The duty of care is the heart of the Cyberbeveiligingswet (Cbw), the Dutch NIS2 law. You must manage your risks with "appropriate technical and organisational measures", and the law lists ten areas you must cover at a minimum.
That sounds big, but "appropriate" means proportionate to your risks and size. A 60-person company doesn't need to do what a bank does. Below, for each measure: what it means in practice and where to start tomorrow.
Even if you are not covered yourself, this list is useful: these are exactly the things your customers will ask about if they are covered.
1. Risk analysis and security policy
What it means: you know which systems and data matter, which threats apply to them, and you have written down how you deal with them.
Start with: a list of your key systems (website, email, accounting, customer data, production) with, for each one: who owns it, what happens if it's down for a day, and what is exposed to the internet. Two pages of policy is enough to start.
2. Incident handling
What it means: you notice an incident, you know who does what, and you can report within 24 hours.
Start with: a one-page incident plan: who is the first point of contact, who decides, who reports to the NCSC, and who calls customers. Make sure you can see what's happening: without logging and monitoring, you often notice an attack only when it's too late.
3. Business continuity, backups and crisis management
What it means: you can keep going if systems fail or are encrypted, and you can recover.
Start with: the 3-2-1 rule for backups (three copies, two types of storage, one offline or immutable). Most importantly, test a restore. A backup you have never restored is a hope, not a plan.
4. Supply chain security
What it means: you also look at the security of your suppliers, such as your IT provider, hosting company and software vendors.
Start with: a list of suppliers with access to your systems or data. Ask the most important ones what security they have (ISO 27001, for example) and put agreements on security and incident notification in your contracts.
5. Secure acquisition, development and maintenance
What it means: security is part of buying and building systems, and you keep them up to date. This includes handling vulnerabilities and giving others a way to report vulnerabilities to you.
Start with: a fixed patch rhythm, with priority for vulnerabilities that are being actively exploited. Publish a security.txt file or a responsible disclosure page so researchers know where to go.
6. Assessing whether your measures work
What it means: you regularly check that the measures actually do what they should.
Start with: a few measurable points you review every quarter, such as the percentage of accounts with MFA, the number of open critical vulnerabilities, and the date of the last restore test. Record what you reviewed: that is your evidence for regulators and customers.
7. Basic cyber hygiene and training
What it means: everyone knows the basics, and the board follows suitable training (mandatory under the Cbw).
Start with: a short annual training on phishing, passwords and reporting anything suspicious. Make reporting easy and safe: someone who clicked a bad link should feel able to say so right away.
8. Cryptography and encryption
What it means: you have a policy for encrypting data in transit and, where needed, at rest.
Start with: check that all your websites and services use HTTPS with a current TLS version, that certificates don't expire, and that laptops are encrypted (BitLocker or FileVault).
9. Personnel, access control and asset management
What it means: you know which devices and accounts exist, who has access to what, and you handle joiners and leavers properly.
Start with: an up-to-date list of devices and accounts, and a fixed checklist for leavers (accounts disabled, badges returned, shared passwords changed). Give people only the access they need.
10. Multi-factor authentication and secure communication
What it means: where appropriate, you use MFA, secured communications and a secure emergency communication channel.
Start with: MFA on email, admin accounts and remote access (VPN, RDP). It's the measure with the biggest return per euro. Also agree how you'll communicate if email itself is compromised, for example a phone list on paper.
Short on time? Start here
Do these five first. They cover most attacks on small and mid-sized businesses:
- MFA on email and all admin and remote access.
- Backups following 3-2-1, with a tested restore.
- Patching, prioritising actively exploited vulnerabilities.
- Visibility: logging, monitoring and alerts on suspicious activity.
- A one-page incident plan, including who reports within 24 hours.
How OZAG Security helps
OZAG Security takes part of this list off your hands. The platform detects attacks and suspicious activity (measure 2), tracks which of your systems have actively exploited vulnerabilities (5), checks your websites for expiring certificates, outdated TLS and missing security headers (8), spots risky services such as RDP exposed to the internet (9 and 10), and produces NIS2 reports that show what you've done (6). Try it free for 14 days.
Read also: Does the Dutch Cyber Security Act apply to you?
This article is general information, not legal advice.