NIS2 Netherlands (Cbw, 2026)

Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems you use for your work or to provide your services, and to prevent incidents or limit their effect on the recipients of your services and on other services (article 21(1)). The measures give a security level matched to those risks. Take account of the state of the art, the cost of implementation and, where applicable, the relevant European and international standards; for proportionality weigh your exposure to risk, your size, and the likelihood and severity of incidents, including their social and economic effect (article 21(2)). The measures follow an all-hazards approach that protects the systems and their physical environment, and cover at least: risk analysis and information system security policy; incident handling; business continuity, such as backup management, recovery plans and crisis management; supply chain security, including your direct suppliers and service providers; security in acquiring, developing and maintaining systems, including vulnerability handling and disclosure; policies and procedures to assess whether the measures work; basic cyber hygiene and cybersecurity training; policy and procedures on cryptography and, where relevant, encryption; human resources security, access policy and asset management; and, where appropriate, multi-factor or continuous authentication, secured voice, video and text communication and secured emergency communication (article 21(3)). For the supply chain, weigh each direct supplier's specific vulnerabilities, the general quality of their products and their cybersecurity practices including secure development, and the results of the coordinated security risk assessments of critical supply chains that the NIS Cooperation Group runs (article 21(4)). The Cyberbeveiligingsbesluit sets the detailed measures by article 21(5); they are the Requirements Cyberbeveiligingsbesluit art. 6 to art. 18 of this catalog, and an entity takes at least those (Cyberbeveiligingsbesluit art. 5). Government bodies meet the measures through ISO 27001 and the BIO2 government measures: the Cyberbeveiligingsregeling sector overheid (BWBR0052963, arts. 3 and 5) requires an essential entity in the government sector, except a waterschap, to use at least the ISO 27002:2022 controls (except 5.32 and 5.34) and the BIO2 government measures that are relevant to it (except 5.32.01 to 5.34.01), and lets it swap in or combine controls from another framework only at an equivalent level that it can show. The Cyberbeveiligingsregeling IenW (BWBR0052878, arts. 6 to 8) says the same for waterschappen.

Have an adopted security policy for your network and information systems, put it in writing and apply it demonstrably (art. 6(1)). Set the roles, responsibilities and authorities for the security of those systems, and keep conflicting roles, responsibilities and authorities apart as far as possible (art. 6(2)). Require your staff and everyone else who works in the entity to apply the security in line with the policy (art. 6(3)). Run a management system for the security of your network and information systems, so you can show that you meet Cyberbeveiligingswet art. 21 (art. 6(4)). Government bodies run that management system on ISO 27001:2023, including its scope, and keep an overview of their crucial network and information systems as part of it: the Cyberbeveiligingsregeling sector overheid (BWBR0052963, arts. 3 and 4) sets this, and the Cyberbeveiligingsregeling IenW (BWBR0052878, arts. 6 and 7) sets it for waterschappen. Other essential and important entities in the sectors that IenW regulation covers also record, as part of the management system, which risk-management measures (processes and controls) are monitored, measured, analysed and evaluated, by which methods, when, and by whom (Cyberbeveiligingsregeling IenW art. 10). Exclude this only if the Account is exclusively one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. An entity that is only partly one of those types keeps both sets.

Have an adopted risk management policy for the security of your network and information systems, put it in writing and apply it demonstrably (art. 7(1)). The policy covers at least a risk management method and criteria for accepting risk (art. 7(2)). Set processes and procedures for risk analysis, risk assessment and risk treatment, and apply them demonstrably (art. 7(3)). From the risk analysis, draw up an overview of the risks to the security of your network and information systems (art. 7(4)). Based on that overview, set security requirements for your network and information systems; where the analysis gives reason, take measures that secure them in a structural and demonstrable way (art. 7(5)). Articles 10 and 11 of the decree measure your suppliers and acquisitions against these requirements. Exclude this only if the Account is exclusively one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. An entity that is only partly one of those types keeps both sets.

Have an adopted incident handling policy, put it in writing and apply it demonstrably (art. 8(1)). Set the roles, responsibilities and authorities to detect incidents in time, analyse and assess them, respond to them, limit their effect, remove their cause and recover from them, document them, report them and learn from them (art. 8(2)). Set processes and procedures to monitor relevant events in your network and information systems so you can detect, analyse and classify incidents, and apply them demonstrably (art. 8(3)). Set processes and procedures for the same six activities as in paragraph 2, and apply them demonstrably (art. 8(4) and (5)). Log the events in your network and information systems that matter for their security, keep the logs for a set period and protect them against unauthorised change (art. 8(6)). Exclude this only if the Account is exclusively one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. An entity that is only partly one of those types keeps both sets.

Have an adopted business continuity policy for your network and information systems, put it in writing and apply it demonstrably (art. 9(1)). Set processes and procedures that secure your business continuity, including at least restoring your network and information systems and making and periodically verifying the reliability of backups of software and data; apply them demonstrably and test them periodically (art. 9(2)). Have an adopted business continuity plan, put it in writing, apply it when an incident endangers continuity and test it periodically (art. 9(3)). Have a recovery plan, put it in writing, apply it in case of an incident and test it periodically (art. 9(4)). Have a crisis management plan, put it in writing, apply it in a crisis, and test and exercise it periodically; it holds at least the tasks, responsibilities and authorities of staff and others in a crisis, a description of the means of communication in a crisis, and, when appropriate, a description of the emergency facilities available, including secured emergency communication (art. 9(5)). The Cyberbeveiligingsregeling IenW (BWBR0052878, art. 11) elaborates this for essential and important entities in its sectors: the backup procedures say which software and data are backed up and set recovery times and recovery points, safeguards for the completeness, accuracy, integrity, confidentiality and availability of backups and for restoring from them, and retention periods; the business continuity plan takes the risk assessment of art. 7 into account and holds its purpose and scope, tasks and responsibilities, key contacts and communication channels, conditions to activate and deactivate it, the resources required including backups and redundancy, and the conditions to recover and resume activities. Exclude this only if the Account is exclusively one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. An entity that is only partly one of those types keeps both sets.

Have an adopted supply chain security policy; in it, set how you deal with your dependence on the products and services of suppliers and service providers that can affect the security of your network and information systems. Put the policy in writing and apply it demonstrably (art. 10(1)). Check whether your direct suppliers and direct service providers meet the security requirements you set under art. 7(5), and check this periodically (art. 10(2)). Exclude this only if the Account is exclusively one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. An entity that is only partly one of those types keeps both sets.

Based on the security requirements of art. 7(5), have an adopted policy to mitigate and control the risks from acquiring software, hardware or services that relate to your network and information systems. Put the policy in writing and apply it demonstrably (art. 11(1)). Where it applies, set processes and procedures for the secure development of your network and information systems, covering every development phase, and apply them demonstrably (art. 11(2)). Set processes and procedures for the maintenance and management of your network and information systems, covering at least configuration management and change management, and apply them demonstrably (art. 11(3)). The Cyberbeveiligingsregeling IenW (BWBR0052878, art. 12) elaborates this for essential and important entities in its sectors: the maintenance processes cover at least security testing and security patch management (patches from trusted sources, checked for integrity and, where appropriate, tested before production, and applied within a reasonable time or the reason for not doing so is documented); you also detect and prevent malicious and unauthorised software, run vulnerability scans where appropriate and record the results, evaluate your exposure to vulnerabilities and threats, remedy vulnerabilities without delay or document why not, and segment your network and information systems into networks or zones in line with the risk analysis and, where appropriate, from those of third parties. Exclude this only if the Account is exclusively one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. An entity that is only partly one of those types keeps both sets.

Make sure your staff and the other people who work in the entity, as far as relevant to their function, are aware of the risks to the entity's network and information systems and apply cyber hygiene practices (art. 12(1)). Designate the staff and other people whose roles, responsibilities and authorities require skills and expertise in the security of network and information systems, and make sure they receive regular training on that security (art. 12(2)). Exclude this only if the Account is exclusively one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. An entity that is only partly one of those types keeps both sets.

Have an adopted policy on the use of cryptography, put it in writing and apply it demonstrably (art. 13(1)). Set processes and procedures on the use of cryptography, and apply them demonstrably (art. 13(2)). The policy and the processes and procedures work out at least when cryptography is used, which types of encryption are used and how, who in the entity is responsible for implementing cryptography, and who is responsible for key management (art. 13(3)). Exclude this only if the Account is exclusively one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. An entity that is only partly one of those types keeps both sets.

Designate the staff and other people who work in the entity and give them roles, responsibilities and authorities for the security of your network and information systems (art. 14(1)). Evaluate that designation periodically and update it where needed (art. 14(2)). Set reliability requirements that your staff and other people who work in the entity must meet, as far as appropriate and necessary for their tasks on the security of the entity's network and information systems (art. 14(3)). Exclude this only if the Account is exclusively one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. An entity that is only partly one of those types keeps both sets.

Have an adopted policy on logical and physical access to your network and information systems, put it in writing and apply it demonstrably (art. 15(1)). The policy covers at least issuing, monitoring, using, changing and withdrawing identities and authorisations, and managing them (art. 15(2)). Check identities, means of authentication and authorisations periodically for necessity, correctness and currency, and change them where needed (art. 15(3)). The Cyberbeveiligingsregeling IenW (BWBR0052878, art. 13) adds for essential and important entities in its sectors that the policy covers privileged accounts and system administrator accounts: strong identification, authentication and authorisation procedures for them, system administration privileges that are as far as possible individual and limited, and privileges used only for system administration. Exclude this only if the Account is exclusively one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. An entity that is only partly one of those types keeps both sets.

Have an adopted policy for managing the assets you use for your work or to provide your services, put it in writing and apply it demonstrably (art. 16(1)). The policy covers at least a system to classify assets at different levels, where applicable on the requirements for confidentiality, integrity and availability, and rules for the acceptable use of your assets (art. 16(2)). Set processes and procedures for managing your assets, and apply them demonstrably (art. 16(3)). Keep a complete and current inventory of your assets (art. 16(4)). Exclude this only if the Account is exclusively one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. An entity that is only partly one of those types keeps both sets.

When you are specifically alerted to vulnerabilities or cyber threats that are relevant to the security of your network and information systems, assess whether the measures taken under Cyberbeveiligingswet art. 21 need changes or additions, and record the result of that assessment in writing (art. 17(1)). Do the same for targeted security advisories and threat information that are relevant to your systems and that you receive from relevant organisations, including CSIRTs, competent authorities, other government bodies, direct suppliers and direct service providers (art. 17(2)). Exclude this only if the Account is exclusively one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. An entity that is only partly one of those types keeps both sets.

Evaluate periodically how effective the measures you took under Cyberbeveiligingswet art. 21(1) are and what effect they have in practice, and record the result in writing. Adjust the measures where the outcome of those evaluations calls for it. Exclude this only if the Account is exclusively one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. An entity that is only partly one of those types keeps both sets.

The board of the entity approves the measures of Cyberbeveiligingswet art. 21 (art. 24(1)). Every board member has the knowledge and skills to identify risks to the security of network and information systems, to assess cybersecurity risk-management measures, and to assess the effect of those risks and measures on the services the entity provides (art. 24(2)). Every board member meets this within two years of the rule coming into force, and a member appointed afterwards within two years of the appointment (art. 24(3)); the two-year period is the board members' training period. Keep that knowledge and those skills demonstrably current (art. 24(4)). To show them, every board member holds a certificate of taking part in a training that covers those topics (art. 24(5)). The Cyberbeveiligingsbesluit elaborates the training (arts. 20 to 22): art. 20 says its purpose is to enable the board member to identify risks to the security of network and information systems and judge their effect on the entity's services, and to assess cybersecurity risk-management measures and their effect; art. 21 says it covers at least the types of risk to network and information systems, risk management processes and the risk assessment method, and the topics of Cyberbeveiligingswet art. 21(3) points a to j; art. 22 says the certificate holds at least the board member's name, the date or dates of the training, the topics covered and the name of the training provider, and is in Dutch or English. Where a legal person is the board or a board member, the rules apply to the natural persons who sit on the board on its behalf (art. 24(7)). Where the entity has a two-tier board under Book 2 of the Civil Code (arts. 129a or 239a), they apply to its executive directors only (art. 24(8)); for a maatschap they apply to every partner, for a vennootschap onder firma to every partner, and for a commanditaire vennootschap to its managing partners (art. 24(9) to (11)). For a government body that is an essential entity, the board is the minister for a ministry, the independent administrative body itself, gedeputeerde staten for a province, the college of mayor and aldermen for a municipality, the dagelijks bestuur for a waterschap, and for a joint arrangement the dagelijks bestuur of the public body, the board of the operations organisation or the common body (art. 24(12)). The article does not apply to an entity to which Cyberbeveiligingswet art. 21 does not apply (art. 24(13)).

Report every significant incident under arts. 26 to 29 (art. 25(1)). An incident is significant if it causes or can cause a severe operational disruption of the services or financial loss for the entity, or has affected or can affect other entities by causing considerable material or non-material damage (art. 25(2)). A ministerial regulation or decision can set criteria for what is significant, by sector, subsector, type of entity or entity; for the entities where EU implementing acts under Directive (EU) 2022/2555 art. 23(11) already say when an incident is significant, it can add criteria (art. 25(3) and (4)); Cyberbeveiligingsbesluit art. 23 gives the competent minister that power, requires them to evaluate the criteria at least every four years, and requires an entity that holds a decision that is specific to it to keep that decision confidential in its organisation. For government bodies, the Cyberbeveiligingsregeling sector overheid (BWBR0052963, art. 6) sets the criteria. In the central government subsector an incident is significant if it leads or can lead to an outage of the service of at least four hours, financial damage to the State or society of more than 500 million euros, serious injury or death of at least one person, misuse of business information with financial damage of more than 5 million euros, or unauthorised disclosure of confidential information at least at the level Staatsgeheim CONFIDENTIEEL, NATO CONFIDENTIAL or EU CONFIDENTIAL. In the decentralised government subsector it is significant if it leads or can lead to an outage of the service of at least four hours, financial consequences that the budget cannot absorb, or serious injury or death of at least one person. A planned service interruption or planned effect of maintenance is not a significant incident. The Cyberbeveiligingsregeling IenW (BWBR0052878, arts. 14 to 28) sets the criteria for the sectors it covers: transport, drinking water, wastewater, waste management, chemicals, research and others, and for waterschappen in art. 28 (the same three criteria as the decentralised government subsector).

Send an early warning about a significant incident to your CSIRT and your competent authority, without delay or, if that is not possible, within 24 hours of learning about the incident (art. 26(1)). In the early warning, state whether the incident is suspected to be caused by an unlawful or malicious act, state whether it can have cross-border effects, and give the contact details of the officer who is responsible for the report (art. 26(2)). Cyberbeveiligingsbesluit art. 24 adds that the early warning holds the suspected time the incident began and, where possible, a description of its nature and the effects that are noticeable at that moment, a forecast of the recovery time, and the measures the entity plans or has taken to limit the effects of the incident or to prevent it from recurring.

Send a notification to your CSIRT and your competent authority without delay or, if that is not possible, within 72 hours of learning about the significant incident. It holds, where applicable, an update of the early warning information, an initial assessment of the incident including its severity and effects, the indicators of compromise where available, and all information that lets the CSIRT and the competent authority determine any cross-border effects (art. 27(1)). A trust service provider notifies without delay or, if that is not possible, within 24 hours when the incident affects the provision of its trust service (art. 27(2)). Cyberbeveiligingsbesluit art. 25 says the notification goes to the reporting point that the Minister has set up for it (the meldpunt).

As part of the notification of art. 27(1), send an interim report on relevant updates of the situation when your CSIRT or competent authority asks for it (art. 28).

Send a final report to your CSIRT and your competent authority no later than one month after the notification of art. 27(1). It holds a detailed description of the incident, its severity and its effects; the type of threat or root cause that probably led to it; the mitigation measures applied and in progress; and, where applicable, the cross-border effects (art. 29(1)). If the incident is still ongoing when the final report is due, send a progress report on those aspects instead, and send the final report within one month after the incident has been handled (art. 29(2)).

Where appropriate, inform the recipients of your services without delay of significant incidents that can adversely affect the provision of those services (art. 30(1)). Tell the recipients who may be affected by a significant cyber threat in relation to the services they receive, without delay, which measures they can take in response, and, where necessary, also inform them of the significant cyber threat itself (art. 30(2)).

For registration in the national register, give the Minister the following through the mechanism set up for it: the name of the entity; its address and current contact details, including e-mail addresses, IP ranges and telephone numbers; where applicable, the sectors and subsectors of annex 1 or 2 of the Act that it belongs to; where applicable, the EU member states where it provides its services under annex 1 or 2; where applicable, its joining or leaving of an information-sharing arrangement; and where applicable, the other data that a general administrative order names (art. 44(1)). Report every change in that information to the Minister without delay and in any case within two weeks of the date of the change (art. 44(2)). Cyberbeveiligingsbesluit art. 27 adds the data to give: whether you register as an essential entity, an important entity or an entity that provides domain name registration services; your Chamber of Commerce number under the Handelsregisterwet 2007, or the comparable registration number of the country where you are established, and for a government body in the Register van Overheidsorganisaties the identification code it has there; and, for an essential or important entity, where applicable the type of entity of annex 1 or 2 of the Act that it is, and its domain names.