Cybersecurity Act (Cbw) & NIS2
The new law for registration, notification and duty of care is final. Nestor Security helps you comply on time and demonstrably.
Cbw declaration
Show your customers that you have the Cbw under control
More and more clients are asking whether you comply with the Cyber Security Act (Cbw), the Dutch implementation of NIS2. With an independent statement, you show in black and white that your security is in order.
Find out why 500+ Companies trust Nestor Security for IT security and compliance
CBW and NIS2
The law demands Evidence
Since August 15, 2026, the Cyber Security Act has been in effect, without a transition period. Organizations that fall under it must be able to prove that their security is in order. They also require their suppliers to provide this proof.
Does this look familiar?
- Our clients request Cbw guarantees from suppliers.
- We have arranged everything, but we can only show a small part of it.
- The board wants to know where we stand in terms of compliance.
Register
You register your organization with the NCSC. This way the government knows that you are covered by the law and can alert you quickly in the event of a threat.
Duty of Care
You take appropriate measures based on an up-to-date risk analysis. The law lists ten topics, including the security of your suppliers.
Reporting requirement
Report serious incidents to the NCSC in three steps, from a first warning to a final report.
Board
The board approves the measures, monitors their implementation and provides mandatory training.
8.000+
Organizations are subject to the law, compared to about 1,000 under the previous law
18
Industries, from healthcare and energy to digital infrastructure
24 hours
To report a serious incident to the NCSC
2028
By August 15 at the latest, the board will follow the mandatory training.
The comparison
Declaration, certificate or mark of approval?
The Cbw does not issue a certificate or declaration. You choose for yourself how to demonstrate that your measures are in order, and your customers decide which evidence they accept. The three most commonly used forms of evidence are related to each other in this way.
| Cbw declaration | ISO 27001 or NEN 7510 | NIS2 Supply Chain certification | |
|---|---|---|---|
| What you receive | A report with the opinion of an independent auditor | A certificate, with annual control audits | A certificate at the achieved level |
| Tested by | Special requirements for the Cbw, tailored to your organization | A fixed international standard, not specific to the Cbw | Fixed NIS2 requirements per level, from SC10 to SC30 |
| Who is checking? | An EDP auditor register (RE) | An accredited certifying body | An audit company recognized by the certification mark |
| Lead time | 16 weeks, or 8 weeks if the evidence is ready | Often 4 to 6 months or longer | Usually 2 to 6 months |
| Fits especially well with | Organizations under the Cbw and their suppliers | Organizations that want to ensure security on a structural level | MKB suppliers with limited risk |
If you are a supplier with limited risk, the SC10 level certification may suffice. If you have access to systems or sensitive customer data, or your customer requests the opinion of a RE, a tailored statement is a better fit. Nestor Security also guides projects for ISO 27001, NEN 7510 and the NIS2 Supply Chain certification. In the initial consultation, we will discuss together which form best suits you.
What you get in hand
What is written in a Cbw declaration?
A statement is not a certificate, but an opinion from an auditor. In Denmark, suppliers already show their customers that they comply with NIS2 with such a statement. That’s how your statement is structured.
Example
Report from the independent IT auditor
Cybersecurity law, tailored requirements
Object of research[Your organization]
Normative frameworkCustomized Cbw requirements
StandardISAE 3000
Auditor's opinion
Register of EDP auditors (RE)
The standard ISAE 3000
The international standard by which auditors issue an independent statement. Your client’s auditor recognizes him immediately, and there is room to adapt the requirements to your organization.
The auditor's judgment
A formal assessment by an independent auditor of your measures, so not a statement you make yourself. This gives it weight with customers, management and regulators.
What exactly was investigated
In the report, this is referred to as the object of research. What falls under it, we determine together during the initial meeting, so that the explanation aligns with the questions of your customers.
Requirements tailored to your organization
This is called the standard framework, the set of requirements that the auditor checks against. We’ll keep it short and align it with the Cbw and your working methods. This usually results in fewer incorrect findings.
Signed by an EDP auditor
A RE is bound by the professional rules of NOREA, the professional organization of IT auditors. On route 1, an external RE draws up the contract, on route 2 an RE from Nestor Audit.
Two routes
Two routes to yours Cbw declaration
If you need help drafting the requirements and collecting evidence, Nestor Security can guide you through the process. If you have your own security or audit team that will provide the evidence, Nestor Audit will carry out the audit alone.
Route 1Nestor Security
Guidance to the explanation
We set the requirements, collect and verify the evidence together with you, arrange the contact with the external auditor and guide the audit.
For whomOrganizations that do not have their own security or audit team who do not want to undertake the process of obtaining the declaration themselves.
- Determining what we investigate, what criteria we use for evaluation, and what evidence is required for that evaluation
- Gather the evidence together with your team
- Engage an external EDP auditor, possibly from our network
- Together with the auditor, prepare the audit report
- Conducting the audit
- Resolve any findings
- Declaration signed by
- External register EDP auditor
- Lead time
- 16 weeks
- Proposal
- Within two working days after the introduction
Route 2Nestor Audit
Audit by Nestor Audit
We conduct the audit in collaboration with your security or internal audit team. The statement is signed by a registered EDP auditor from Nestor Audit.
For whomOrganizations with their own security or internal audit team that provide the evidence. Also suitable for advisors without their own internal audit team who need a statement for a client.
- Discuss what we are investigating, what criteria we are evaluating and how your organization works
- Receiving the evidence and conducting the audit
- Preparing the audit report
- Monitoring quality with a mandatory second check
- Declaration signed by
- RE from Nestor Audit
- Lead time
- 8 weeks
- Proposal
- Within two working days after the introduction
Independence guaranteed
Nestor Security provides guidance, Nestor Audit performs the audit. Since advice and audit are never provided by the same people, the independence of your statement is guaranteed.
The process
From introduction to explanation
A clear approach in four stages, with a fixed contact person. With guidance, you have the signed declaration within 16 weeks. If you choose route 2 and the proof is ready, that takes 8 weeks. In the initial meeting, we make the planning for you concrete.
- Week 1 to 2
Getting to know each other and making a proposal
- 30-minute introduction
- Within two working days, a proposal with scope, planning and price
- You choose the route that suits you
- Week 3 to 6
Criteria and evidence determine
- Recording what we are investigating
- Develop a short, appropriate set of requirements
- The requirement determines what evidence is required.
- Week 7 to 12
Collecting evidence
- Collect and verify the evidence together with your team
- Engage an external EDP auditor, possibly from our network
- Week 13 to 16
Audit and declaration
- Together with the auditor, prepare the audit report
- Accompanying the audit and resolving any findings
- The auditor will sign your statement
Received a statement
Your statement contains an independent assessment of your measures. You share it with customers, management, and regulators and renew it every year. Upon completion, you can choose a one-year contract, with a mid-term check after six months and a repeat audit after twelve months.
Existing certificate
Do you already have ISO 27001 or NEN 7510? Then it can be done in 10 weeks
Your certificate already covers much of what the Cbw requires. With a declaration, you show that your existing measures also cover the additional Cbw requirements, such as the reporting obligation and the role of the board. We use your certificate and measures as proof in this process.
Still no certificate?
No problem. With a Cbw declaration, you demonstrate that you comply with the Cbw requirements, without having to set up a complete management system first.
What the Cbw requires in addition to ISO 27001
Registration with the NCSC
Organizations that fall under the Cbw register themselves in the NCSC register via MyNCSC. After that, you will also have access to the services of your CSIRT, the team that helps with digital incidents.
Requirements for your suppliers
The duty of care also applies to your suppliers. You assess their risks and establish security arrangements in contracts.
The entire organization counts
An ISO certificate sometimes applies to a part of the organization. The duty of care applies to all network and information systems that you use for your work and your services.
Notification deadlines of 24 and 72 hours
ISO 27001 requires a process for incidents, but not legal deadlines. Under the Cbw, you report a serious incident within 24 hours to the NCSC, with a follow-up report within 72 hours and a final report within one month.
Approval and training of the board
The board approves the measures, monitors their implementation and undergoes training, as evidenced by a certificate. Board members are in office until August 15, 2028.
Multifactor authentication and secure communication
The Cbw explicitly mentions multifactor authentication, secure communication and emergency communication. Under ISO 27001, such choices depend on your own risk analysis.
Success stories
Don't just take it from us
You are in good company with Nestor.
ISO 27001
The communication lines with Nestor Security were short. The organization has a pragmatic mindset and is a down-to-earth party to do business with. As a result, the process went smoothly and fairly quickly.
Pascal Kamphuis
Corpoflow
NEN 7510Privacy Officer
We prefer to work together as much as possible regionally and like to hold meetings face-to-face. When you look at partners in the North, there are still a few left, and Nestor Security stands out above the rest.
Irene Bernsen
Joyce-House
ISO 27001ISO 27701
Nestor Security has provided the internal audits of ISO 27001 and ISO 27701 for us. They really hit the mark for us with a good combination of quality and practicality. They are pragmatic, think well with our needs, and the audits are well-managed.
Wouter Buzing
Effectory
About us
Who are Nestor Security and Nestor Audit?
Nestor Security helps organizations use information securely and practically. We advise and implement, with an approach that puts your core activities at the center.
Through Nestor Audit, we have three registered EDP auditors who carry out the audits. You work with short lines and a fixed point of contact, without the complexity and fees of a large accounting firm.
Nestor Audit
Register of EDP Auditors (RE)
- Three in-house EDP auditors
- Registered in the register of NOREA, the professional organization of IT auditors
- Operates in accordance with ISAE 3000 and the professional rules of NOREA
- A mandatory second quality check is included with every audit.
Contact
Starting right away with the Cbw?
Your questions answered
FAQs
What does a Cbw declaration cost?
Guidance to the declaration (route 1) costs from €12,500. If you choose only the audit by Nestor Audit (route 2), you pay from €6,500. All amounts are exclusive of VAT.
The exact price depends on what we are investigating and how many requirements there are. After the initial meeting, you will receive a proposal with scope, planning, and price within two working days.
Is a Cbw declaration mandatory?
No. The Cbw does not issue any statements or certificates. However, you must be able to demonstrate that you are taking appropriate measures, including with your suppliers.
An independent statement is the clearest way to demonstrate that. The regulator itself will assess whether you comply with the law.
How long is the statement valid for?
You renew the statement every year so that your evidence remains up to date.
Upon completion of the installation, you can choose a one-year contract, with a mid-term check after six months and a repeat audit after twelve months.
Do I fall under the Cyber Security Act?
The Cbw applies to organizations in 18 sectors, such as energy, transport, healthcare, digital infrastructure, ICT services, waste management, production and food. Within those sectors, it concerns organizations with a minimum of 50 employees, or an annual turnover and balance sheet total of more than 10 million euros. Some organizations are included regardless of their size.
That is up to you to decide. The government does not usually designate organizations. The NIS2 self-assessment by the NCSC will help you determine whether your organization is subject to the law.
May I share the statement with customers?
Yes. The statement is intended to be shared with customers, management and regulators.
This way you answer customer questions with an independent judgment, instead of having to fill in every questionnaire again.
How does my statement remain independent?
Advice and audits are never given by the same people. An auditor therefore never assesses work that he or she has personally contributed to.
Therefore, you choose beforehand for guidance by Nestor Security or for the audit by Nestor Audit. This ensures the independence of your statement, also for your clients and the supervisory authority.
What is the difference between the Cbw and NIS2?
NIS2 is a European directive. Each EU country translates it into its own legislation, and in the Netherlands that is the Cyber Security Act. Your obligations therefore come from the Cbw, not directly from the directive.
The specific requirements are set out in the Cyber Security Decree and in sector-specific regulations. The Cbw replaces the Network and Information Systems Security Act (Wbni).
Is ISO 27001 enough to meet the Cbw requirements?
You have a considerable advantage, but you don't automatically qualify. The law also requires registration with the NCSC, reporting deadlines of 24 and 72 hours, and a board that approves, monitors, and undergoes training.
With a declaration, you show that your existing measures also meet the Cbw requirements. We use your certificate and measures as proof.
What happens when the auditor has findings?
With route 1, we help you resolve any findings. That is standard part of the guidance.
With route 2, Nestor Audit performs the audit in collaboration with your own team. We do not resolve findings, as advice and audit remain strictly separate.
How long does it take to get a Cbw declaration?
With guidance, you have the signed declaration 16 weeks after the initial meeting. If you already have ISO 27001 or NEN 7510, that is 10 weeks.
If you choose route 2 and your own team provides the proof, you will receive the certificate within 8 weeks.