The Dutch Cyberbeveiligingswet (Cbw) has applied since 15 August 2026, and more than 8,000 organisations now carry a duty of care, a registration duty and a reporting duty with no general transition period. The Cbw transposes NIS2 and replaces the Wet beveiliging netwerk- en informatiesystemen (Wbni). Unlike some Member States, the Netherlands spreads supervision across sector regulators, while the Nationaal Cyber Security Centrum (NCSC) runs the entity register. This guide covers who is in scope, the obligations in the Cbw and the Cyberbeveiligingsbesluit (Cbb), reporting and penalties, and what the duty of care means for service accounts, API keys and AI agents. It is for CISOs, compliance leads and board secretaries in organisations with Dutch operations. The directive is covered in the NIS2 Directive Guide; this page covers the Dutch layer.
Status checked 27 October 2026: adopted by the Tweede Kamer on 15 April 2026 and the Eerste Kamer on 7 July 2026, in force with the Wet weerbaarheid kritieke entiteiten (Wwke) from 15 August 2026. The Cbb was published in the Staatscourant in early July 2026. Ministerial regulations setting incident reporting thresholds were still being prepared according to the government's NIS2 dossier, so check the current position before relying on any threshold.
Key takeaways
- The law is live: registration in the NCSC entity register through mijn.ncsc.nl became mandatory on 15 August 2026, and organisations must decide for themselves whether they fall under the Cbw.
- Supervision is sectoral: ten supervisors share the work, with the Rijksinspectie Digitale Infrastructuur (RDI) covering thousands of organisations in nine sectors, while CSIRTs handle the technical side of incidents.
- The duty of care is specified in secondary law: the Cbb covers the zorgplicht, registration and board training, and government bodies build on the Baseline Informatiebeveiliging Overheid (BIO2).
- Boards are personally in the frame: board members must approve and oversee measures, have sufficient knowledge and complete training, with fines reported at up to EUR 25,000 for failing the knowledge and skills requirement.
- Machine identities sit inside the zorgplicht: the measures cover network and information systems as a whole, so non-human identities and AI agents need inventory, ownership, least privilege and logging.
Scope: who and what is covered
The Cbw follows the directive's sectors and size rules: around 18 sectors, essential entities (essentiële entiteiten) and important entities (belangrijke entiteiten). The government puts the total at more than 8,000 organisations, including ministries, municipalities, provinces, water authorities, independent administrative bodies and inter-municipal partnerships.
| Question | Dutch answer |
|---|---|
| Who decides if you are in scope? | The organisation itself, under the Cbw. Under the Wwke (critical entities) the responsible minister designates entities on legal criteria, around 500 in total |
| Which law did it replace? | The Wbni, which covered a much smaller group of operators of essential services and digital service providers |
| Public sector? | Yes: central government, provinces, municipalities, water authorities and other public bodies are explicitly named by the government |
| Financial sector? | DORA prevails for financial entities on overlapping obligations and DNB is among the supervisors. See the DORA and NIS2 Overlap Mapping Guide |
| Groups? | Each Dutch legal entity assesses its own position, using the EU SME definition including linked and partner enterprises |
Who supervises whom
Ten supervisors share Cbw oversight: the ANVS, the Autoriteit Persoonsgegevens (AP), DNB, the Inspectie Gezondheidszorg en Jeugd (IGJ), the Inspectie Leefomgeving en Transport (ILT), the Inspectie Justitie en Veiligheid, the Inspectie van het Onderwijs, the NVWA, the RDI and Staatstoezicht op de Mijnen (SodM). The RDI alone supervises thousands of organisations across nine sectors. CSIRTs, including the NCSC, handle the technical response to incidents, while the supervisor handles compliance.
Confirm your competent authority through the NCSC register and the sector allocation in the Cbw, because an entity active in several sectors can answer to more than one supervisor.
Key obligations
Registration duty (registratieplicht)
- Where: the entiteitenregister run by the NCSC, through mijn.ncsc.nl.
- How: login with eHerkenning, or SSOnRijk for certain public bodies, as reported by legal advisers. Secure the eHerkenning means: whoever holds it can change the registration.
- When: mandatory from 15 August 2026. Organisations that have not registered are already out of step with the law.
- What: the Cbb sets the registration requirements. Expect entity details, sector, contact points and IP ranges in line with directive Article 27.
Duty of care (zorgplicht)
- Principle: take appropriate and proportionate measures to manage risks to network and information systems and to prevent incidents or limit their impact.
- Detail: set out in the Cbb and sector rules. For government organisations, a ministerial regulation bases the duty of care on BIO2.
- Coverage: the measures mirror directive Article 21(2): risk analysis, incident handling, business continuity, supply chain, secure acquisition and development, effectiveness testing, cyber hygiene and training, cryptography, human resources security and access control, and multi-factor authentication.
Board obligations
- Approve and oversee: the board approves cybersecurity risk-management measures and oversees their implementation, and is ultimately responsible for cyber risk.
- Knowledge and training: board members must have sufficient knowledge and skills to identify risks and assess measures, and must follow training. Advisers report a two-year period for meeting the knowledge requirement after the provision takes effect.
Reporting duty (meldplicht)
| Stage | Deadline | Recipient |
|---|---|---|
| Early warning | Without undue delay, at the latest within 24 hours of becoming aware | The entity's CSIRT and the competent authority, via the meldportaal |
| Incident notification | Within 72 hours | Same |
| Final report | One month after the notification; if still ongoing, a progress report and then a final report within one month of resolution | Same |
Personal data breaches still go to the Autoriteit Persoonsgegevens under GDPR Article 33. See the Cyber Incident Reporting Requirements Map.
Timeline and current status
| Date | Milestone |
|---|---|
| 17 October 2024 | EU transposition deadline (missed) |
| 15 April 2026 | Tweede Kamer adopts the Cbw and Wwke |
| Early July 2026 | Cyberbeveiligingsbesluit published in the Staatscourant |
| 7 July 2026 | Eerste Kamer adopts both laws |
| 15 August 2026 | Cbw, Wwke and Cbb in force; registration mandatory |
| Pending (as of the government dossier) | Ministerial regulations on incident reporting thresholds and BIO2 duty of care |
| About two years after entry into force (as reported) | Board knowledge and skills requirement must be met |
There is no general grace period. Advisers expect supervisors to use discretion in the first months, but sanctions are not ruled out. Compare other countries in the NIS2 Transposition Tracker.
How the Dutch approach differs from its neighbours
| Feature | Netherlands (Cbw) | Typical alternative elsewhere |
|---|---|---|
| Who identifies entities | Self-assessment, then registration | Authority sends inclusion notices (Italy) or designates |
| Supervision | Ten sector supervisors, CSIRTs for technical response | One national authority (France, Belgium) |
| Technical detail | Cyberbeveiligingsbesluit plus sector rules; BIO2 for government | National referential or framework published by the authority |
| Transition | No general grace period after 15 August 2026 | Staged deadlines from notice or publication |
| Board sanctions | Specific fine for board knowledge and skills failures (as reported) | Temporary management bans for essential entities |
For multinational groups this means the Dutch entity cannot simply inherit the group's French or Italian timetable. Run the Dutch scope decision, registration and supervisor identification as a separate workstream, even if the control set underneath is shared.
Enforcement and penalties
| Measure | Essential entities | Important entities |
|---|---|---|
| Maximum administrative fine | EUR 10 million or 2% of worldwide annual turnover of the preceding financial year, whichever is higher (as reported by legal advisers) | EUR 7 million or 1.4% of worldwide annual turnover, whichever is higher |
| Other Cbw infringements | Up to EUR 1 million | |
| Board members, knowledge and skills failure | Up to EUR 25,000 (as reported by legal advisers) | |
| Periodic penalty payment (last onder dwangsom) | Set case by case with a cap, no fixed statutory maximum | |
The figures above are from a law firm summary of the enacted Cbw. Confirm them in the consolidated text on wetten.overheid.nl before quoting them to a board. Supervisors also have the usual Dutch administrative tools: binding instructions, orders subject to penalty and publication.
What it means for AI agents and non-human identities
The zorgplicht explicitly reaches access control and multi-factor authentication through directive Article 21(2)(i) and (j). In most estates, machine identities outnumber people, hold standing privileges and are reviewed least. A supervisor assessing access control will therefore look past the human joiner, mover and leaver process to the service accounts, pipeline tokens and agent credentials that run production every day. The Snowflake breach showed the cost: credentials without MFA, rotation or network allow lists opened about 165 customer environments (see the Snowflake breach).
| Duty of care area | NHI and agent control | Evidence for the supervisor |
|---|---|---|
| Access control (21(2)(i)) | Named owner for every service account, key, certificate and agent; least privilege; removal of dormant identities | NHI inventory, review records, removal log |
| Authentication (21(2)(j)) | MFA for people; workload identity federation or short-lived tokens for machines; secrets in a vault | Vault coverage and static key exception list |
| Supply chain (21(2)(d)) | Inventory of OAuth grants and API keys held by suppliers and SaaS integrations | Supplier access register, contract clauses |
| Incident handling (21(2)(b)) | Ability to revoke and rotate machine credentials within hours | Revocation runbook and exercise results |
| Effectiveness (21(2)(f)) | Test agent permissions and tool access, not only human access | Test reports and remediation tracking |
- Agents as accountable identities: each AI agent needs its own identity, scoped permissions and an audit trail linking actions to the human owner. See the Agent Identity and Access Guide.
- eHerkenning is an identity too: the means used to manage the NCSC registration should be held by named people, with deputies, and reviewed like any privileged access.
Compliance steps
- Self-assess scope per legal entity: sector, size and any size-independent category. Document the reasoning.
- Register now if you have not: mijn.ncsc.nl with eHerkenning. Record who did it and when.
- Identify your supervisor and CSIRT: confirm through the register and sector guidance, especially if you operate in several sectors.
- Brief and train the board: minute approval of the measures, record training, and plan for the knowledge and skills requirement.
- Gap-assess against the Cbb: use ISO/IEC 27001 controls where you have them, or BIO2 for government. The ISO 27001 to NIS2 and DORA Mapping Guide helps.
- Set up the reporting route: criteria for a significant incident, decision owner, access to the meldportaal and a rehearsed 24-hour early warning.
- Bring NHIs under control: inventory, owners, vaulting, rotation and dormant identity removal, starting with credentials that reach production and suppliers.
- Watch for ministerial regulations: update reporting thresholds and sector rules as they are published.
Small versus large organisations
- Medium-sized important entities: focus on registration, board training, MFA, a vault for production secrets and a simple incident route. Use a managed service provider if needed, but keep the supplier's own access to your systems under review.
- Large essential entities: expect proactive supervision. Assign control owners, automate evidence, and run continuous NHI discovery rather than an annual list.
Framework mapping
| Cbw obligation | NIST CSF 2.0 | NIST SP 800-53 r5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Board approval and training | GV.RR-01, GV.OV-01 | PM-2, AT-2 | A.5.1, A.6.3 |
| Access control and authentication | PR.AA-01, PR.AA-05 | AC-2, AC-6, IA-4, IA-5 | A.5.15 to A.5.18, A.8.2, A.8.5 |
| Supply chain | GV.SC-01 | SR-3 | A.5.19 to A.5.21 |
| Detection and logging | DE.CM-01, PR.PS-04 | AU-2, AU-6 | A.8.15, A.8.16 |
| Meldplicht | RS.CO-02 | IR-6 | A.5.24, A.5.26 |
Detection and measurement
- Registration accuracy: register entry reviewed in the last quarter, with changes made promptly.
- Board training coverage: percentage of board members with recorded cybersecurity training.
- NHI ownership: share of service accounts, keys and agents with an owner and a review within 12 months.
- Static secret reduction: number of long-lived credentials in production, trending down.
- Early warning time: time from detection to draft early warning in exercises, against 24 hours.
Common failure patterns
- Assuming the old Wbni scope: many organisations that were never operators of essential services are now in scope.
- Waiting for supervisors to call: under the Cbw organisations self-identify; nobody will send an inclusion notice.
- Board training as a slide deck: the requirement is knowledge sufficient to assess risks, and training must be provable.
- Ignoring machine credentials: human MFA is rolled out while integration tokens and agent keys keep broad, permanent access.
- Treating group policy as Dutch evidence: a group security policy written for ISO/IEC 27001 certification rarely shows how the Dutch entity meets each Cbb requirement, who owns it locally and where the records are. Supervisors will ask for the entity-level picture, including which suppliers and integrations hold credentials into Dutch systems.
- Single reporting clock: planning only for the AP 72-hour deadline and missing the 24-hour early warning to the CSIRT and supervisor.
Practitioner checklist
- Record the scope decision for every Dutch legal entity.
- Confirm registration on mijn.ncsc.nl and the named eHerkenning holders.
- Identify the competent supervisor and CSIRT for each entity.
- Minute board approval of measures and keep training evidence.
- Complete a gap analysis against the Cbb or BIO2.
- Rehearse 24-hour, 72-hour and one-month reporting through the meldportaal.
- Inventory non-human identities and AI agents with owners, scopes and rotation.
- Track new ministerial regulations and update thresholds.
- Review supplier and SaaS integration credentials that reach Dutch systems, and revoke those without an owner.
Standards and references
- Rijksoverheid: Cyberbeveiligingswet en Wwke vanaf 15 augustus 2026 van kracht
- Rijksoverheid: Tweede Kamer stemt in met Cbw en Wwke
- Dutch Digital Government: NIS2 Directive and Cyberbeveiligingswet
- EUR-Lex: Directive (EU) 2022/2555 (NIS 2)
- Bijzonder Strafrecht: Cbw en Wwke, sectoraal toezicht
- Clyde & Co: Dutch Cybersecurity Act enters into force on 15 August 2026
Related NHI Mgmt Group resources: NIS2 Directive Guide · NIS2 Readiness Checklist · NIS2 Transposition Tracker · Non-Human Identity (NHI) Guide. This guide summarises the Dutch Cyberbeveiligingswet as it stood on 27 October 2026 and is not legal advice.