The Cybersecurity Law (Cyberbeveiligingswet, Cbw) strengthens cybersecurity in the Netherlands. It implements the European NIS2 Directive and requires organisations in a wide range of sectors to manage cybersecurity risks and report significant incidents. It aims to strengthen the cybersecurity of organisations and increase the digital resilience of society and the economy.
Does the law apply to your organisation?
The law covers organisations in a wide range of sectors: Energy, Transport, Banking, Healthcare, Digital infrastructure, Financial market infrastructure, Drinking water, Waste water, ICT service management, Public administration, Space, Postal and Courier services, Waste management, Manufacture, production and distribution of chemicals, Production, processing and distribution of food, Manufacturing, Digital providers, Research.
Publicity funded universities and universities of applied sciences in the Netherlands also fall within the scope of the law.
Whether the law applies to your organisation depends on its activities, size and applicable exceptions. Your organisation is responsible for determining whether it falls within the scope and whether it qualifies as an essential or important entity.
What are the main obligations?
Essential and important entities must:
- Register with the National Cyber Security Centre (NCSC) through MijnNCSC.
- Manage cybersecurity risks by taking appropriate and proportionate technical, operational and organisational measures.
- Report significant incidents to their Computer Security Incident Response Team (CSIRT) and supervisory authority.
- Ensure board responsibility and training: board members must approve cybersecurity measures, oversee their implementation and complete cybersecurity training.
Compliance with these obligations is monitored by the relevant supervisory authority.
More information
For more information about the scope of the law, the obligations and the support available to organisations, read the information guide on the Cybersecurity Law.