Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details

Cyberbeveiligingsbesluit (Besluit van 8 juli 2026), Artt. 2, 4-13 en 24-25

In force since 15 Aug 2026.

A sector security regimes rule binding public and private bodies.

Obligation class: Security, Governance, Reporting

As of 12 October 2026.

What it requires

If you are an essential or important entity under the Cyberbeveiligingswet, take at least the measures of Articles 6 to 18 of the Cyberbeveiligingsbesluit to implement Article 21 of the Act (Article 5). A DNS service provider, top-level domain registry, cloud-computing, data-centre, content-delivery-network, managed-service or managed-security-service provider, online marketplace, online search engine, social-networking platform or trust service provider answers to Implementing Regulation (EU) 2024/2690 instead (Article 4).NIST CSF 2.0GV.OC-03
Record in writing, and apply demonstrably, policies on the security of your network and information systems, on risk management (with a risk-management method and risk-acceptance criteria), on incident handling, and on business continuity and crisis management (Articles 6 to 9).NIST CSF 2.0GV.PO-01
Record a supply-chain security policy and check periodically that your direct suppliers and service providers meet your security requirements (Article 10).NIST CSF 2.0GV.SC-01 NIST CSF 2.0GV.SC-07
Apply a policy for the risks of acquiring software, hardware or services, apply secure-development processes across all development phases where they apply, and apply maintenance processes that cover at least configuration management and change management (Article 11).NIST CSF 2.0PR.PS-06 NIST CSF 2.0PR.PS-01 NIST CSF 2.0GV.SC-06
Make your staff aware of the risks to your network and information systems, have them apply cyber-hygiene practices, and give those whose roles need security expertise regular training (Article 12); keep a written cryptography policy that sets out when cryptography is used and who is responsible for key management (Article 13).NIST CSF 2.0PR.AT-01 NIST CSF 2.0PR.AT-02 NIST CSF 2.0GV.PO-01
In the early warning of a significant incident, give the presumed start time of the incident and, where possible, a description of its nature and visible effects, an estimate of the recovery time and the measures you plan or have taken, and make the notification at the reporting point the Minister sets up (Articles 24 and 25).NIST CSF 2.0RS.CO-02

These lines are LexLint's reading of the law's text, as of 12 October 2026.

In the frameworks

NIST Privacy Framework

PR.PO-P2Configuration change control processes are established and in place.
PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.

NIST CSF 2.0

GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
GV.SC-01A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
GV.SC-06Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships
GV.SC-07The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship
PR.AT-01Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind

4 more

PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
PR.PS-01Configuration management practices are established and applied
PR.PS-06Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle
RS.CO-02Internal and external stakeholders are notified of incidents

CIS Controls

3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
3.10Encryption of sensitive data as it crosses networks.
3.11Encryption of sensitive data where it is stored on servers and applications.
6.8Access rights defined by job role, and kept up to date.
7.1A documented, reviewed approach to finding and handling weaknesses.
8.2Turning on and gathering logs from the enterprise's systems.

1 more

17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.

FINOS AIGF

AIR-PREV-005System Acceptance Testing
AIR-PREV-006Data Quality & Classification/Sensitivity
AIR-PREV-007Legal and Contractual Frameworks for AI Systems
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
AIR-PREV-012Role-Based Access Control for AI Data
AIR-PREV-014Encryption of AI Data at Rest

7 more

AIR-PREV-017AI Firewall Implementation and Management
AIR-PREV-020MCP Server Security Governance
AIR-PREV-024Human-in-the-Loop Action Approval Gate
AIR-DET-001AI Data Leakage Prevention and Detection
AIR-DET-004AI System Observability
AIR-DET-011Human Feedback Loop for AI Systems
AIR-DET-021Agent Decision Audit and Explainability

ENISA NIS2 guidance

1.1Policy on the security of network and information systems
1.2Roles, responsibilities and authorities
2.1Risk management framework
2.2Compliance monitoring
3.1Incident handling policy
3.2Monitoring and logging

11 more

3.4Event assessment and classification
3.5Incident response
3.6Post-incident reviews
4.1Business continuity and disaster recovery plan
4.3Crisis management
6.2Secure development life cycle
6.5Security testing
6.10Vulnerability handling and disclosure
9.1Cryptography
11.2Management of access rights
12.4Asset inventory

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Criminal exposure note

The decree creates no offence and sets no penalty of its own; the sanctions for breaching a measure it sets are those of the Cyberbeveiligingswet.

Who enforces it

Enforcement body

The competent authority for the entity's sector under the Cyberbeveiligingswet; the Minister of Justice and Security is the CSIRT and the coordinator for coordinated vulnerability disclosure (Article 2).

Settledness

As of: 12 October 2026

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

The Cyberbeveiligingsbesluit (Decree of 8 July 2026, Staatsblad 2026) implements the Cyberbeveiligingswet and, by Article 35, took effect together with the Act on 15 August 2026. Article 5 requires an essential or important entity to take at least the measures of Articles 6 to 18 in implementing Article 21 of the Act.

Article 4 sets Articles 6 to 18 aside for DNS service providers, top-level domain name registries, cloud-computing, data-centre, content-delivery-network, managed-service and managed-security-service providers, online marketplaces, online search engines, social-networking platforms and trust service providers, which answer to Commission Implementing Regulation (EU) 2024/2690 instead.

Article 7 requires a written, demonstrably applied risk-management policy that covers at least a risk-management method and risk-acceptance criteria. Articles 6, 8 and 9 require the same written policy for the security of network and information systems, for incident handling and for business continuity and crisis management. Article 10 requires a written supply-chain security policy and a periodic check that direct suppliers and service providers meet the entity's security requirements.

Article 11 requires a policy for the risks of acquiring software, hardware or services, secure-development processes across all development phases where they apply, and maintenance processes covering at least configuration management and change management. Article 12 requires staff to be aware of the risks to the entity's network and information systems, to apply cyber-hygiene practices and, where their role needs security expertise, to receive regular training.

Article 13 requires a written cryptography policy that settles in which cases cryptography is used and who is responsible for implementing it and for key management. Article 24 requires the early warning of a significant incident to include, as well as the data the Act lists, the presumed start time of the incident and, where possible, a description of its nature and visible effects, an estimate of the recovery time and the measures planned or taken.

Article 25 requires the notification of a significant incident to be made at a reporting point that the Minister sets up. Article 2 designates the Minister of Justice and Security as the CSIRT for essential and important entities and as coordinator for coordinated vulnerability disclosure under Article 17 of the Act.

When LexLint raises it

When your app profile says your app runs an essential service or handles health records.

Back to the example · Lint your app