Cyberbeveiligingswet (NIS2): what your business must do

The Cyberbeveiligingswet, the Dutch NIS2 law, has applied since 15 August 2026. Find out in five minutes whether your company is in scope, what the law asks of you, and how to get there in 90 days.

Cybersecurity8 min readUpdated October 7, 2026

A boardroom table at dusk with a closed laptop, a hardware security key, a ticked checklist on a clipboard, a softly glowing phone and a desk clock, with Dutch canal houses outside.

Short answer

50+

employees, or over €10 million in turnover and balance sheet, in one of 18 sectors: then the law most likely applies to you.

What the Cyberbeveiligingswet is

The Cyberbeveiligingswet (Cbw) is the Dutch implementation of the European NIS2 directive. It replaced the earlier Wbni on 15 August 2026 and applies to more than 8,000 organisations that provide essential or important services in the Netherlands.

The law does not prescribe a product or a security certification. It asks organisations in scope to know their cyber risks, take proportionate measures, report serious incidents fast, and make their board responsible for all of it. Those four duties are explained below.

15 Aug 2026the date the law took effect, with no transition period for the core duties.

8,000+organisations in the Netherlands are in scope, according to the NCSC.

Does the law apply to your business?

Three questions decide it: your sector, your size and, once you are in scope, which kind of entity you are.

18sectors, from energy and health to food, waste, manufacturing and digital services.

Check your organisation with the government's free self-assessment tool (opens in a new tab).

Does the Cyberbeveiligingswet apply to you?

Do you provide a service in one of the 18 sectors of the law?
Energy, transport, banking, financial markets, health, drinking water, waste water, digital infrastructure, managed ICT services, government, space, post, waste, chemicals, food, manufacturing, digital providers and research.
No
Not directly in scope
Customers who are in scope may still ask you to meet their security standards.
Yes
Do you have 50 or more employees, or over €10 million in both turnover and balance sheet total?
Medium-sized or larger, by the European SME definition. Count linked companies in your group too.
No
Usually not in scope
Unless you are, for example, a DNS, trust service or public telecom provider, or a government body: they are in scope at any size.
Yes
Are you a large organisation in a high-criticality sector?
Large means 250 or more employees, or over €50 million turnover and over €43 million balance sheet total. High-criticality are the first eleven sectors above.
No
Important entity
Supervised after the fact, for example following an incident. Fines up to €7 million or 1.4% of worldwide turnover.
Yes
Essential entity
Supervised proactively, with inspections possible at any time. Fines up to €10 million or 2% of worldwide turnover.

Simplified from the NCTV's criteria. Some organisations are in scope at any size; the official tool gives the definitive answer.

Being in scope is about the organisation, not one website or one department. A machinery manufacturer with 60 employees is in scope as an important entity, even if IT is a small part of the business.

Not in scope? Your customers may still ask

Organisations in scope must also manage the risks in their supply chain. That reaches small businesses that are not in scope themselves: the IT supplier of a hospital, the software maker for a water company, the logistics partner of a food producer.

In practice it arrives as a security questionnaire, new clauses at a contract renewal, or a request to show how you handle access, updates and incidents. The questions follow the same ten areas as the law, so preparing for them is the same work at a smaller scale.

Organisations in scope must manage the security of their suppliers. Expect questionnaires, contract clauses and sometimes audits.

The four duties: register, protect, report, govern

€10Mor 2% of worldwide turnover: the maximum fine for essential entities.

€7Mor 1.4% of worldwide turnover for important entities.

The four duties at a glance
Duty	What it means	From
Register	Register in the NCSC entity register at mijn.ncsc.nl, with eHerkenning level EH2+. Report changes within 14 days.	15 August 2026
Protect	Analyse your risks and take appropriate, proportionate technical and organisational measures in ten areas.	15 August 2026
Report	Report significant incidents to the CSIRT and your supervisor: an early warning, a notification and a final report.	Within 24 hours
Govern	The board approves the measures and oversees them. Every director needs a certificate of cyber risk training.	Training within two years

There is no grace period for registering, protecting and reporting. Only the training of directors has a transition period of up to two years.

The ten areas your measures must cover

The duty of care rests on ten areas from the NIS2 directive. Together they describe a security programme that most mid-sized companies can run with a few clear policies, good tooling and one person in charge.

The law asks for measures that fit your risks. A company of 60 people is not expected to run a security operations centre around the clock.

The ten areas of the duty of care

Risk analysis and policy
Know what you protect and against what, and write down how.
Incident handling
Detect, respond to and recover from incidents, with clear roles.
Business continuity
Backups, disaster recovery and crisis management that have been tested.
Supply chain security
Manage the risks of your suppliers and service providers.
Secure purchase, development and maintenance
Including how you handle and disclose vulnerabilities.
Checking effectiveness
Test and audit whether your measures actually work.
Cyber hygiene and training
Updates, sound passwords and regular training for everyone.
Cryptography
Encryption where it matters, with rules for how you use it.
People, access and assets
Who can reach what, and an up-to-date list of your systems.
Multi-factor authentication
MFA, and secured voice, video, text and emergency communication.

From Article 21 of the NIS2 directive, implemented in the Cyberbeveiligingswet.

Area six asks you to check whether your measures work. A penetration test of your website, apps and email is one of the clearest ways to do that, and its report shows what was checked and what was fixed. Email deserves an early look too: setting up SPF, DKIM and DMARC stops others from sending mail in your company's name.

Reporting an incident: 24 hours, 72 hours, one month

An incident is significant when it causes, or can cause, a severe disruption of your service or financial loss, or when it affects, or can affect, others by causing considerable damage. From the moment you become aware of one, the clock runs.

24 hfor the early warning, counted from the moment you become aware of a significant incident.

The reporting clock

You become aware
24 hours
Early warning
What happened, and whether it may be malicious or affect other countries.
72 hours
Notification
A first assessment: how severe, what impact, and any signs of compromise.
One month
Final report
The full description, the likely cause, the measures taken and any cross-border impact.

Reports go to the CSIRT and your supervisor through mijn.ncsc.nl. The final report is due one month after the notification.

Twenty-four hours is short. Decide now who notices an incident, who judges whether it is significant, and who files the report, at weekends too.

Your first 90 days

The law is already in force, so if you are in scope, start now. This plan takes a mid-sized company from uncertainty to a defensible position in about three months.

13weeks from "are we in scope?" to a board that has approved its measures.

A 90-day plan

Check scopeRun the self-assessment and confirm your entity type.
Week 1–2
RegisterRegister at mijn.ncsc.nl with eHerkenning EH2+.
Week 2–3
Risk analysisList systems, data and suppliers, and rank the risks.
Week 3–6
MeasuresClose the biggest gaps first: MFA, updates, backups, access.
Week 6–13
SuppliersReview contracts and ask key suppliers about their security.
Week 7–11
Incident drillWrite the reporting procedure and rehearse it once.
Week 8–10
Board sign-offThe board approves the measures and plans its training.
Week 10–13

Work streams overlap: measures start as soon as the risk analysis shows the first gaps.

After the first 90 days, keep a rhythm: review your risks every year, test your measures, and keep your registration up to date.

Want help with the risk analysis, the measures or a test of what you have in place? Secure covers security scans, penetration tests and hardening, and you can ask us a question first.

Sources

Questions, answered.

When did the Cyberbeveiligingswet take effect?

On 15 August 2026. It replaced the Wbni and implements the European NIS2 directive. Registration, the duty of care and the reporting duty apply from that date; directors have up to two years to complete their training.

Does NIS2 apply to small businesses?

Usually not directly. The law applies from 50 employees, or more than €10 million in turnover and balance sheet total, in 18 sectors. Some providers, such as DNS and trust service providers, are in scope at any size. Small businesses are often affected as suppliers of organisations that are in scope.

What happens if we don't comply?

Supervisors can give instructions and binding orders, and impose fines of up to €10 million or 2% of worldwide turnover for essential entities, and up to €7 million or 1.4% for important entities, whichever is higher. If an essential entity ignores a binding order, a court can suspend its directors at the supervisor's request.

Where do we register?

In the NCSC entity register at mijn.ncsc.nl. You need eHerkenning at level EH2+ and authorisation to represent your organisation. Changes must be reported within 14 days.

Do we need ISO 27001?

No. The law does not require ISO 27001 or any other certification of your organisation; only directors need a certificate showing they completed cyber risk training. ISO 27001 covers much of the duty of care and can help you show your measures are in order, but it is not mandatory.

Who is our supervisor?

That depends on your sector. The Rijksinspectie Digitale Infrastructuur (RDI) supervises digital infrastructure, for example. The NCTV publishes an overview of the supervisor for each sector.

More guides

Not sure where you stand?

We check your website, domain and email for the weak spots the law asks you to manage, and help you fix them. Security scans start at €495, penetration tests at €2,950.

Ask a security question Cybersecurity