NIS2 and the Cybersecurity Act: what do you need to arrange now?
Since 15 August 2026 the Dutch Cybersecurity Act (Cyberbeveiligingswet) applies, the Dutch implementation of the European NIS2 Directive. More than 8,000 organisations must register, demonstrably manage their cyber risks and report serious incidents quickly. Here you can read whether it applies to you, what is expected of you and how to start.
Updated on 16 October 2026It depends on your sector and your size.
Both must apply. What counts is the sector your organisation itself is active in, not the sector of your customers.
Sectors of high criticality
- Energy
- Transport
- Banking
- Financial market infrastructure
- Health
- Drinking water
- Waste water
- Digital infrastructure
- ICT service management
- Public administration
- Space
Other critical sectors
- Postal and courier services
- Waste management
- Chemicals
- Food
- Manufacturing, including machinery, electronics, electrical equipment, vehicles and medical devices
- Digital providers
- Research
Medium-sized or larger
- 50 or more employees (FTE)
- or fewer than 50, but an annual turnover and a balance sheet total of more than € 10 million each
- Employees and figures of partner and linked enterprises count
Some organisations are always covered, regardless of size, such as DNS service providers, providers of public electronic communications and public administration bodies. A minister can also designate a smaller organisation; you would be notified.
In doubt? Take the NIS2 self-assessment of the Dutch Authority for Digital Infrastructure (in Dutch). It also tells you whether you are an essential or an important entity. The obligations are largely the same; the difference lies in the maximum fines and in supervision. Essential entities can be inspected without cause, important entities mainly after the fact, for example after an incident.
Four obligations.
Registration
Register your organisation in the NCSC entity register, via mijn.ncsc.nl. You do this with eHerkenning at level EH2+, with an authorisation for your organisation. Among other things you provide your sector, a contact person and your network details, such as IP addresses and domain names. Registration has been mandatory since 15 August 2026. You report changes within two weeks.
Duty of care
You take appropriate and proportionate measures to manage the risks to your network and information systems, and to prevent incidents or limit their impact. The act lists the topics they must cover at a minimum:
- Risk analysis and security policy
- Incident handling
- Business continuity, with backup, recovery and crisis management
- Supply chain security
- Security in acquisition, development and maintenance, including vulnerability handling
- Assessing whether the measures work
- Basic cyber hygiene and cybersecurity training
- Cryptography and encryption
- Human resources security, access control and asset management
- Multi-factor authentication and secured communications, where appropriate
The Cybersecurity Decree (Cyberbeveiligingsbesluit) works these topics out in more detail. The act does not prescribe a certificate such as ISO 27001.
Reporting obligation
You report a significant incident through the NCSC reporting portal, which forwards it to your CSIRT and your supervisor. An incident is significant if it seriously disrupts your services, causes financial loss or can seriously affect others; the exact thresholds differ per sector. The deadlines are shown below.
Board responsibility
The board approves the measures and is responsible for them. Board members must have enough knowledge to assess cyber risks and measures, and take a training with a certificate for this.
Three deadlines, from the moment you know.
The clock starts as soon as you become aware of a significant incident. If you do not see an attack, you cannot report it in time.
- 1DiscoveryMoment 0
You become aware of a significant incident. From now on the deadlines run.
- 2Early warningWithin 24 hours
Is the incident likely malicious, and does it have cross-border impact?
- 3NotificationWithin 72 hours
An initial assessment of severity and impact, with indicators of compromise if you have them.
- 4Final reportWithin one month
What happened, the cause and the measures taken. If the incident is still ongoing, a progress report first.
An attack nobody sees is often discovered only after weeks. By then the damage is done, and the investigation only begins.
An attack is seen and contained as soon as it starts, and you receive an incident report with the facts you need for the notification.
Supervision and fines.
The supervisor for your sector can impose an order subject to a penalty or a fine. For breaching the duty of care or the reporting obligation, the maximum for an essential entity is € 10 million or 2% of worldwide annual turnover, whichever is higher. For an important entity it is a maximum of € 7 million or 1.4%.
Board members themselves can also be fined, up to € 25,000, if they do not meet their own obligations, such as the training.
Not covered yourself? Your customers may be.
The act does not impose its own obligations on suppliers. But organisations that are covered must secure their supply chain. If you supply them with ICT services, components or access to their systems, they can set requirements for your security: a questionnaire, contract terms or an audit.
Here too, the act does not prescribe a certificate. It does help if you can show what you have arranged, so you do not start from scratch with every customer.
The Cybersecurity Act on one page.
The questions to go through with your board: are you covered, is registration in order, are the ten duty-of-care topics covered, and does everyone know what happens during an incident.
Frequently asked questions
Does NIS2 apply to small businesses?
As a rule, no. The act applies from medium-sized organisations: 50 FTE or more, or an annual turnover and a balance sheet total of more than € 10 million each. Exceptions include DNS service providers, providers of public electronic communications, public administration bodies and organisations designated by a minister. Customers who are covered can, however, set requirements for you as a supplier.
What is the difference between NIS2 and the Cybersecurity Act?
NIS2 is European Directive (EU) 2022/2555. The Cybersecurity Act (Cyberbeveiligingswet) is the Dutch law that implements it, together with the Cybersecurity Decree. It replaces the Dutch Network and Information Systems Security Act (Wbni) and covers many more sectors and organisations.
Do we need ISO 27001 certification?
No. The act and the decree do not prescribe a certificate. A standard like ISO 27001 can help show how you fulfil the duty of care, and some customers ask for it.
We have not registered yet. What now?
Registration has been mandatory since 15 August 2026 for organisations that are covered. Take the self-assessment first, then register as soon as possible via mijn.ncsc.nl. Make sure you have eHerkenning at level EH2+ with the right authorisation, and gather your network details beforehand.
Can Remarx tell us whether we are covered?
We are happy to go through the criteria with you, but we are not lawyers. The verdict comes from the self-assessment, the ministry for your sector or your lawyer. What we do help with: getting the measures the act requires demonstrably in order.
From obligation to measure.
Security Assessment & pentest
Where does an attacker get in? A security assessment shows where you are vulnerable: technically and organisationally.
Read moreCISO as a Service
Security leadership at board level. A full-time CISO easily costs € 10,000 to € 15,000 a month, if you can find one.
Read moreManaged Detection & Response
Monitoring that actually intervenes. A hijacked account is blocked within seconds to minutes, an infected laptop isolated: automatically, at night too.
Read moreSources
Consulted on 16 October 2026. Dutch sources are in Dutch.
- Cyberbeveiligingswet (Cybersecurity Act), in force from 15 August 2026 (articles 21, 24, 25 to 29, 44, 80, 87 and 93) · wetten.overheid.nl
- Cyberbeveiligingsbesluit (Cybersecurity Decree), in force from 15 August 2026 (articles 5 to 22) · wetten.overheid.nl
- Cybersecurity Act and Critical Entities Resilience Act in force from 15 August 2026 (7 July 2026) · Government of the Netherlands
- Does my organisation fall under the Cybersecurity Act (NIS2)? · NCSC
- Register your organisation for the Cybersecurity Act · NCSC
- Reporting incidents under the Cybersecurity Act · NCSC
- The Cybersecurity Act and suppliers · NCSC
- NIS2 self-assessment · Dutch Authority for Digital Infrastructure (RDI)
- Directive (EU) 2022/2555 (NIS2), Annexes I and II and articles 32 and 33 · EUR-Lex
This page is a plain-language summary and not legal advice. If you are unsure about your situation, consult the self-assessment, the ministry responsible for your sector or your lawyer.
Get acquainted in twenty minutes.
You speak directly with a specialist who knows the trade. You tell us what's going on; we tell you honestly whether and how we can help. Even if the answer is 'you don't need us'.
Pick a time
On working days, via Teams or phone. Choose a slot in our calendar and get an instant confirmation.
Open the calendar Prefer to call? 085 060 9448 · Or send a message