Schedule a no-obligation consultation
Customers and regulators no longer ask whether you operate safely, but how you prove it. Nestor Security ensures that you have the answer ready with a single independent Cbw declaration.
Curious about what we can do for you? Request a free consultation.
The law in brief
What does the Cybersecurity Act regulate?
The Cybersecurity Act (Cbw) is the Dutch implementation of the European NIS2 Directive. The law replaces the Network and Information Systems Security Act (Wbni) and obliges organizations in eighteen sectors to demonstrably get their digital resilience in order.
In terms of content, the obligations align with what the NIS2 Directive prescribes. What is primarily new is that they are now enshrined in Dutch law: with an individual supervisory authority per sector, a central reporting portal at the NCSC, and concrete sanctions. Whereas the Wbni affected approximately one thousand organizations, the Cbw applies to over eight thousand.
The law itself outlines the main points. The practical implementation follows from the Cybersecurity Decree and ministerial regulations per sector, which contain, for example, the thresholds for the reporting obligation. For the government, the duty of care is further elaborated in the BIO2.
CBW and NIS2
The Cbw is the law, NIS2 the European directive behind it. You can read more about the background and the directive itself on our NIS2 page.
From Wbni to Cbw
The Wbni will expire on August 15. Organizations that already fell under it will transition to the new regime. The requirements are broader and supervision is more active.
Adopted at the same time: the Wwke
In addition to the Cbw, the Law on Critical Entities has been adopted, aimed at physical and operational resilience. Approximately 500 organizations are designated for this purpose by the Minister of the Interior.
As of August 15
Four obligations, no transition period
These obligations apply from the first day. The supervisor will soon assess your organization on them.
✎
Registration requirement
You register your organization in the entity register via mijn.ncsc.nl. You can do this now, and it is wise to prepare the registration before it becomes mandatory.
â—†
Duty of Care
You control the risks to your network and information systems with appropriate measures based on an up-to-date risk analysis. The law lists ten areas in which you must be able to demonstrate measures.
â—ˆ
Reporting requirement
You can report significant incidents via the NCSC reporting portal: an early warning within 24 hours, a follow-up notification within 72 hours, and a final report within a month.
âš–
Administrative responsibility
The board approves the measures, oversees their implementation, and completes certified training. In the event of negligence, the supervisory authority can personally impose a fine or penalty payment on board members.
Scope
Does the Cybersecurity Act apply to your organization?
You are responsible for assessing this yourself: the government does not designate you. The sector and the size of your organization together determine whether you fall under the law and whether you are classified as an essential or important entity.
Active in one of the 18 sectors
The law applies to essential and important sectors, such as energy, transport, healthcare, digital infrastructure, ICT services, manufacturing, chemicals, food, postal services, and waste management.
50+ employees or €10 million+
Within those sectors, the law applies to organizations with at least 50 employees, or an annual turnover and balance sheet total exceeding €10 million.
Sometimes regardless of the scale
Some organizations always fall under the law, for example, providers of public communications networks, trust services, and DNS service providers. An organization can also be designated because it is critical to society or the economy.
Indirectly, through the supply chain
Do you supply to organizations subject to the law? If so, through their chain responsibility, you will almost certainly be subject to security requirements. This is estimated to affect tens of thousands of Dutch companies.
Quick check
Answer three questions
A first indication, not legal advice. If in doubt, we will review it for you free of charge.
Is your organization active in one of the 18 essential or important sectors?
Do you have 50 or more employees, or an annual turnover and balance sheet total above € 10 million?
Do you supply services or products to organizations that (likely) fall under the law?
Annex I · highly critical sectors
This generally includes the essential entities, with proactive supervision.
EnergyTransportBankingFinancial market infrastructureHealthcareDrinkwaterWastewaterDigital infrastructureIT service management (B2B)GovernmentSpace travel
Annex II · other critical sectors
This generally includes the important entities, with reactive supervision.
Postal and courier servicesWaste managementChemical substancesGroceriesManufacturingDigital providersResearch
Schedule a free consultation
Curious about what we can do for you? Request a free consultation. Our specialists are happy to assist you.