Knowledge base
Explanations of the Dutch Cyberbeveiligingswet and ISO 27001, based on the text of the law and the publications of the NCSC and the supervisors. Each article states when it was last updated.
NCSC and supervisors sign cooperation agreements: what happens to your incident reports
The NCSC and the Cbw supervisors signed cooperation agreements on 7 October 2026. Mandatory incident reports now go to the supervisor automatically.
Read the update →Z-CERT designated by law as the healthcare CSIRT from 6 October
From 6 October 2026, Z-CERT is the statutory CSIRT for Dutch healthcare and for medical device manufacturers. What changes and what does not.
Read the update →
Does the Cyberbeveiligingswet apply to your organisation?
Whether the Dutch Cyberbeveiligingswet applies depends on your sector, your size and a set of exceptions. How to test it, and what to do if in doubt.
Read the article →The notification duty under the Cyberbeveiligingswet: 24 hours, 72 hours, one month
What the Cyberbeveiligingswet notification duty requires: when an incident is significant, what you report after 24 hours, 72 hours and a month, and where.
Read the article →Fines and the role of the board under the Cyberbeveiligingswet
Which sanctions the Dutch Cyberbeveiligingswet has, what it asks of the board and what can affect directors personally. With the articles of the Act.
Read the article →Registering with the NCSC under the Cyberbeveiligingswet: step by step
How to register your organisation under the Cyberbeveiligingswet: what to arrange first, what data the NCSC asks for and the steps on mijn.ncsc.nl.
Read the article →NIS2 checklist: the ten elements of the duty of care, and the evidence that goes with them
The ten duty-of-care elements of article 21 Cbw, with what the Cyberbeveiligingsbesluit asks for each and the evidence a supervisor will want to see.
Read the article →Answering a security questionnaire from your customer
Your customer sends a NIS2 or security questionnaire. Why it arrives, how to read it and how to answer with evidence instead of adjectives.
Read the article →