Since 15 August 2026, the Cyberbeveiligingswet (Cbw), the Dutch Cyber Security Act, has been in force in the Netherlands. It is how the Netherlands implements the EU NIS2 directive, and it replaces the old Network and Information Systems Security Act (Wbni). According to the Dutch government, more than 8,000 organisations now have new obligations. There is no transition period: if the law applies to you, it applies now.
This article explains in plain language who the law covers, what it requires, and why it also affects companies that are not covered themselves.
Who does the Cbw apply to?
The law covers organisations in 18 sectors that are considered essential to society. These include energy, drinking water, transport, healthcare, digital infrastructure, ICT service management, public administration, postal and courier services, waste management, chemicals, food and manufacturing.
Size matters too. As a rule of thumb, you are covered if you operate in one of these sectors and you have:
- 50 or more employees, or
- more than €10 million in annual turnover and balance sheet total.
Smaller companies are generally out of scope, with exceptions: government bodies, DNS service providers, top-level domain registries and trust service providers are always covered, whatever their size. A minister can also designate a smaller company that plays a critical role; you would be notified if that happens.
Essential or important?
The law has two categories:
- Essential entities: mostly large organisations (250+ employees, or more than €50 million turnover and €43 million balance sheet) in the most critical sectors. Supervision is proactive: the regulator can inspect you even if nothing has gone wrong.
- Important entities: medium-sized organisations in those sectors, plus medium and large organisations in the other sectors. Supervision is reactive: it follows an incident or a sign that something is wrong.
The duties are largely the same for both. The difference lies mainly in supervision and maximum fines.
Not sure? The NIS2 self-assessment tool on regelhulpenvoorbedrijven.nl gives an indication in a few minutes. It is your own responsibility to establish whether the law applies.
Not covered? Your customers will still ask
This is the point many small and mid-sized companies miss. Organisations under the Cbw must also secure their supply chain. If you supply a hospital, an energy company, a municipality or a logistics firm, expect them to ask you to prove your security is in order: in contracts, questionnaires or audits.
The Dutch Chamber of Commerce (KVK) lists what customers ask for in practice: two-factor authentication on all accounts, regular updates and backups, a plan for when things go wrong, prompt incident notifications, and staff training. Companies that can show this win contracts. Those that can't, lose them.
The four duties
1. Registration
Register your organisation in the NCSC entity register at mijn.ncsc.nl. You need eHerkenning level 3 (or higher). You provide your company details, sector, the EU countries you operate in, contact details and, where relevant, your IP ranges. If anything changes, such as a merger or new IP addresses, you have two weeks to update it.
2. Duty of care
Assess your risks and take appropriate technical and organisational measures. The law lists ten areas you must cover at a minimum, from risk analysis and incident handling to backups, access control and multi-factor authentication. "Appropriate" means proportionate to your risks and size. Our NIS2 checklist for small and mid-sized businesses turns the ten areas into practical steps.
3. Incident reporting
You report a significant incident in stages: an early warning within 24 hours, a notification within 72 hours and a final report within one month. Reports go to your sector's CSIRT (often the NCSC) and the regulator, and in some cases you must inform your customers too. See NIS2 incident reporting: 24 hours, 72 hours, one month.
4. The board is accountable
Under the Cbw, cybersecurity is explicitly a board responsibility. The board approves the measures and oversees their implementation, and board members must have sufficient knowledge themselves and follow suitable training. In cases of serious negligence, board members can be held personally liable.
Supervision and fines
Each sector has its own regulator. For digital infrastructure and ICT services it is the Dutch Authority for Digital Infrastructure (RDI); for transport it is the Human Environment and Transport Inspectorate (ILT). Regulators can order scans and audits, issue binding instructions, impose penalty payments and levy fines. The EU NIS2 directive requires maximum fines of at least €10 million or 2% of worldwide annual turnover for essential entities, and at least €7 million or 1.4% for important entities (whichever is higher).
What to do now
- Establish whether you are covered. Do the self-assessment and record your conclusion, even if it's "no".
- Register at mijn.ncsc.nl if you are covered. Arrange eHerkenning level 3 if you don't have it yet.
- Do a baseline. Go through the ten measures and note what exists and what's missing.
- Set up your reporting process. Who decides whether something is significant, who reports, and where are the contact details?
- Put it on the board agenda and schedule the board training.
- Prepare for customer questions, even if you are out of scope yourself.
How OZAG Security helps
OZAG Security is built for companies without their own 24/7 security team. The platform watches your systems around the clock, links scattered alerts into real incidents so you know what's happening well within 24 hours, and produces NIS2 reports you can show to your board, regulator or customers. Try it free for 14 days, no credit card needed.
This article is general information, not legal advice. If you are unsure about your situation, consult the NCSC or a lawyer.