Cybersecurity Act now in force: what does this mean for your organisation?

The Cyber Security Act (Cbw) has been in force since 15 August 2026. At the same time, the Critical Entities Resilience Act (Wwke) also came into force. For many organisations in the Netherlands, this means complying with new, specific obligations in the field of digital resilience.
Please note: the Cbw applies throughout the entire supply chain. This means that your contracts with customers and suppliers may suddenly need to include a cyber security component.

So it’s high time you found out where you stand; we’ll bring you up to speed in three short questions.

What is it?

The Cybersecurity Act is the Dutch implementation of the European NIS2 Directive, which sets out measures to ensure a high common level of cybersecurity across the EU.

The aim of the Cybersecurity Act (Cbw) is to better protect key social and economic processes against digital threats, so that a cyber incident does not immediately bring the whole of society to a standstill. The Act replaces the former Network and Information Systems Security Act (Wbni) and immediately raises the bar considerably.

What does it say?

The Cyber Security Act (Cbw) identifies the organisations that must assess and manage their cyber risks, prevent incidents as far as possible and limit their consequences. The organisations in question have three key obligations: a registration obligation, a duty of care and a reporting obligation.

• Registration requirement – this means that the organisation must be registered in the national register of entities at the National Cyber Security Centre (NCSC), via mijn.ncsc.nl.
• Duty of care – comprises around 10 measures that the organisation must take in all cases, including drawing up policies, ensuring the organisation’s continuity following an incident and assessing the supply chain.
• Reporting obligation – the obligation to report significant incidents within the statutory time limit (in principle within 24 hours) to the CSIRT (Computer Security Incident Response Team) and the supervisory authority.

Important detail: the Act explicitly places ultimate responsibility with the board. Directors must have sufficient knowledge to be able to assess the risks and the measures to be taken. It is advisable for directors and staff to undertake training for this purpose where necessary.

Which organisations does the Act apply to?

Does your organisation fall within its scope? You can determine this in three steps; see also the NCTV website:

1. Sector – The Act applies to eighteen sectors, including energy, transport, banking, drinking water, digital infrastructure and healthcare.
2. Size – Next, you need to look at the number of employees, annual turnover and balance sheet total.
3. Essential or important? – If you find that you fall within the scope of the Act, you must determine whether you are an essential or an important entity. The difference lies in the supervision: for essential entities, this is proactive; for important entities, it is reactive (ex-post checks).

Organisations are responsible for assessing whether they fall within the scope of the Act. The website of the NCTV (National Coordinator for Security and Counter-Terrorism) offers a handy self-assessment tool.

What does this mean for you?

The Cybersecurity Act is more than just an IT issue – it is a legal and administrative responsibility that has implications for both your policies and your contracts. We’d be happy to advise you: from determining whether you fall within the scope of the Act, to embedding cybersecurity provisions in your agreements with clients and suppliers.

Do you have any questions about the Cybersecurity Act, or would you like to discuss whether your organisation is covered by it? Please feel free to get in touch.