NIS2 and the Cyberbeveiligingswet

Module 9: Rules and organisation · Reading time: 11 minutes

Learning objective: After this lesson, you can explain what the Cyberbeveiligingswet (NIS2) regulates, who it applies to, and what it means for small businesses through the supply chain.
Key concepts: NIS2, Cyberbeveiligingswet (Cbw), essential and important entity, sector, size, duty of care, reporting duty (24 hours, 72 hours, 1 month), registration duty, supply chain, RDI self-assessment

From European directive to Dutch law

NIS2 is a European directive from 2022 (Directive (EU) 2022/2555) intended to raise the digital resilience of important organisations across the EU. A directive doesn't apply directly: each country transposes it into its own law. In the Netherlands, that's the Cyberbeveiligingswet (Cbw, the Dutch Cybersecurity Act implementing NIS2). It has been in force since 15 August 2026, together with the Wet weerbaarheid kritieke entiteiten (Dutch Critical Entities Resilience Act) and the Cyberbeveiligingsbesluit, which work out the rules in more detail. The old Wet beveiliging netwerk- en informatiesystemen (Wbni) has been withdrawn. There is no transition period: if the law applies to you, you must comply now.

According to the NCSC, more than 8,000 organisations fall under the law. That's a small part of all businesses in the Netherlands. For most small businesses, the key question is therefore not "what do I need to do for the law?", but "what do my customers ask of me because they fall under the law?". We'll get to that shortly.

The NCSC is the point of contact for the Cbw, and since 1 January 2026 also for SMEs: the former Digital Trust Center (DTC) is now part of the NCSC.

Does it apply to you? Sector and size

Whether an organisation falls under the Cbw depends on two questions.

1. Do you work in a sector covered by the law? The law has two annexes.

For some sectors, extra conditions apply as set by the responsible ministry. So not every organisation that does something with "food" automatically falls under it.

2. Are you big enough? Your organisation counts if you:

• have 50 or more employees (FTE), or
• have fewer than 50 employees, but your annual turnover and balance sheet total are both above 10 million euros.

Partner and linked enterprises count too. So a company with 20 employees that belongs to a group of 200 can still fall under it.

Exceptions: regardless of size. A few types of organisation always fall under it, however small: DNS service providers, top-level domain name registries, providers of public electronic communications networks and services, trust service providers, and public administration bodies. Providers of domain name registration services must also register.

Essential or important

Organisations covered by the law are essential or important entities. Roughly speaking: large organisations in the Annex 1 sectors and a few types designated regardless of size are essential; the rest are important. The difference lies mainly in supervision: for essential entities, the supervisory authority may also carry out checks on its own initiative, for example through inspections and audits; for important entities, it mainly intervenes after the fact, if there are indications that something is wrong. The duties themselves are largely the same. You can work out whether you're essential or important using the self-assessment below.

Check it yourself

The Dutch Authority for Digital Infrastructure (RDI) has a free NIS2 self-assessment at https://regelhulpenvoorbedrijven.nl/NIS-2-NL/. You answer a series of questions about sector, size and services and get a result. If you're unsure, for example because your business belongs to a group or operates in multiple countries, the NCSC has guidance for complex business models.

What the law asks of you

If your organisation falls under it, three duties apply.

Registration duty

You register your organisation in the entity register via MijnNCSC (registration portal of the NCSC). This lets the government know who falls under the law and allows it to reach you in the event of a threat.

Duty of care

You carry out a risk analysis and, based on it, take appropriate and proportionate measures to secure your network and information systems. The NCSC lists at least ten topics, all of which you've come across in this course:

1. risk analysis (lesson 1.1 and 9.3);
2. incident handling with an incident plan (lesson 8.1);
3. preparation for disruption: backups, recovery plans, crisis management (module 6);
4. security of the supply chain, including supplier risks (lesson 7.2);
5. cyber hygiene and training (lesson 9.2);
6. secure procurement, development and maintenance of systems, including updates (lesson 5.1);
7. personnel, access policy and management of equipment and software (lesson 7.1);
8. passkeys or multi-factor authentication and secure communication (module 2);
9. a policy on cryptography (encryption);
10. assessing whether the measures work, for example through periodic testing (lesson 6.3 and 9.3).

The board is responsible: it approves the measures and oversees their implementation. Under the European directive, board members must also follow training on cyber risks. Cyber security is therefore no longer a task you can simply hand to the IT person.

Reporting duty

You report a significant incident to the NCSC, via MijnNCSC. This is an incident that seriously disrupts your service provision, causes financial damage, or could cause major damage to others; the exact thresholds differ per sector. The deadlines count from the moment you become aware of the incident:

A single notification via MijnNCSC reaches both the CSIRT (the team that helps with the incident) and the supervisory authority. In addition, under the directive, you must, where necessary, inform the recipients of your services about significant incidents that could affect them.

Cbw notification and GDPR notification: two different things

This resembles the data breach reporting duty under the GDPR (lesson 8.2), and "72 hours" appears in both. Still, they are two separate duties.

A ransomware attack on a Cbw organisation in which customer data is also stolen must therefore be reported to both. And a small business that doesn't fall under the Cbw still has the GDPR reporting duty if personal data is leaked.

If it doesn't apply to you: the supply chain

For most readers of this course, the answer to the first question is: no, my business doesn't fall under the Cbw. The bakery with twelve people, the bookkeeping office with five, the sole-trader web developer. In that case you have no statutory duties under the Cbw: no registration, no reporting duty to the NCSC, no supervision.

But the law can still reach you through your customers. Organisations covered by the Cbw must secure their supply chain: they must take into account the vulnerabilities of their direct suppliers and service providers. The NCSC states that the law doesn't impose obligations on suppliers themselves, but that Cbw organisations can set requirements for the digital security of their suppliers. Those requirements then end up in your contract or in a questionnaire.

An example. A small IT company with six employees manages the laptops and network of a medium-sized transport company with 140 employees. The transport company falls under the Cbw (transport, big enough). The IT company itself doesn't: "management of ICT services" is indeed listed in Annex 1, but the company is too small. Still, it receives a questionnaire: do you have two-factor authentication on the management tools, who has access to our systems, how quickly do you report an incident to us, where are the backups stored?

What the NCSC says about this, and what it means for you:

• Requirements must be proportionate. A customer should look at the risk your service poses to them. A supplier with access to the systems gets stricter requirements than the bakery that delivers the lunch.
• It concerns direct suppliers. The suppliers of your suppliers fall outside the law.
• A certificate isn't mandatory. The Cbw doesn't prescribe a quality mark. A certificate can make the conversation easier, but it's not a guarantee and not a legal requirement.
• Start the conversation early. Map out what measures you already have in the areas where you deal with the customer, and put the agreements in writing.

So don't overstate it. The Cbw doesn't turn a small business into an "NIS2-obliged" organisation, and an advisor who tells you that in order to sell you expensive certification is only telling part of the story. But don't underestimate it either: if you supply larger organisations, you'll increasingly need to be able to show that the basics are in order. The basic measures from this course are exactly what such a questionnaire usually asks for.

This lesson provides general information and is not legal advice. For the current rules, see https://www.ncsc.nl/cyberbeveiligingswet-nis2 and the text of the law at https://wetten.overheid.nl/BWBR0052872/2026-08-15/0.

Summary

• The Cyberbeveiligingswet is the Dutch implementation of NIS2 and has applied since 15 August 2026, with no transition period.
• It applies to you if you're in a sector from Annex 1 or 2 and have 50 or more FTE, or your annual turnover and balance sheet total are both above 10 million euros; some types (such as DNS service providers and public administration) regardless of size.
• Duties: register via MijnNCSC, a duty of care with a risk analysis and appropriate measures under the board's responsibility, and reporting significant incidents within 24 hours, 72 hours and 1 month.
• The Cbw notification to the NCSC is separate from the GDPR notification of data breaches to the Dutch Data Protection Authority (AP); sometimes both are required.
• A small business usually doesn't fall under it itself, but may face appropriate security requirements via customers who do.

Quiz

Exercise

Exercise A9.1: Does it fall under the Cyberbeveiligingswet? You'll get six short descriptions of organisations (sector, number of employees, turnover, balance sheet total, possibly a group or a large customer). For each organisation, determine: it falls under the law, it doesn't fall under the law but will probably face requirements via a customer, or it doesn't fall under the law. The program checks your answers and shows the decision tree steps for each organisation.

Further reading

There isn't yet an article on the Cyberbeveiligingswet in the WebOké knowledge base; use the official sources instead.

• NCSC, Cyberbeveiligingswet (NIS2): https://www.ncsc.nl/cyberbeveiligingswet-nis2
• NCSC, Does my organisation fall under the Cyberbeveiligingswet?: https://www.ncsc.nl/cyberbeveiligingswet-nis2/valt-mijn-organisatie-onder-de-cyberbeveiligingswet-nis2
• NCSC, Duty of care: https://www.ncsc.nl/cyberbeveiligingswet-nis2/zorgplicht
• NCSC, Reporting duty: https://www.ncsc.nl/cyberbeveiligingswet-nis2/meldplicht
• NCSC, The Cyberbeveiligingswet and suppliers: https://www.ncsc.nl/cyberbeveiligingswet-nis2/de-cyberbeveiligingswet-en-toeleveranciers
• RDI, NIS2 self-assessment: https://regelhulpenvoorbedrijven.nl/NIS-2-NL/
• Text of the Cyberbeveiligingswet: https://wetten.overheid.nl/BWBR0052872/2026-08-15/0