The Cyberbeveiligingswet (Cbw), the Dutch implementation of NIS2, entered into force on 15 August 2026. There is no statutory transition period. We establish what applies to you, implement the duty of care and keep the evidence current.
Updated 25 September 2026
There is no list of covered organisations and no letter from the regulator. The RDI states plainly that organisations are themselves responsible for determining whether they fall under the Cbw. Three tests settle it, and an organisation near the line cannot settle them from a web page.
Medium-sized means 50 FTE or more, or fewer than 50 with both annual turnover and balance sheet total above EUR 10 million. Partner and linked enterprises are counted together. The figures are indicative; the RDI self-assessment is the official test.
Eighteen sectors are listed, eleven in Annex 1 and seven in Annex 2. An Annex 1 entity above the medium ceiling is an essential entity. An Annex 2 entity is an important entity however large it becomes.
Qualified trust service providers, TLD name registries, DNS service providers, government bodies and entities designated under the Wwke are essential entities whatever their size. A ministerial designation can bring an entity into scope on qualitative grounds.
Both classes carry the same substantive obligations. The difference is supervision. Essential entities are checked proactively, whether or not anything has gone wrong; important entities are checked mainly after the fact.
Article 21 of the Cyberbeveiligingswet sets out ten elements. Below is what each one requires and what we deliver for it. The M1 to M10 numbering is ours, so the dossiers can be referenced; the Act numbers them as elements (a) to (j).
Requires an up-to-date information security policy based on periodic risk analysis. Risks are identified, assessed and controlled.
What we deliver
Documented procedures for detection, analysis, notification and recovery. Three stages under articles 26 to 29 Cbw: an early warning within 24 hours, a full notification within 72 hours and a final report within one month of the notification, all through mijn.ncsc.nl.
What we deliver
Backup management, disaster recovery and procedures for crises and major disruptions. Organisations must demonstrate that they can restore critical processes.
What we deliver
Managing security risks through the supply chain. Suppliers and service providers with access to your systems fall under your NIS2 responsibility.
What we deliver
Security in the procurement, development and maintenance of network and information systems. Including patch management and vulnerability management.
What we deliver
Mandatory policy for the use of cryptography and encryption to protect information in transit and at rest. Key management must be documented.
What we deliver
Screening of employees, access control on a need-to-know basis, management of privileged accounts (PAM) and a clear offboarding process.
What we deliver
Where appropriate, multi-factor or continuous authentication, secured voice, video and text communications and secured emergency communication systems within the entity. This is statutory element (j) in full, including remote access and management systems.
What we deliver
Basic cyber hygiene practices and cybersecurity training, the two halves of statutory element (g), elaborated in article 12 of the Cyberbeveiligingsbesluit. Regular awareness programmes on cyber threats, social engineering and safe behaviour.
What we deliver
Policies and procedures to assess the effectiveness of the cybersecurity risk-management measures. Statutory element (f), elaborated in article 18 of the Cyberbeveiligingsbesluit. Without it, the other nine are asserted rather than demonstrated.
What we deliver
The duty of care sits in article 21 and is worked out in the Cyberbeveiligingsbesluit, articles 5 to 19. The obligations have been enforceable since 15 August 2026.
Under article 15 the competent authority is the responsible Minister per sector. Supervision is exercised in practice by the sectoral inspectorates: the RDI for energy, digital infrastructure, ICT service management, government, space, postal and courier services, manufacturing and research; the ILT for transport, drinking water, waste water, waste management, chemicals and the water authorities; DNB for banking; the AFM for financial market infrastructure; the IGJ for healthcare and medical device manufacture; the NVWA for food. Incident notifications go to a CSIRT, which is the NCSC generally, Z-CERT for healthcare, CERT-WM for the water authorities and waste water, and the IBD for municipalities. Knowing which regime you actually sit in is part of the work.
For each duty-of-care element we deliver a file populated from your own environment: the policy, the procedure, the evidence that the measure works and the date it was last tested. That last item is element (f) of Article 21. Without an effectiveness assessment, the other nine elements are asserted rather than demonstrated.
An audit is a snapshot. Both frameworks ask for more than that: NIS2 requires policies to assess the effectiveness of measures, and ISO 27001 makes threat intelligence a control in its own right. That is why we continuously search the dark web, criminal chat channels, ransomware leak sites, paste sites and public code repositories for what has surfaced about your organisation.
What is watched
What we do with it
Our monitoring collects and alerts in near real time. We assess every alert, rate its severity and turn it into the action the framework requires: a password reset, revoking sessions, a notification within the deadline or a correction in the file. Every finding and every follow-up is recorded with a date, so the effectiveness review is not a once-a-year exercise but is substantiated continuously.
Where it lands in the framework
NIS2Art. 21(2)(a), (b), (d) and (f)
Risk analysis, incident handling, supply chain security and the assessment of the effectiveness of measures.
ISO 27001Annex A 5.7, 5.19 to 5.22 and 8.16
Threat intelligence, supplier relationships and monitoring activities.
What it is not
This monitoring is not a security operations centre. It looks at what has leaked about you outside your network, not at the traffic inside it. Detection in your own environment and incident response are a separate agreement.
Two frameworks that are regularly confused. One is law, the other a standard you choose. This table sets out what each one is, who it binds, and what it asks you to be able to demonstrate.
What it is
Who it applies to
Mandatory or voluntary
Applies since
Supervisor or issuing body
What you must be able to show
Consequence of non-compliance
Certification available
| Criterion | NIS2EU directive, Dutch Cbw | ISO 27001Voluntary international standard |
|---|---|---|
| What it is | EU directive, implemented in Dutch law as the Cyberbeveiligingswet (Cbw). | A standard for an information security management system, an ISMS. |
| Who it applies to | Essential and important entities in 18 sectors. More than 8,000 Dutch organisations. | Any organisation, of any type or size, that chooses to adopt it. |
| Mandatory or voluntary | Mandatory. Registration, duty of care and incident reporting, all from day one. | Voluntary. One exception: essential entities in the government sector must apply it. |
| Applies since | 15 August 2026, when the Cyberbeveiligingswet entered into force. | Current edition published 25 October 2022, with a climate amendment added in 2024. |
| Supervisor or issuing body | Sector inspectorates: RDI, ILT, DNB, AFM, IGJ, NVWA. The NCSC runs the reporting portal. | An accredited certification body, in the Netherlands accredited by the RvA. |
| What you must be able to show | Ten duty of care elements, lettered a to j, and a management system on a PDCA cycle. | A documented ISMS: scope, risk method, Statement of Applicability, audit and review records. |
| Consequence of non-compliance | Essential entities: up to EUR 10 million or 2% of group turnover, whichever is higher. | No fine. The certificate is suspended or withdrawn, which customers and tenders notice. |
| Certification available | No. There is no NIS2 certificate and the Cbw does not require one. | Yes, by an accredited certification body. |
Position as at September 2026. The Cyberbeveiligingswet entered into force on 15 August 2026 and the sector thresholds that define a reportable incident are still being completed in ministerial regulations. Determining which framework applies to your organisation remains your own legal responsibility, and this table is a summary rather than advice.
The Cyberbeveiligingsbesluit requires a documented management system on a Plan-Do-Check-Act basis. It prescribes no standard and requires no certificate, and names the ISO 27000 series as an example. An organisation that runs two separate programmes pays twice for the same evidence.
Compare frameworksFill in the form. Within 24 hours you receive a written analysis: does your organisation fall under this framework, and which steps are immediately required.