What is the Cybersecurity Act (Cyberbeveiligingswet)?
The Cybersecurity Act (Cyberbeveiligingswet, Cbw) is the Dutch law that implements the European NIS2 directive (Network and Information Security Directive 2) and requires essential and important entities to register, take appropriate cybersecurity measures and report significant cyber incidents. It applies to more than 8,000 organisations across eighteen sectors, from energy and drinking water to chemicals and manufacturing. The Cbw replaces the Dutch Network and Information Systems Security Act (Wbni) and explicitly covers OT environments such as process control and SCADA.
This page is about the Dutch national law. It is not the same as the EU Cybersecurity Act, Regulation (EU) 2019/881, which gave the EU agency ENISA a permanent mandate and created the European cybersecurity certification framework for ICT products and services.
🗓️ Since when does the Cybersecurity Act apply?
The Cyberbeveiligingswet and its implementing decree, the Cyberbeveiligingsbesluit, entered into force on 15 August 2026. From that date the duty of care, the incident reporting obligation and the registration obligation apply immediately, without a general transition period. The Act replaces the Wbni, which had implemented the first NIS directive in the Netherlands since November 2018.
| Date | Milestone |
|---|---|
| 16 January 2023 | The NIS2 directive enters into force |
| 17 October 2024 | Deadline for transposition into national law |
| 7 July 2026 | The Dutch Senate (Eerste Kamer) adopts the Cyberbeveiligingswet |
| 15 August 2026 | Cyberbeveiligingswet, Cyberbeveiligingsbesluit and Wwke enter into force; the Wbni lapses |
The Netherlands therefore transposed NIS2 almost two years late. Only higher education institutions get a transition period: the Minister of Education, Culture and Science designates them specifically, and they get three extra years to meet the duty of care.
🎯 What is the purpose of the Cybersecurity Act?
- Implementing NIS2 - the Netherlands adopts the European minimum requirements for digital resilience largely one-to-one
- Broader scope than the Wbni - where the Wbni only covered designated operators of essential services, sector and size now determine who is in scope
- A higher, uniform security level - the same requirements for IT and OT systems that are needed to deliver the service
- Faster detection and reporting - so that the NCSC and supervisors gain early visibility of attacks and can warn other organisations
- Board accountability - cybersecurity becomes a board responsibility, not just an IT task
🧱 Who does the Cybersecurity Act apply to?
Whether your organisation falls under the Cbw depends on two questions: are you in a sector listed in Annex I or II of NIS2, and are you at least a medium-sized enterprise? Medium-sized means 50 or more employees, or an annual turnover and balance sheet total each above 10 million euros. This is known as the size-cap rule. The Act applies to organisations established in the Netherlands. A full step-by-step scope check, including group structures and exceptions, is in does your organisation fall under the Cbw?
| Annex | Sectors |
|---|---|
| I - sectors of high criticality (11) | Energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, space |
| II - other critical sectors (7) | Postal and courier services, waste management, chemicals, food, manufacturing, digital providers, research |
Within those sectors the Act distinguishes two categories. The obligations are the same; the difference lies in supervision and the maximum fine.
| Feature | Essential entity | Important entity |
|---|---|---|
| Who | Large organisations in Annex I, critical entities under the Wwke and some providers regardless of size (such as DNS services) | Medium-sized organisations in Annex I and medium-sized and large organisations in Annex II |
| Supervision | Proactive (ex ante) and reactive (ex post) | Reactive only, after indications or incidents |
| Maximum fine | 10 million euros or 2% of worldwide annual turnover, whichever is higher | 7 million euros or 1.4% of worldwide annual turnover, whichever is higher |
🔐 What obligations does the Cybersecurity Act impose?
The Cbw has four main obligations.
Duty of care
Organisations identify the risks to their network and information systems and take appropriate and proportionate technical, operational and organisational measures. The Cyberbeveiligingsbesluit (articles 5 to 19) elaborates this: a documented, adopted security policy, risk management with a risk analysis method and risk acceptance criteria, and the ten measure categories from NIS2. These include incident handling, business continuity and backups, supply chain security and supply chain risks, vulnerability management, cyber hygiene and training, cryptography, access control and multi-factor authentication. An Information Security Management System (ISMS) and technical measures such as firewalls, IDS and SIEM help make that implementation demonstrable.
Reporting obligation
You report a significant incident in stages to the CSIRT and the supervisor, through the NCSC reporting portal. For most sectors the NCSC is the CSIRT; for the water boards it is CERT-WM. The health minister intends to designate Z-CERT for healthcare; until then the NCSC fills that role. Thresholds, the content of each report and an OT example are covered in incident reporting under the Cbw.
| Deadline | Report | Content |
|---|---|---|
| Within 24 hours | Early warning | Suspicion of malicious activity and possible cross-border impact |
| Within 72 hours | Incident notification | Initial assessment of severity and impact, indicators of compromise |
| Within 1 month | Final report | Detailed description, root cause, measures taken and impact |
Registration obligation
Organisations register themselves, as soon as possible, in the national entity register through MijnNCSC. Failing to register, or registering incorrectly, can lead to an order subject to a penalty payment or a fine.
Board accountability
The board approves the measures and oversees their implementation. Every board member follows training on cyber risks, risk management processes and risk assessment methods, and must be able to show a certificate. Supervisory measures can also target individual directors; at essential entities, a director can be temporarily suspended for serious breaches. This makes cybersecurity a permanent part of governance.
⚖️ Who supervises the Cybersecurity Act?
Supervision is divided by sector among several supervisors, with the Dutch Authority for Digital Infrastructure (RDI) as the coordinating supervisor. The NCSC acts as the CSIRT for most sectors.
| Supervisor | Sectors |
|---|---|
| RDI (coordinating) | Energy, digital infrastructure, ICT service management, public administration, space, postal and courier services, manufacturing (except medical), digital providers, research |
| ILT | Transport, drinking water, wastewater, waste management, chemicals |
| IGJ | Healthcare and medical devices |
| NVWA | Food |
| DNB / AFM | Banking and financial market infrastructure |
| ANVS | Nuclear installations |
Supervisors can carry out audits, inspections and scans, issue binding instructions, and impose penalty payments and fines. How often and how intensively they inspect depends on the organisation’s risk profile.
🔄 How does the Cbw relate to the Wwke, BIO2 and other legislation?
- Wwke - the Dutch Critical Entities Resilience Act entered into force on the same day and covers the physical and organisational resilience of critical infrastructure; critical entities are always essential under the Cbw
- BIO / BIO2 - for government organisations, the Baseline Information Security for Government 2 is linked to the duty of care through the government cybersecurity regulation
- ISO 27001 - the Cyberbeveiligingsbesluit uses ISO 27001 and NEN 7510 as a starting point, but does not require certification
- Cyber Resilience Act - sets requirements for products with digital elements; the Cbw sets requirements for the organisations that use them
- EU Cybersecurity Act (Regulation 2019/881) - governs ENISA and voluntary EU certification schemes; it imposes no duty of care or reporting obligation on organisations
🏭 What does the Cybersecurity Act mean for OT and industry?
The duty of care applies to all network and information systems needed to deliver the service, so it also covers SCADA systems, PLCs and historians in critical processes. A ransomware attack that shuts down a water treatment plant or a production line can be a reportable incident. In OT, patching, MFA and a complete asset overview are difficult because installations last for decades and availability comes first. IEC 62443 therefore fits OT practice better than a purely IT-oriented framework.
Practical first steps for an industrial organisation:
- Determine scope and register - check sector, size and category, and register through MijnNCSC
- Map your assets - an up-to-date asset inventory of controllers, networks and external connections
- Analyse risks - with a business impact analysis and a zone-based risk assessment in line with IEC 62443-3-2
- Segment the network - network segmentation based on the zones and conduits model and defence in depth
- Secure your suppliers - set requirements for system integrators and remote access, including suppliers outside the EU
- Detect and report - OT monitoring and an incident response plan that makes the 24-hour deadline achievable
- Involve the board - schedule training and have the ISMS reviewed periodically
❓ Frequently asked questions
Is the Dutch Cybersecurity Act the same as the EU Cybersecurity Act?
No, the Dutch Cybersecurity Act (Cyberbeveiligingswet) is the national law implementing NIS2, while the EU Cybersecurity Act is Regulation (EU) 2019/881 on ENISA and cybersecurity certification. Only the Dutch Cyberbeveiligingswet imposes a duty of care, reporting and registration on organisations.
Is the Cyberbeveiligingswet the same as NIS2?
NIS2 is the European directive; the Cyberbeveiligingswet is the Dutch law that implements it. Organisations in the Netherlands must therefore comply with the Cyberbeveiligingswet, which has applied since 15 August 2026.
How many organisations fall under the Dutch Cybersecurity Act?
According to the NCSC, more than 8,000 Dutch organisations fall under the Cyberbeveiligingswet. That is many more than under the Wbni, because sector and size now determine scope rather than designation by a ministry.
Does your organisation have to register under the Cyberbeveiligingswet?
Yes, every essential and important entity must register itself in the entity register through MijnNCSC under the Cyberbeveiligingswet. The registration obligation has applied since 15 August 2026; failing to register or registering incorrectly can lead to a penalty payment or a fine.
Is ISO 27001 certification mandatory under the Dutch Cybersecurity Act?
ISO 27001 certification is not mandatory under the Cyberbeveiligingswet. The Cyberbeveiligingsbesluit does use ISO 27001 as a starting point, and an ISMS supplemented with IEC 62443 for OT is a common way to demonstrate the duty of care.
Does the Cyberbeveiligingswet apply to OT systems?
The Cyberbeveiligingswet applies to all network and information systems needed to deliver the service, including OT such as SCADA, PLCs and process control systems. An incident that disrupts production or supply can therefore be reportable.
📌 In summary
The Dutch Cybersecurity Act (Cyberbeveiligingswet) has implemented NIS2 in the Netherlands since 15 August 2026 and requires more than 8,000 essential and important entities to register, secure their IT and OT on a risk basis and report significant incidents within 24 hours.
The Act replaces the Wbni, places responsibility with the board and is enforced by sectoral supervisors coordinated by the RDI. It should not be confused with the EU Cybersecurity Act (Regulation 2019/881). Together with the Wwke, the Cbw forms the legal foundation for the digital and physical resilience of vital sectors in the Netherlands.