The EU directive covers defined entity types in Annexes I and II, normally subject to a size test, with important exceptions for some services and entities. Dutch Cbw scope depends on the activity, size, designation and sector rules. Covered organizations are classed as essential or important and should confirm their status rather than infer it from an industry label.
Law and regulation / EU directive and Dutch implementing law
NIS2 / Dutch CyberbeveiligingswetCyber resilience for essential and important services
NIS2 sets a common EU floor for cyber risk management and incident reporting across critical sectors. Dutch organizations should assess their duties under the Cyberbeveiligingswet (Cbw), which implements the directive locally; the directive alone is not a universal certification scheme.
Start with applicability
What it actually covers
Disruption at a healthcare provider, digital infrastructure operator or other critical service can spread beyond one organization. NIS2 therefore links board oversight, all-hazards risk reduction, continuity and rapid reporting to the services people rely on.
NIS2 is a directive, so national implementation and sector-specific rules matter. A company's ISO/IEC 27001 certificate, supplier questionnaire or sector membership cannot by itself establish Cbw applicability or legal compliance. Where DORA provides equivalent sector-specific ICT duties for a financial entity, the DORA route takes precedence for those duties; check the applicable supervisory and reporting route.
The substance
Key areas to understand
An original operational reading of the official framework or legal text. Check the source for the authoritative wording.
Who is covered
Map the actual legal entity, services, sector, size and any special designation against the Dutch Cbw. Record whether it is essential or important and which authority and CSIRT apply.
Management responsibility
The management body approves cyber risk measures, oversees their implementation and needs enough training to make informed decisions. Treat this as an operating cadence with decisions and follow-up, not a one-off sign-off.
Risk controls across the service
Build proportionate measures for risk analysis, incident handling, backup and recovery, supplier security, secure acquisition and maintenance, vulnerability work, effectiveness checks, training, cryptography, access and appropriate multi-factor authentication.
Significant incident reporting
In the Dutch route, sector-specific thresholds determine what is significant. NCSC describes a 24-hour early warning, a 72-hour follow-up and a final report within one month after the notification, counted from awareness where relevant. Special sectors and trust services can have different routes or timing.
Registration and supervision
Covered Dutch entities register in the national entity register. Keep registration details, the responsible contact and supervisory correspondence current, and prepare to demonstrate that controls work in practice.
From reference to work
A practical starting sequence
These steps organize work; they are not a claim that a short checklist completes the requirement.
Determine scope before building a checklist
Document each legal entity, critical service, sector classification, size test, national designation and applicable reporting authority; revisit after acquisitions or service changes.
Connect risks to service outcomes
For each important service, identify dependencies, credible incidents, recovery tolerances and the owners of preventive and recovery measures.
Exercise a significant-incident clock
Run a tabletop from discovery through threshold decision, 24-hour warning, 72-hour update, stakeholder communications and final report; include after-hours escalation.
Review supplier concentration and assurance
Identify direct suppliers that support essential delivery, test their response and recovery commitments, and track remediation through management review.
Make it inspectable
Evidence to look for
The right records depend on the entity, scope and chosen assessment route.
- Scope and registration record
A dated legal-entity and service assessment, Cbw classification, sector thresholds, NCSC registration and designated contacts.
- Board oversight trail
Approved risk policy, management training, risk decisions, exceptions and review minutes showing corrective action.
- Control and continuity proof
Risk register, supplier assessments, access reviews, backup and restore results, vulnerability handling and measured control effectiveness.
- Incident reporting file
Detection and awareness timestamps, significance decision, submitted notices, CSIRT/authority correspondence, customer communications and lessons learned.
Illustrative situation
What this could look like
A Dutch cloud service provider discovers a compromise affecting a critical service. Its team first checks whether the event crosses its sector's significant-incident threshold, preserves the awareness timestamp, activates containment and continuity plans, and uses the applicable NCSC route for staged reporting. The board reviews impact and recovery evidence after the incident.
Keep the role clear
NIS2 is a directive, so national implementation and sector-specific rules matter. A company's ISO/IEC 27001 certificate, supplier questionnaire or sector membership cannot by itself establish Cbw applicability or legal compliance. Where DORA provides equivalent sector-specific ICT duties for a financial entity, the DORA route takes precedence for those duties; check the applicable supervisory and reporting route.
Related, not equivalent
Where ISO/IEC can help
ISO/IEC 27001 offers an information security management system, 27005 supports risk work, 27035 supports incident management and 27036 supports supplier relationships. They can organize implementation evidence, while Cbw scope, duties and deadlines must still be assessed against law and sector rules.
Common distinctions
Questions worth asking
Does an ISO/IEC 27001 certificate make us NIS2 compliant?
No. It may provide useful assurance for part of the cyber risk program, but legal scope, board duties, registration, sector thresholds and incident reporting need their own assessment.
Do all Dutch healthcare providers fall under the Cbw?
No. Cbw scope uses its own sector, size and designation rules. Dutch care providers may still have a separate duty to work to NEN 7510 even when the Cbw does not apply.
When does the incident clock start?
NCSC describes the reporting stages from the point at which the organization becomes aware of a significant incident. Preserve the timeline and check the sector's significance threshold and any special reporting route.
Primary-source trail
Read the official material
Research checked 2026-10-20. Edition, applicability and implementation rules can change. The links below take you to the responsible publisher or authority.