What is the Wwke?
The Wwke (Wet weerbaarheid kritieke entiteiten, the Dutch Critical Entities Resilience Act) is the Dutch law that transposes the European CER Directive (EU) 2022/2557 and requires government-designated critical entities to make their essential services resilient against all relevant threats, from natural disasters and sabotage to terrorism, personnel risks and supplier failure. The act entered into force on 15 August 2026, at the same time as the Dutch Cybersecurity Act (Cyberbeveiligingswet).
The Wwke is the physical and organisational counterpart to the Cybersecurity Act, which implements NIS2. Where NIS2 governs cyber resilience, the Wwke addresses all forms of disruption to essential services. Because those services almost always run on OT, the law directly affects the protection of SCADA systems, PLC cabinets and the buildings that house them.
🗓️ Since when does the Wwke apply?
The Critical Entities Resilience Act is dated 8 July 2026 and was published in the Bulletin of Acts and Decrees as Staatsblad 2026, 188. The Dutch Senate adopted the Wwke and the Cybersecurity Act on 7 July 2026, and both laws entered into force on 15 August 2026. The bill was parliamentary file number 36765.
| Milestone | Date |
|---|---|
| CER Directive enters into force (like NIS2) | 16 January 2023 |
| Deadline for transposing CER into national law | 17 October 2024 |
| Old European Critical Infrastructure Directive (2008/114/EC) repealed | 18 October 2024 |
| Member States must have identified critical entities | 17 July 2026 |
| Wwke and Cybersecurity Act in force | 15 August 2026 |
| Critical entity completes its risk assessment | 9 months after designation |
| Duty of care and reporting obligation apply | 10 months after designation |
The Netherlands therefore transposed the directive almost two years late. If the first designations follow within about a month of entry into force, as with the water boards, those critical entities must complete their risk assessment around mid-2027 and have their measures demonstrably in place a month later.
🎯 What is the aim of the Wwke?
- Safeguard the continuity of services society cannot do without, such as electricity, drinking water, transport and healthcare
- All-hazards approach - not only cyberattacks, but also floods, heat, fire, sabotage, terrorism, pandemics and supply chain failure
- Mandate risk-based measures instead of voluntary arrangements
- Introduce mandatory reporting of significant disruptions, so government has an up-to-date picture
- Enable European cooperation for services delivered across borders
In the Netherlands the Wwke succeeds the earlier Aanpak vitaal (vital infrastructure approach), under which the National Coordinator for Security and Counterterrorism (NCTV) and the ministries mapped vital processes without any statutory duty of care attached.
🧱 Who counts as a critical entity?
An organisation can be designated as a critical entity if it meets three conditions: it provides one or more essential services, it operates in the Netherlands with its critical infrastructure on Dutch territory, and an incident would have significant disruptive effects on that service. The responsible sector minister makes the designation after consulting the Minister of Justice and Security. The CER Directive lists eleven sectors:
| Sector | Examples of services | Full Wwke obligations? |
|---|---|---|
| Energy | Electricity, gas, oil, district heating, hydrogen | Yes |
| Transport | Air, rail, water and road transport | Yes |
| Banking | Credit institutions | No, DORA applies |
| Financial market infrastructure | Trading venues, central counterparties | No, DORA applies |
| Health | Hospitals, laboratories, pharmaceutical supply chain | Yes |
| Drinking water | Abstraction, production and distribution | Yes |
| Waste water | Collection and treatment | Yes |
| Digital infrastructure | Internet exchange points, DNS, data centres, cloud | No, NIS2 applies |
| Public administration | Central government bodies | Yes |
| Space | Ground infrastructure for space-based services | Yes |
| Food | Production, processing and distribution | Yes |
Entities in banking, financial market infrastructure and digital infrastructure are designated, but the directive’s resilience requirements, reporting obligation and supervision do not apply to them, because DORA and NIS2 already cover these. Member States may also add sectors of their own, and the Netherlands subdivides the sectors further. The Minister of Infrastructure and Water Management, for example, designates water boards for the sectors ‘flood defence and water management’ (keren en beheren) and ‘waste water’, and in some cases ‘road management’.
Designation is confidential: ministries do not publish a list of critical entities. A designated organisation is also always an essential entity under the Cybersecurity Act, regardless of its size.
🔐 What obligations does a critical entity have?
The Wwke has three core obligations, based on Articles 12 to 15 of the CER Directive:
- Risk Assessment - within nine months of designation you assess all relevant natural and man-made risks to your essential service, then as often as necessary and at least every four years. You also use the government’s sector risk assessment as input.
- Duty of care - within ten months of designation you take appropriate and proportionate technical, security and organisational measures, documented in a resilience plan. You may reuse documents prepared under other legislation.
- Reporting obligation - an incident that significantly disrupts, or could significantly disrupt, your essential service must be reported to the competent authority without undue delay and no later than 24 hours after you become aware of it (or as soon as possible if that is operationally impossible), followed where required by a detailed report within one month.
The duty of care covers six types of measures:
| Measure | Examples in practice |
|---|---|
| Prevent incidents | Disaster risk reduction, climate adaptation, flood and heat measures |
| Physical protection | Fencing, barriers, perimeter monitoring, detection, access control |
| Respond and mitigate | Crisis procedures, alerting routines, an Incident Response Plan |
| Recover | Continuity management, recovery plans, alternative supply chains |
| Personnel security | Defining critical roles, access rights to premises, installations and sensitive information, background checks, including for external service providers |
| Awareness | Training, information materials and exercises |
You must also cooperate with supervision: the competent authority can carry out on-site inspections and audits and request information to assess whether your measures are adequate.
A critical entity serving six or more EU Member States can be classed as a critical entity of particular European significance. The European Commission may then send an advisory mission on request.
🔄 How does the Wwke differ from the Cybersecurity Act?
Many organisations fall under both laws. The Wwke governs physical and organisational resilience; the Cybersecurity Act governs digital resilience.
| Topic | Wwke / CER | Cybersecurity Act / NIS2 |
|---|---|---|
| Type of resilience | Physical, organisational, all-hazards | Network and information systems |
| Who is covered | Individually designated critical entities | Essential and important entities by sector and size (see scope) |
| Designation | Decision by the sector minister | Largely self-assessment plus registration |
| First notification | Within 24 hours to the competent authority | Early warning within 24 hours (see incident reporting) |
| Central role | Minister of Justice and Security (NCTV) as single point of contact | NCSC as CSIRT for most sectors |
| Supervision | Sector minister with inspectorates such as the ILT | RDI, ILT, IGJ, DNB/AFM and others |
An integrated approach across IT and OT avoids duplicated effort: one risk analysis, one crisis organisation and one set of measures aligned with IEC 62443 and ISO 22301.
🏭 What does the Wwke mean for IT and OT?
The Wwke clearly affects industrial environments. In practice the law translates into:
- Physical security of process plants, control rooms, SCADA rooms, substations and PLC cabinets in the field
- Personnel resilience - screening of operators, maintenance contractors and suppliers with access, and attention to insider threats
- Supplier dependency - insight into supply chain risks and high-risk suppliers, with alternatives for critical components
- External dependencies - power, telecoms and timing signals, as in GNSS interference
- Crisis response that brings physical and cyber incidents together via an Incident Response Plan and a Crisis Communication Plan
- Alignment with IEC 62443 for the cyber component of the resilience plan
Hybrid threats make that link urgent. Campaigns such as Volt Typhoon show that state actors are preparing to disrupt vital services, and sabotage of a pumping station or substation can have the same consequences as a cyberattack on its control system.
🛠️ How do you approach the Wwke in practice?
- Establish designation and scope - determine which essential services and sites the designation covers, and link them to your Cybersecurity Act registration.
- Determine business impact - use a Business Impact Analysis to set maximum tolerable downtime and minimum service levels per service.
- Carry out the risk assessment - assess threats per site: flooding, fire, sabotage, utility failure, cyberattacks and staff shortages.
- Draw up the resilience plan - record preventive, detective and recovery measures per risk, and reuse existing documents from ISO 22301, the Cybersecurity Act or sector legislation.
- Set up the reporting process - make sure a disruption can be reported to the competent authority within 24 hours, alongside the Cybersecurity Act notification to the CSIRT.
- Exercise and improve - rehearse scenarios in which physical and digital incidents coincide, and repeat the risk assessment at least every four years.
For the Dutch water boards this is already concrete: the Minister of Infrastructure and Water Management designates them within a month of entry into force for flood defence and water management and for waste water, and the Human Environment and Transport Inspectorate (ILT) supervises. See also Water Sector OT Security.
❓ Frequently asked questions
What does the abbreviation Wwke stand for?
Wwke stands for Wet weerbaarheid kritieke entiteiten, the Dutch Critical Entities Resilience Act. The Wwke transposes the European CER Directive (Critical Entities Resilience, EU 2022/2557) and has applied since 15 August 2026.
How do I know whether my organisation falls under the Wwke?
Only an organisation that the responsible sector minister has designated as a critical entity falls under the Wwke. You then receive a designation decision; without one, the Wwke obligations do not apply, although you may still fall under the Dutch Cybersecurity Act.
What must a critical entity report under the Wwke?
A critical entity reports any incident that significantly disrupts, or could significantly disrupt, the provision of its essential service. The Wwke notification goes to the competent authority no later than 24 hours after the entity becomes aware of the incident, followed where required by a detailed report within one month.
Is the Wwke the same as the Dutch Cybersecurity Act?
No, the Wwke governs the physical and organisational resilience of critical entities, while the Cybersecurity Act governs digital security. A critical entity under the Wwke is, however, automatically an essential entity under the Cybersecurity Act.
Which deadlines apply after designation under the Wwke?
After designation a critical entity has nine months for its first risk assessment. The Wwke duty of care and reporting obligation apply ten months after designation, and you repeat the risk assessment at least every four years.
Who supervises the Wwke?
Supervision of the Wwke lies with the competent authority for each sector: the sector minister, who often assigns it to an inspectorate such as the ILT. The Minister of Justice and Security, supported by the NCTV, is the single point of contact for the Netherlands.
📌 In summary
The Wwke is the Dutch transposition of the European CER Directive and, since 15 August 2026, requires designated critical entities to carry out a risk assessment, maintain a resilience plan against all relevant threats and report disruptions within 24 hours. Together with the Cybersecurity Act it forms the legal foundation for protecting Critical Infrastructure in the Netherlands, and for OT environments that means treating physical, personnel and digital security as one coherent approach.