NetherlandsCyberbeveiligingswet, Cybersecurity Risk-Management Measures and Governance
Cyberbeveiligingswet, Artt. 21 en 24
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- This binds an essential entity (Article 8 or 9) or an important entity (Article 12 or 13) drawn from Annex 1 or Annex 2; Annex 2's digital-provider entry names an online marketplace, an online search engine and a social-networking-services platform, and Annex 1's digital-infrastructure and ICT-service-management entries separately name a cloud-computing-service provider, a data-centre-service provider and a content-delivery-network provider, so a service in any of those six lines is reached at the medium-enterprise size threshold or above; the wider sector classes (energy, transport, banking, health, drinking water, public administration and the rest of the Annexes) are reached too, by declaring that you are an essential or important entity. A financial entity covered by Regulation (EU) 2022/2554 answers under that Regulation instead, because Article 22 sets this Article aside where a sector-specific act of the European Union is at least equivalent.
- Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems you use for your work or to provide your services, and to prevent an incident or limit its effect on the recipients of your services and on other services.NIST CSF 2.0ID.RA-06
- Cover at minimum: risk analysis and information-system security policy; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including the direct suppliers and service providers you rely on; security in acquiring, developing and maintaining your systems, including vulnerability handling and disclosure; policies to assess the effectiveness of your risk-management measures; basic cyber-hygiene practices and staff training; cryptography and, where applicable, encryption policy; personnel security, access control and asset management; and, where appropriate, multi-factor or continuous authentication, and secure voice, video, text and emergency communications.NIST CSF 2.0GV.PO-01
- Have your management board approve these measures, and ensure every board member holds the knowledge and skills to identify network-and-information-system risks, assess your cybersecurity risk-management measures, and assess their consequences for your services, within two years of this duty taking effect or, for a member appointed afterwards, within two years of appointment.NIST CSF 2.0GV.RR-01NIST CSF 2.0PR.AT-02
These lines are LexLint's reading of the law's text. Also read by: Nationaal Cyber Security Centrum (NCSC), Ministerie van Justitie en Veiligheid (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
- PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
The Act's own penalty provision for an Article 21 infringement is an administrative fine (bestuurlijke boete) under Article 80 (essential entity) or Article 87 (important entity), together with the corrective and enforcement powers of Chapter 15; an infringement of Article 24(2) to (6) is enforced against the board member personally by a periodic penalty payment (Article 92) or an administrative fine of up to EUR 25,000 (Article 93); the Act creates no criminal offence for either infringement.
Penalty structure
Article 80(3)(a) sets the maximum administrative fine for an essential entity's infringement of, among other provisions, Article 21, at EUR 10,000,000 or 2 percent of the total worldwide annual turnover of the undertaking to which the entity belongs in the preceding financial year, whichever is higher. Article 87(3)(a), the mirror provision for an important entity, sets the equivalent cap at EUR 7,000,000 or 1.4 percent of that turnover, whichever is higher. Both mirror NIS2 Article 34(4) and (5). An infringement of Article 24(2) to (6) falls outside those provisions: Article 93 caps the administrative fine on the board member personally at EUR 25,000.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The Minister the Cyberbeveiligingswet designates as competent authority for the entity's sector; the Minister of Economic Affairs for the digital-provider and digital-infrastructure sectors named above.
Settledness
- As of
- Guidance link
- https://www.ncsc.nl/cyberbeveiligingswet-nis2
- Guidance body
- Nationaal Cyber Security Centrum (NCSC), Ministerie van Justitie en Veiligheid
- Open questions
- Does the Cyberbeveiligingsbesluit and the sector-specific Cyberbeveiligingsregelingen (BWBR0052875 and its sector siblings), the administrative orders that designate the CSIRT under Article 16 and set further technical detail, create any duty beyond what Articles 21 and 24 already state?
What this law does
Article 21 requires an essential entity or an important entity to take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems it uses for its work or to provide its services, and to prevent an incident or limit its effect on the recipients of its services and on other services, at a security level matched to the risk and covering, at minimum, risk analysis and information-system security policy, incident handling, business continuity and crisis management, supply-chain security, secure acquisition and development, effectiveness-assessment policy, cyber hygiene and training, cryptography policy, personnel and access-management security, and, where appropriate, multi-factor authentication (Article 21, paragraphs 1 to 3).
Article 24 requires the entity's management board to approve these measures and requires every board member to hold the knowledge and skills to identify network-and-information-system risks, assess cybersecurity risk-management measures, and assess their consequences for the entity's services, each within two years of that requirement taking effect or, for a member appointed afterwards, within two years of appointment.
Article 22 sets Article 21 aside for an essential or important entity that a sector-specific act of the European Union already requires to take at least equivalent cybersecurity risk-management measures. Regulation (EU) 2022/2554 is such an act for a financial entity identified as an essential or important entity, so that entity answers under that Regulation instead.
This Act, Wet van 8 juli 2026 (Cyberbeveiligingswet), transposes NIS2 Directive Articles 20 and 21 and, by its own Article 106, repeals the Wet beveiliging netwerk- en informatiesystemen (Wbni), the predecessor NIS1 transposition, which the consolidated register shows lapsed on , the date this Act took effect.
When LexLint raises it
When your app profile says your app operates a social platform, handles health records or runs an essential service.
Back to the example · Lint your app
Page updated .