Runs an essential service, in the Netherlands

Cyberbeveiligingsbesluit (Besluit van 8 juli 2026), Artt. 2, 4-13 en 24-25 · Read the law's page

• If you are an essential or important entity under the Cyberbeveiligingswet, take at least the measures of Articles 6 to 18 of the Cyberbeveiligingsbesluit to implement Article 21 of the Act (Article 5). A DNS service provider, top-level domain registry, cloud-computing, data-centre, content-delivery-network, managed-service or managed-security-service provider, online marketplace, online search engine, social-networking platform or trust service provider answers to Implementing Regulation (EU) 2024/2690 instead (Article 4).
• Record in writing, and apply demonstrably, policies on the security of your network and information systems, on risk management (with a risk-management method and risk-acceptance criteria), on incident handling, and on business continuity and crisis management (Articles 6 to 9).
• Record a supply-chain security policy and check periodically that your direct suppliers and service providers meet your security requirements (Article 10).
• Apply a policy for the risks of acquiring software, hardware or services, apply secure-development processes across all development phases where they apply, and apply maintenance processes that cover at least configuration management and change management (Article 11).
• Make your staff aware of the risks to your network and information systems, have them apply cyber-hygiene practices, and give those whose roles need security expertise regular training (Article 12); keep a written cryptography policy that sets out when cryptography is used and who is responsible for key management (Article 13).
• In the early warning of a significant incident, give the presumed start time of the incident and, where possible, a description of its nature and visible effects, an estimate of the recovery time and the measures you plan or have taken, and make the notification at the reporting point the Minister sets up (Articles 24 and 25).

Cyberbeveiligingswet, Artt. 21 en 24 · Read the law's page

• Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems you use for your work or to provide your services, and to prevent an incident or limit its effect on the recipients of your services and on other services.
• Cover at minimum: risk analysis and information-system security policy; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including the direct suppliers and service providers you rely on; security in acquiring, developing and maintaining your systems, including vulnerability handling and disclosure; policies to assess the effectiveness of your risk-management measures; basic cyber-hygiene practices and staff training; cryptography and, where applicable, encryption policy; personnel security, access control and asset management; and, where appropriate, multi-factor or continuous authentication, and secure voice, video, text and emergency communications.
• Have your management board approve these measures, and ensure every board member holds the knowledge and skills to identify network-and-information-system risks, assess your cybersecurity risk-management measures, and assess their consequences for your services, within two years of this duty taking effect or, for a member appointed afterwards, within two years of appointment.
• This binds an essential entity (Article 8 or 9) or an important entity (Article 12 or 13) drawn from Annex 1 or Annex 2; Annex 2's digital-provider entry names an online marketplace, an online search engine and a social-networking-services platform, and Annex 1's digital-infrastructure and ICT-service-management entries separately name a cloud-computing-service provider, a data-centre-service provider and a content-delivery-network provider, so a service in any of those six lines is reached at the medium-enterprise size threshold or above; the wider sector classes (energy, transport, banking, health, drinking water, public administration and the rest of the Annexes) are reached too, by declaring that you are an essential or important entity. A financial entity covered by Regulation (EU) 2022/2554 answers under that Regulation instead, because Article 22 sets this Article aside where a sector-specific act of the European Union is at least equivalent.

Cyberbeveiligingswet, Artt. 25-29 · Read the law's page

• This binds an essential entity (Article 8 or 9) or an important entity (Article 12 or 13) drawn from Annex 1 or Annex 2, on the same scope as this jurisdiction's companion risk-management row: Annex 2's digital-provider entry names an online marketplace, an online search engine and a social-networking-services platform, and Annex 1 separately names a cloud-computing-service provider, a data-centre-service provider and a content-delivery-network provider, each at the medium-enterprise size threshold or above; the wider sector classes are reached as on that row. A financial entity covered by Regulation (EU) 2022/2554 reports under that Regulation instead, because Article 31 sets Articles 25 to 30 aside where a sector-specific act of the European Union is at least equivalent.
• Give your CSIRT and competent authority an early warning without delay, or within 24 hours of becoming aware of a significant incident if immediate reporting is not possible, stating whether the incident is suspected to result from unlawful or malicious action and whether it may have cross-border effects.
• Follow with a notification, without delay or, if that is not possible, within 72 hours of becoming aware of the significant incident, updating the early warning with an initial assessment of the incident's severity and effects. If you provide a trust service and the incident affects its provision, file this notification without delay or, if that is not possible, within 24 hours of becoming aware of the incident instead.
• Submit an interim report if your CSIRT or competent authority asks for one.
• Submit a final report no later than one month after your notification, describing the incident in detail, its severity and effects, the likely threat or root cause, mitigating measures applied, and any cross-border effects; if the incident is still ongoing at that point, submit a progress report instead and the final report within one month of resolution.
• Where appropriate, inform the recipients of your service of the incident and of any measures they can take in response (Article 30).