, usually as a questionnaire. What you attach, how the measurement works and what it costs is on its own page.

What to attach to the questionnaire →

Where Exposentry fits in

Exposentry fills the right-hand column of the table for elements b, e, f, g, h and i: a continuous vulnerability scan of what your organisation exposes to the internet, with a report that records what was there, when, and which scan module found it, carrying a digital seal and timestamp. With a subscription that report arrives every month. It runs on OpenKAT, the open-source scanner developed within the Dutch government; Edward Hasekamp, who built Exposentry, contributes to OpenKAT himself. It is one building block of your duty of care. What it measures and what it does not is in the knowledge base; what it costs is on the pricing page.

What does an attacker see of your domain? →Pricing and plans →

Frequently asked questions

What is the difference between NIS2 and the Dutch Cybersecurity Act?

NIS2 is the European directive (2022/2555). A directive does not apply directly; each member state transposes it into national law. The Cyberbeveiligingswet is that Dutch transposition, the Cybersecurity Decree its detail. Whoever has to comply with NIS2 in the Netherlands complies with the Cbw and the Decree.

Since when has the Dutch Cybersecurity Act applied?

Since 15 August 2026, without a general transition period. The Cybersecurity Decree sets that date in article 35. The earlier target date of 1 July 2026 has lapsed. Only board training has a two-year deadline, and higher education follows its own route.

How do I know whether my organisation is covered?

First check whether your activity is listed in annex 1 or 2 of the act, then your size: from 50 employees or an annual turnover and balance sheet total above 10 million euros. A few categories are covered regardless of size, such as DNS providers and public bodies. The Dutch government's decision aid and the self-check in our knowledge base walk you through these steps.

What is the Cybersecurity Decree?

The government decree accompanying the act (Staatsblad 2026, 189). It details the duty of care in minimum measures (articles 6 to 18), regulates the content of incident reports and board training, and sets the date of entry into force. For cloud, DNS, data centre and managed services, among others, the requirements of Implementing Regulation (EU) 2024/2690 apply instead (Decree article 4).

What must I report, and when?

Every significant incident: one that causes or may cause serious operational disruption or financial loss, or causes considerable damage to other entities (article 25). An early warning within 24 hours, a notification within 72 hours and a final report no later than a month later, via mijn.ncsc.nl. Failing to report falls in the highest fine category (articles 80 and 87(3)(a)).

Is a vulnerability scan mandatory under the Dutch Cybersecurity Act?

No. The act requires you to manage vulnerabilities (article 21(3)(e)), to assess and record alerts about them (Decree article 17) and to evaluate the effectiveness of your measures periodically (Decree article 18). How you do that, the act leaves open; an external measurement is a common and demonstrable way to fill it in.

What does the act mean for me as a supplier?

Your customers covered by the act must verify whether you meet their security requirements and check this periodically (Decree article 10(2)). Formally you are often outside the act yourself; in practice you receive the questionnaire. A dated report of your external attack surface is then an attachment that backs up your answers.

Who supervises?

Each sector has its own supervisor, such as the RDI, the IGJ, the ILT, DNB and the AFM. The NCSC runs the reporting portal and the register. Essential entities are supervised proactively, important entities reactively after an incident or signal.

How does the Dutch Cybersecurity Act relate to DORA, the GDPR and the Wwke?

For financial entities under DORA, DORA's requirements apply instead of the Cbw duty of care and reporting obligation (articles 22 and 31); the act itself still applies to them. The GDPR continues to apply alongside the Cbw: an incident involving personal data is also reported within 72 hours to the Dutch Data Protection Authority. The Critical Entities Resilience Act regulates the physical resilience of about 500 critical entities; under the Cbw these are automatically essential.

Is there a NIS2 certificate?

No. The act requires measures and the evidence that they work. ISO 27001, NEN 7510 and the BIO are routes to set up those measures and provide useful paper evidence. A certificate remains an auditor's snapshot; the supervisor checks for itself (articles 72 and 83). The checklist in the knowledge base walks through the ten elements with the paper evidence and the measurable signal for each.