Board approval and training

Catalog reference

The board of the entity approves the measures of Cyberbeveiligingswet art. 21 (art. 24(1)). Every board member has the knowledge and skills to identify risks to the security of network and information systems, to assess cybersecurity risk-management measures, and to assess the effect of those risks and measures on the services the entity provides (art. 24(2)). Every board member meets this within two years of the rule coming into force, and a member appointed afterwards within two years of the appointment (art. 24(3)); the two-year period is the board members' training period. Keep that knowledge and those skills demonstrably current (art. 24(4)). To show them, every board member holds a certificate of taking part in a training that covers those topics (art. 24(5)). The Cyberbeveiligingsbesluit elaborates the training (arts. 20 to 22): art. 20 says its purpose is to enable the board member to identify risks to the security of network and information systems and judge their effect on the entity's services, and to assess cybersecurity risk-management measures and their effect; art. 21 says it covers at least the types of risk to network and information systems, risk management processes and the risk assessment method, and the topics of Cyberbeveiligingswet art. 21(3) points a to j; art. 22 says the certificate holds at least the board member's name, the date or dates of the training, the topics covered and the name of the training provider, and is in Dutch or English. Where a legal person is the board or a board member, the rules apply to the natural persons who sit on the board on its behalf (art. 24(7)). Where the entity has a two-tier board under Book 2 of the Civil Code (arts. 129a or 239a), they apply to its executive directors only (art. 24(8)); for a maatschap they apply to every partner, for a vennootschap onder firma to every partner, and for a commanditaire vennootschap to its managing partners (art. 24(9) to (11)). For a government body that is an essential entity, the board is the minister for a ministry, the independent administrative body itself, gedeputeerde staten for a province, the college of mayor and aldermen for a municipality, the dagelijks bestuur for a waterschap, and for a joint arrangement the dagelijks bestuur of the public body, the board of the operations organisation or the common body (art. 24(12)). The article does not apply to an entity to which Cyberbeveiligingswet art. 21 does not apply (art. 24(13)).

Narrative — how we satisfy this requirement