NIS2 in the Netherlands
The Cyberbeveiligingswet has bound companies since 15 August 2026
The Act is Stb. 2026, 187 and the decree that commenced it is Stb. 2026, 189, both published on 10 July 2026. What follows is what the Act asks of an essential or important entity, in its own words, with the article that carries each one.
- Since
De Cyberbeveiligingswet en dit besluit treden in werking met ingang van 15 augustus 2026.
The Cyberbeveiligingswet and this decree take effect on 15 August 2026.Artikel 35 Cyberbeveiligingsbesluit- Who
entiteiten, genoemd in bijlage 1 van deze wet, niet zijnde een essentiële entiteit, die in aanmerking komen als middelgrote onderneming uit hoofde van artikel 2 van de bijlage bij de Aanbeveling 2003/361/EG
entities named in Annex 1 to this Act, other than an essential entity, that qualify as a medium-sized enterprise under article 2 of the Annex to Recommendation 2003/361/ECArtikel 12, eerste lid, onderdeel a- What
De essentiële entiteit of belangrijke entiteit neemt passende en evenredige technische, operationele en organisatorische maatregelen om de risico’s voor de beveiliging van de netwerk- en informatiesystemen, die zij voor haar werkzaamheden of voor het verlenen van haar diensten gebruikt, te beheersen.
The essential or important entity takes appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems it uses for its activities or for providing its services.Artikel 21, eerste lid- Where
- Registration is with NCSC, on MijnNCSC.You need eHerkenning of SSOnRijk before the portal will take anything.
The authentic text in the Staatsblad, read on 2 November 2026
The dates the Act sets itself
Two of these are written nowhere as a date. The Act gives them as a period running from its own commencement, and article 35 of the decree commences the whole Act on one day.
| When | What | Whose |
|---|---|---|
| 15 August 2026 | The Act and the decree take effect. Artikel 35 Cyberbeveiligingsbesluit | the Minister |
| 15 September 2026 | The national register exists, at most one month after article 43. Artikel 98 | the Minister |
| 15 August 2028 | Every board member in post on the day of commencement meets the knowledge requirement. A member appointed later has two years from appointment. Artikel 24, derde lid | you |
The duty of care, and where the measures are
Article 21, third paragraph, lists ten subjects the measures cover at least. They are the same ten as in article 21(2) of the Directive, which we set subject by subject against the ISO 27001 control that satisfies it.
The ten subjects against ISO 27001The board approves, and has to be able to judge
De maatregelen, bedoeld in artikel 21, behoeven de goedkeuring van het bestuur van de essentiële entiteit of belangrijke entiteit.The measures referred to in article 21 require the approval of the board of the essential or important entity.Artikel 24, eerste lid
The knowledge requirement is on each board member rather than on the company, and the Act asks that each one keeps that knowledge demonstrably current.
The two clocks after an incident
Both periods run from the moment you become aware of the significant incident, not from the incident itself.
Early warning to your CSIRT and your competent authority, without delay or within 24 hours.
Dit doet zij onverwijld of, indien dat niet mogelijk is, binnen 24 uur nadat zij kennis heeft gekregen van het significante incident.It does so without delay or, where that is not possible, within 24 hours of becoming aware of the significant incident.Artikel 26, eerste lidNotification with an initial assessment, without delay or within 72 hours.
De essentiële entiteit of belangrijke entiteit dient onverwijld of, indien dat niet mogelijk is, binnen 72 uur nadat zij kennis heeft gekregen van het significante incident een melding in bij haar CSIRT en haar bevoegde autoriteitThe essential or important entity submits a notification to its CSIRT and its competent authority without delay or, where that is not possible, within 72 hours of becoming aware of the significant incidentArtikel 27, eerste lidRegistering
Een essentiële entiteit, belangrijke entiteit en een entiteit die domeinnaamregistratiediensten verleent verstrekt ten behoeve van de registratie in het nationale register, bedoeld in artikel 43, aan Onze Minister de volgende informatie middels het daarvoor opgezette mechanismeAn essential entity, an important entity and an entity providing domain name registration services supplies the following information to Our Minister, through the mechanism set up for it, for registration in the national register referred to in article 43Artikel 44, eerste lid
The duty to register is article 44. Which supervisor you have depends on your sector, and NCSC keeps a page on that.
Whether you are in scope is not what this page says
Article 12 is quoted above so you can read the test the Act applies. Whether your company meets it depends on your sector, your size and the Act's annexes. The five NIS2 questions are on their own page and end in a written determination.
Work through the NIS2 determinationThe one deferred duty
Designated higher education institutions get 36 months from the designation. For a company no such period exists.
Het bepaalde bij of krachtens de artikelen 21 en 24 is van toepassing op de op grond van artikel 11 aangewezen essentiële entiteit en de op grond van artikel 13 aangewezen belangrijke entiteit vanaf 36 maanden na de aanwijzing.Articles 21 and 24, and anything made under them, apply to an essential entity designated under article 11 and an important entity designated under article 13 from 36 months after the designation.Artikel 97
The NIS2 Registration Pack
A worksheet for the size question, with the authority, the portal, the credential and the CSIRT for the Netherlands. Then an incident runbook with both clocks, the ten subjects with the ISO 27001 evidence beside them, and the record of the board's approval.
Questions
- Does StandardOS register us?
- No. You register on MijnNCSC with eHerkenning of SSOnRijk. We supply the worksheet and the evidence.
- Was there a transition period?
- Not for companies. The decree provides no transitional law and commences the Act and itself on 15 August 2026.
Read on 2 November 2026 in the authentic text: Stb. 2026, 187, the Cyberbeveiligingswet, Stb. 2026, 189, the Cyberbeveiligingsbesluit
We are not a supervisor and not a certification body. What is above is in the Act; what we sell is the work around it.