NIS2 and the Cyberbeveiligingswet: does my business fall under it?
Since 15 August 2026, the Cybersecurity Act has applied in the Netherlands. You may already have heard the term NIS2 from a customer, a supplier or an adviser. This article briefly explains what the law is, who it applies to and what it means for a small business that doesn't fall under it.
This article gives general information and is not legal advice. The current rules are published by the NCSC and in the text of the law.
What is it?
NIS2 is a European directive from 2022 (Directive (EU) 2022/2555) designed to make organisations in key sectors more digitally resilient. Each country transposes the directive into its own law. In the Netherlands, that law is the Cybersecurity Act (Cbw). The law has applied since 15 August 2026, with no transition period, and replaces the old Network and Information Systems Security Act (Wbni). According to the NCSC, more than 8,000 organisations fall under it. The NCSC is the point of contact.
Does my business fall under it?
That depends on two questions: your sector and your size.
1. Do you work in a sector listed in the law?
| Annex 1 | Annex 2 |
|---|---|
| Energy, transport, banking, financial market infrastructure, healthcare, drinking water, waste water, digital infrastructure, ICT service management, public administration, space | Postal and courier services, waste management, chemicals, food, manufacturing, digital providers, research |
Some sectors have additional conditions. So not every business that has something to do with food automatically falls under it.
2. Are you large enough? In short, medium-sized and large organisations fall under it. You count if you:
- have 50 or more employees (FTE), or
- have fewer than 50 employees, but your annual turnover and your balance sheet total both exceed 10 million euros.
Partner enterprises and linked enterprises count too. So a business with 20 employees that belongs to a group of 200 may still fall under it.
Exceptions, regardless of size. A few types of organisations always fall under it, no matter how small. For example DNS service providers, top-level domain name registries, providers of public electronic communications networks and services, trust service providers and government organisations. If you have been designated under the Critical Entities Resilience Act, you also fall under the Cybersecurity Act.
Check for yourself with the self-assessment
The Dutch Authority for Digital Infrastructure (RDI) offers a free NIS2 self-assessment. You answer questions about your sector, size and services and get a result. It also shows whether you are an essential or an important entity. The difference is mainly in supervision: for essential entities the regulator may also carry out checks on its own initiative, for important entities mainly after the fact. Does your business belong to a group or do you operate in multiple countries? Then the NCSC's guide to complex business models can help.
What do you need to do if you fall under it?
- Register. You register your organisation via MijnNCSC.
- Duty of care. You carry out a risk analysis and take appropriate and proportionate measures. The NCSC lists at least ten topics, including incident handling, backups and recovery, the security of your supply chain, training, updates, access management, multi-factor authentication or passkeys, encryption and testing whether your measures work. The management board approves the measures and oversees them.
- Reporting obligation. You report a significant incident via MijnNCSC: an early warning within 24 hours, a notification with an initial assessment of severity and impact within 72 hours, and a final report within one month.
This notification is separate from the data breach reporting obligation under the GDPR. That applies to everyone who processes personal data, including freelancers, and you report it to the Dutch Data Protection Authority. When something counts as a data breach and whether you need to report it is explained in Is this a data breach and do I need to report it? So an attack in which customer data was also stolen may need to be reported to both.
Don't fall under it? The supply chain can still affect you
Most small businesses don't fall under the law. In that case you have no registration obligation, no obligation to report to the NCSC and no supervision. But organisations that do fall under it must also take into account the risks at their direct suppliers and service providers. According to the NCSC, the law imposes no obligations on suppliers themselves, but customers may set requirements for their digital security. These then end up in a contract or a questionnaire.
Do you supply a larger organisation, for example as a web developer, IT administrator or accounting firm? Then you may get questions such as: do you use two-step verification, who has access to our data, where are the backups stored and how quickly do you report an incident?
- Requirements should be proportionate to the risk of your service. A supplier with access to the systems gets stricter requirements than the baker who delivers lunch.
- It concerns direct suppliers. Your suppliers' suppliers are outside its scope.
- The law does not require a certificate. It can help in the conversation, but it is no guarantee.
- Start in good time: map out which measures you already have in place and put agreements with your customer in writing.
Further reading
- NCSC: Cybersecurity Act (NIS2)
- NCSC: Does my organisation fall under the Cybersecurity Act?
- NCSC: Duty of care
- NCSC: Reporting obligation
- NCSC: The Cybersecurity Act and suppliers
- RDI: NIS2 self-assessment
- Text of the Cybersecurity Act
Want to learn more? Take the free course Safe Online for Entrepreneurs, lesson 9.1 NIS2 and the Cybersecurity Act.