NIS2 obligations in Netherlands (Cyberbeveiligingswet (Cbw))

Competent authority & CSIRT Legal ref: Art. Art. 14 = Central contact point, Art. 15 = Competent authorities (bevoegde autoriteiten), Art. 16 = CSIRT, Art. 17 = Coordinator for coordinated vulnerability disclosure. The official allocation of ministries, CSIRTs and supervisory authorities is set out in the NCTV’s Doorverwijsboom Cyberbeveiligingswet

• Registration with the National Cyber Security Centre (NCSC) entity register; supervision is sector-based (e.g. the Rijksinspectie Digitale Infrastructuur, RDI, for digital infrastructure); organisations report to their designated sectoral CSIRT. nctv.nl · 28 Oct 2026 · source-checked
• The Netherlands has adopted a decentralised supervisory model (multi-CSIRTs) that combines central national coordination with sector specific allocation of responsibilities. The NCSC is the coordinator, but organisations report to their sector-specific CSIRT (sectoral CSIRT), not necessarily directly to the NCSC as the national CSIRT. Overall responsibility for the legislation lies with the Ministry of Justice and Security (JenV) while sectoral ministries, CSIRTs and supervisory authorities are identified both through primary and secondary legislation. ecs-org.eu · 28 Oct 2026 · secondary source
• Competent authorities by sector in the Netherlands: ecs-org.eu · 28 Oct 2026 · secondary source
• Ministry of the Interior and Kingdom Relations (BZK): Central government bodies; Decentralised authorities (except water boards). ecs-org.eu · 28 Oct 2026 · secondary source
• Ministry of Economic Affairs (EZ): Digital infrastructure; ICT service management (B2B); Digital service providers; Domain name registration services; Postal and courier services; Space sector; Manufacturing of ICT, electronics, machinery, vehicles and transport equipment. ecs-org.eu · 28 Oct 2026 · secondary source
• HCPN (single point of contact). ecs-org.eu · 28 Oct 2026 · secondary source
• Ministry of Finance: Banking; Financial market infrastructures. ecs-org.eu · 28 Oct 2026 · secondary source
• Ministry of Infrastructure and Water Management (I&W): Transport (air, rail, road and maritime); Drinking water; Wastewater; Waste management; Chemicals; Water boards. ecs-org.eu · 28 Oct 2026 · secondary source
• Ministry of Climate and Green Growth: Energy sector (electricity, district heating and cooling, oil, natural gas and hydrogen). ecs-org.eu · 28 Oct 2026 · secondary source
• Ministry of Agriculture, Fisheries, Food Security and Nature: Food production, processing and distribution. ecs-org.eu · 28 Oct 2026 · secondary source
• Ministry of Health, Welfare and Sport (VWS): Healthcare; Medical devices and in vitro diagnostic devices. ecs-org.eu · 28 Oct 2026 · secondary source
• Ministry of Education, Culture and Science (OCW): Higher education institutions designated as essential or important entities. ecs-org.eu · 28 Oct 2026 · secondary source
• For research organisations: the competent authority depends on the sector in which the research activity is carried out. Where no sector-specific authority exists, responsibility lies with the relevant minister. ecs-org.eu · 28 Oct 2026 · secondary source
• For critical entities under the CER framework: the authority designated under the Dutch Critical Entities Resilience Act also acts as the competent authority under this act. ecs-org.eu · 28 Oct 2026 · secondary source
• CSIRT by sector in the Netherlands: ecs-org.eu · 28 Oct 2026 · secondary source
• NCSC: it is listed as the national CSIRT and single point of contact, manages the national entity register, and acts as the central contact point within the Netherlands and towards other EU Member States. Also acts as CSIRT for municipalities, at least until the end of 2026. ecs-org.eu · 28 Oct 2026 · secondary source
• Some sectors have a designated sectoral CSIRT: ecs-org.eu · 28 Oct 2026 · secondary source
• Z-CERT – Healthcare sector CSIRT ecs-org.eu · 28 Oct 2026 · secondary source
• CERT Watermanagement – Water authorities CSIRT ecs-org.eu · 28 Oct 2026 · secondary source
• Supervisory model in the Netherlands: ecs-org.eu · 28 Oct 2026 · secondary source
• The Netherlands applies a sector-based supervisory model under the Cyberbeveiligingswet. The Dutch Authority for Digital Infrastructure (RDI) supervises a broad range of sectors within its remit, particularly digital infrastructure and other sectors assigned to it under the Dutch framework. In parallel, several sector-specific supervisory authorities oversee compliance in their respective domains, including De Nederlandsche Bank (DNB) for banking, the Netherlands Authority for the Financial Markets (AFM) for financial market infrastructures, the Health and Youth Care Inspectorate (IGJ) for healthcare, the Netherlands Food and Consumer Product Safety Authority (NVWA) for food production and for packaged drinking water, the Authority for Nuclear Safety and Radiation Protection (ANVS) for the nuclear sector, and the Human Environment and Transport Inspectorate (ILT) for transport, (piped) drinking water, wastewater, chemicals, water boards, and other sectors linked to the Ministry of Infrastructure and Water Management. For higher education institutions, the supervisory authority has not yet been determined. ecs-org.eu · 28 Oct 2026 · secondary source
• CSIRTs ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Art. 4 (scope/jurisdiction), Art. 8-13 (essential/important classification), Annexes I & II

• Essential (Essentiele entiteiten): Energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration and space. Most of highly critical sector entities contained in Annex I must exceed the medium-size threshold to be in scope. ecs-org.eu · 28 Oct 2026 · secondary source
• Important (Belangrijke entiteiten): Postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research. ecs-org.eu · 28 Oct 2026 · secondary source
• Certain entities are in scope as essential and regardless of their size including: qualified trust service providers, DNS service providers, TLD registries, plus entities designated as critical entities under the Wwke/CER framework. ecs-org.eu · 28 Oct 2026 · secondary source
• These entites to be qualified as essential must be at least medium-sized: providers of public electronic communications networks/services. ecs-org.eu · 28 Oct 2026 · secondary source
• All government bodies are equally covered regardless of their size, including ministries, municipalities, provinces and water authorities. ecs-org.eu · 28 Oct 2026 · secondary source
• Higher education institutions are not automatically in scope, they must be individually designated as essential entities by the Minister of Education ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: Art. 44

• Since entry into force on 15 Aug 2026, in-scope organisations must be registered on mijn.ncsc.nl (eHerkenning or SSO Rijk login) and keep their data current. ncsc.nl · 28 Oct 2026 · source-checked
• Entities must register themselves in the entity register. The registration is done through the NCSC (mijn.ncsc.nl) and becomes mandatory once the law enters into force. The transposition sets out the exact registration details required. ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 25

• In-scope organisations must report significant incidents to the CSIRT and competent authority. The reporting process consists of an initial early warning that must be submitted within 24 hours of becoming aware of the incident, followed by a more detailed incident notification within 72 hours, and a final report within one month. If the incident is still ongoing at the one-month deadline, a progress report must be submitted instead. In such a case, the final report must then be submitted within one month after the incident has been resolved. The CSIRT may also request additional updates while the incident is ongoing. ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

• The board must approve cyber risk-management measures and oversee the duty of care; executive board members must have demonstrable knowledge and skills within two years of entry into force (by mid-2028) — new members within two years of appointment — and hold a training certificate the supervisor can request. Supervisory/non-executive directors are exempt from the training duty. rdi.nl · 28 Oct 2026 · source-checked

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties

• Essential entities: up to EUR 10,000,000 or 2% of total worldwide annual turnover, whichever is higher. ecs-org.eu · 28 Oct 2026 · secondary source
• Important entities: up to EUR 7,000,000 or 1.4% of total worldwide annual turnover. ecs-org.eu · 28 Oct 2026 · secondary source
• A third tier of fines: up to EUR 1,000,000 for “other infringements” under the Cbw that don’t relate to the main duty of care or incident reporting obligations. ecs-org.eu · 28 Oct 2026 · secondary source
• The supervisor can also order corrective measures, impose penalty payments, publish the sanction, and (for essential entities) temporarily suspend a manager from their role. The Cyberbeveiligingswet includes significant board-level governance requirements and board members can be held personally liable if failing to implement the following measures: Board members must approve cybersecurity risk-management measures Board members must have sufficient knowledge/skills to assess cybersecurity risks Board members must undergo cybersecurity training (with 2-year grace period). Board members can be personally fined up to EUR 25,000 for non-compliance. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Cyberbeveiligingsbesluit (Cbb) Art. 21 (2)

• Duty of care (zorgplicht): ten measure areas (risk analysis policy, incident handling, business continuity, supply chain, secure acquisition/development, effectiveness assessment, cyber hygiene & training, cryptography, personnel/access/asset management, MFA/secure comms); elaborated in the Cyberbeveiligingsbesluit; ISO 27001, NEN 7510 and BIO 2.0 may be used. nctv.nl · 28 Oct 2026 · source-checked
• Reference to European and international standards. ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

• NCSC – Register for the Cbw ncsc.nl
• NCTV – Duty of care nctv.nl
• RDI – Board responsibility & governance rdi.nl

Key dates

• 15 Aug 2028 Netherlands: executive board members must meet Cbw knowledge/training requirements (two years after entry into force; RDI says "mid-2028")
  rdi.nl needs verification

What changed recently

1. 15 Aug 2026
   Cyberbeveiligingswet in force; registration on MijnNCSC mandatory ncsc.nl source-checked
2. 8 Jul 2026
   Referred by the Commission to the Court of Justice for failing to notify transposition digital-strategy.ec.europa.eu source-checked