The Dutch Cybersecurity Act (Cbw): what is required of you since 15 August 2026
On 15 August 2026 the Dutch Cybersecurity Act (Cyberbeveiligingswet, Cbw) came into force, implementing the European NIS2 directive in the Netherlands. More than 8,000 organisations fall under it. Here is what you need to know. Updated on 27 October 2026.
What is the Cybersecurity Act?
The Cybersecurity Act (Cbw) is the Dutch implementation of NIS2. The Senate approved it on 7 July 2026 and it has applied since 15 August 2026. It replaces the Network and Information Systems Security Act (Wbni). According to the NCSC, more than 8,000 organisations fall under the act, split into essential and important entities in sectors such as energy, transport, healthcare, digital infrastructure, government, waste management, manufacturing and food.
The obligations under the Cbw
Duty of care
You take appropriate technical and organisational measures to secure your network and information systems.
Reporting obligation
You report a significant incident within 24 hours (early warning), within 72 hours (notification) and with a final report within one month.
Registration obligation
You register your organisation with the regulator, so it is clear who falls under the act.
Board responsibility
The board approves the measures, oversees them and takes training itself.
Essential and important entities
The Cbw has two categories. Which one applies to you depends on your sector and size.
| Topic | Essential entity | Important entity |
|---|---|---|
| Supervision | In advance and ongoing (proactive) | Afterwards, following signals (reactive) |
| Maximum fine under NIS2 | €10 million or 2% of global annual turnover | €7 million or 1.4% of global annual turnover |
| Duty of care, reporting and registration | Yes | Yes |
How to approach it
- Use the NCSC self-assessment to check whether your organisation falls under the Cbw
- Register your organisation with the regulator
- Carry out a risk analysis and document your security policy
- Take technical measures: endpoint security, detection, patch management, access management
- Set up a reporting procedure that meets the 24 and 72 hour deadlines
- Make agreements with suppliers in the chain
- Have the board take training
How Spiredesk and Xcitium help
Xcitium covers the technical measures of the duty of care, and lets you demonstrate them. Spiredesk maps what you already have and what is missing. For legal advice we refer you to a specialist.
- ✓ Baseline with the free gap assessment
- ✓ Endpoint security, EDR and a 24/7 SOC
- ✓ Patch and vulnerability management
- ✓ Compliance reports for regulator and auditor
Complete your coverage
NIS2 and the Dutch Cybersecurity Act
What the Dutch Cybersecurity Act requires and how Xcitium helps.
ViewCompliance management
Continuous checks of measures against NIS2, DORA, GDPR, ISO and more.
ViewInformation security gap assessment
Your measures compared with ISO 27001, NIST or CIS, with an improvement plan.
ViewRansomware attack: the first hour
Step by step: what to do in the first hour after a ransomware attack.
ViewFrequently asked questions
Does my organisation fall under the Cbw?
That depends on your sector and size. In the sectors covered it usually concerns medium-sized and large organisations: from 50 employees or more than €10 million turnover. The NCSC self-assessment gives you a quick answer.
We are not covered. Do we still need to do anything?
Often, yes. Organisations under the Cbw also have to assess their suppliers, so as a supplier you will increasingly be asked about your security.
What happens if we do nothing?
The regulator can issue instructions and fines. Under NIS2 the maximum fines for essential entities run up to €10 million or 2% of global annual turnover.
Does Xcitium make us Cbw compliant?
No, no single product does that on its own. Xcitium covers the technical measures and provides evidence. The organisational measures, such as policy, registration and board training, remain your responsibility.
The Dutch Cybersecurity Act (Cbw) in your environment?
In a short demo we show you how it works, discuss your situation and make a proposal. No obligation, in English or Dutch.
Product information: xcitium.com. Xcitium, ZeroDwell, OpenEDR and related logos are trademarks of Xcitium Inc.