Framework · Netherlands
Dutch Cybersecurity Act (Cbw)
The Cyberbeveiligingswet is the Dutch implementation of NIS2 and has applied since 15 August 2026. It introduces a duty of care, a reporting obligation and board-level responsibility.
The framework explained
What does the Dutch Cybersecurity Act require?
What is it?
The Cyberbeveiligingswet (Cbw) implements NIS2 in the Netherlands and replaces the Network and Information Systems Security Act (Wbni). It has applied since 15 August 2026 and aims to strengthen the digital resilience and continuity of important services.
Who is it for?
The law covers organisations that provide designated services in the listed sectors and meet the size criteria. Headcount, turnover and balance sheet total all play a role, and there are exceptions. Organisations must check for themselves whether they are in scope; your company name or sector alone is not enough to tell.
Why take action?
Organisations in scope must register, meet a duty of care and report significant incidents. Directors must approve risk management measures, oversee them and build up sufficient knowledge and skills. Cybersecurity therefore calls for cooperation between the board, employees and IT partners.
Where do you start?
- Check whether you are in scope and register your organisation via MijnNCSC.
- Map your risks and choose appropriate, proportionate measures.
- Decide who assesses and reports incidents, in line with the applicable thresholds and deadlines.
- Organise board training, follow-up and evidence of implementation. Check which supervisory authority is responsible for your sector.
Public sources · content checked on 5 October 2026
NCTV: obligations and scope Dutch government: entry into force
Approach
From obligations to demonstrable measures
Together with your IT partner, we move from insight to measures you can demonstrate.
- Independent assessment as a starting point.
- A roadmap with technical work packages for your IT partner.
- Governance, policies and training by Cyberwise.
- ISO/IEC 27001 is optional, not a requirement.
Frameworks
Explore the other frameworks
Each framework has its own scope and evidence requirements. Often, several apply at once.
What does the Dutch Cybersecurity Act mean for your organisation?
Tell us about your scope, current measures and available capacity. Together we determine the right first step.