What changes with the Dutch Cyber Security Act?
The Cyberbeveiligingswet is the Dutch implementation of NIS2. Track NCSC for the exact effective date and the lower regulations.
Try this first
- 1Three pillars match NIS2: duty of care, notification duty, and board responsibility.
- 2Duty of care means technical and organisational measures proportional to risk, documented like an ISMS.
- 3Notification: significant incidents go to CSIRT and the supervisor within the statutory window. Confirm timing via NCSC.
- 4Board responsibility: directors must adopt and follow the policy, train, and can be personally liable. Record the decision in board minutes.
- 5Follow the bill via tweedekamer.nl and NCSC for the final date and secondary rules.
When to bring us in
Essential entity with no ISMS in place yet? You will not make it solo. Bring in external help early.
See also
- Does NIS2 apply to my company?Two questions decide it: are you in a listed sector, and do you meet the threshold from Recommendation 2003/361/EC (more than 50 FTE and more than EUR 10M turnover or balance sheet). Below that you are only indirectly in scope, via your customers. The threshold determines whether you are an important or essential entity depending on sector.
- Am I personally liable as a director under NIS2?Yes. The board is accountable for approving and overseeing the cyber measures. Severe negligence can become personal.
- What is a processing register and how do I build one?A list per processing activity: what data, what purpose, how long, who shares it. Mandatory under GDPR Art. 30; the under-250-staff exemption falls away as soon as processing is structural or high-risk, which is essentially always the case for SMBs handling customer data.
None of the above fits?
Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.
Or skip the DIY entirely
Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.