Loading...
Directive on measures for a high common level of cybersecurity across the Union - Dutch transposition as Cyberbeveiligingswet (Cbw)
The NIS2 Directive is being transposed into Dutch law as the Cyberbeveiligingswet (Cbw), replacing the current Wbni from 2018. It expands cybersecurity obligations to 18 sectors covering approximately 8,000 organisations in the Netherlands, with three core duties: duty of care (zorgplicht), incident reporting (meldplicht), and registration (registratieplicht).
18
Sectors
~8,000
Entities in NL
46
Directive Articles
Q2 2026
Expected
16 January 2023
NIS2 Directive entered into force (EU level)
17 October 2024
EU transposition deadline - Netherlands missed this deadline
18 June 2025
Cyberbeveiligingswet bill submitted to Tweede Kamer
Q2 2026
Expected entry into force of Cyberbeveiligingswet
24-hour early warning to CSIRT or competent authority. 72-hour full incident notification. 30-day comprehensive final report. Must indicate if incident is suspected to be unlawful or could have cross-border impact.
Risk analysis and information system security policies, incident handling, business continuity and crisis management, supply chain security, security in network and information system acquisition/development/maintenance, vulnerability handling and disclosure, assessment of cybersecurity risk-management effectiveness, basic cyber hygiene and training, cryptography policies, human resources security and access control.
Assess cybersecurity practices of direct suppliers and service providers. Incorporate cybersecurity risk-management measures into contractual arrangements. Maintain and monitor critical partner registries.
Management bodies must approve cybersecurity risk-management measures, oversee their implementation, and can be held liable for non-compliance. Members must undertake training to gain sufficient knowledge and skills to identify risks.
Zorgplicht (duty of care) - implement appropriate measures. Meldplicht (reporting obligation) - report incidents to authorities. Registratieplicht (registration) - register compliance status with supervisory authority.
EUR 10M or 2% worldwide turnover
Maximum of at least EUR 10,000,000 or 2% of total worldwide annual turnover, whichever is higher (NIS2 Art. 34(4)). Final Cbw amounts subject to parliamentary adoption.
EUR 7M or 1.4% worldwide turnover
Maximum of at least EUR 7,000,000 or 1.4% of total worldwide annual turnover, whichever is higher (NIS2 Art. 34(5)). Final Cbw amounts subject to parliamentary adoption.
We provide structured preparation and compliance support for NIS2 NL.
Schedule a consultation with our regulatory experts to assess your NIS2 NL compliance posture and build a practical roadmap.