# NIS2 and the Cybersecurity Act in brief

## What applies

NIS2 is a European directive: (EU) 2022/2555. A directive does not apply directly to your organisation. Each member state transposes it into its own law, and the member states had to do so by 17 October 2024 at the latest.

In the Netherlands, that is the Cybersecurity Act (Cyberbeveiligingswet, Cbw). It has applied since 15 August 2026 and replaces the Network and Information Systems Security Act (Wbni). The Cybersecurity Decree (Cyberbeveiligingsbesluit, Staatsblad 2026, 189) set that date. So for you, the Dutch law counts; the directive explains where that law comes from.

This quick guide helps you determine whether you fall under it and what you need to arrange. It is not legal advice.

## Does your organisation fall under it?

The law applies to organisations that provide essential or important services in 18 sectors. You determine yourself whether you fall under it. A selection of the sectors:

### Essential entities
- Energy (electricity, oil, gas, hydrogen)
- Transport (air, rail, water, road)
- Healthcare
- Drinking water
- Digital infrastructure (DNS, internet exchange points, top-level domains, cloud, data centres)
- Government

### Important entities
- Postal and courier services
- Waste management
- Chemicals
- Food
- Manufacture of medical devices
- Digital providers (online marketplaces, search engines, social networks)

## What the law asks of you

### Register

Organisations that fall under the law register in the national entity register of the NCSC. After that, you receive information about threats and help with incidents from the NCSC or the CSIRT of your sector.

### The board is responsible

The board approves the security measures and oversees their implementation. Board members must know enough to assess risks and measures, and follow appropriate training for that.

### Taking measures (duty of care, article 21 of the directive)

You take appropriate and proportionate measures to manage the risks to your network and information systems. The directive names these topics, among others:

| Measure | What it is | Evidence you can show |
|-----------|------------|-------------------------------|
| Risk analysis | Periodic assessment of threats | Risk register, BIA |
| Incident management | Detection, response and recovery | Incident logs, playbooks |
| Business continuity | Backups and recovery after a disaster | Recovery plans, test reports |
| Supply chain | Assessing and monitoring suppliers | Supplier assessments |
| Network and system security | Technical security | Hardening guidelines |
| Access management | Managing identities and rights | Access logs, MFA overview |
| Cryptography | Encryption of stored and transmitted data | Certificates, key management |
| Staff | Awareness and screening | Training records |
| Asset management | Inventory of critical systems | CMDB, asset register |
| Authentication | MFA and strong passwords | MFA coverage |

### Reporting incidents (reporting obligation, article 23 of the directive)

You report a significant incident to your CSIRT and your supervisory authority, via the reporting portal of the NCSC. When an incident is significant is set out per sector in a ministerial regulation. The deadlines from the directive:

1. An early warning within 24 hours after you discover the incident.
2. An incident notification within 72 hours, with an initial assessment of the consequences.
3. Interim updates if the supervisory authority asks for them.
4. A final report within one month, with the cause and the measures taken.

### Supervision and fines

Supervisory authorities check whether you comply with the obligations. The directive (article 34) names as the maximum fine at least:

- for essential entities: 10 million euros or 2 percent of worldwide turnover per year
- for important entities: 7 million euros or 1.4 percent of worldwide turnover per year

In addition, a supervisory authority can carry out audits and inspections and give binding instructions.

## Checklist to get started

### Board (week 1 to 4)
- [ ] Appoint a responsible person with a mandate from the board
- [ ] Have the board follow the training about the obligations
- [ ] Determine whether your organisation falls under it, as an essential or as an important entity
- [ ] Register your organisation in the entity register of the NCSC

### Technology (week 4 to 12)
- [ ] Make an inventory of your systems and data
- [ ] Carry out a risk analysis on the critical systems
- [ ] Turn on MFA on all access
- [ ] Set up central logging
- [ ] Divide your network into segments

### Organisation (week 8 to 16)
- [ ] Write an incident response plan
- [ ] Practise the plan with a tabletop exercise
- [ ] Record how you report to the CSIRT and the supervisory authority
- [ ] Map the risks of your suppliers
- [ ] Set up backups and recovery, and test them

### Ongoing
- [ ] Scan regularly for vulnerabilities
- [ ] Review your risk analysis every year
- [ ] Keep awareness up to date, for example every quarter
- [ ] Check every month whether the updates have been installed

## Where Noveu fits

Noveu supports your organisation with these technical measures and information:

| Topic | What Noveu does |
|-----------|----------------|
| Access management | One Noveu login via OpenID Connect, with TOTP and passkeys, optional for users |
| Data location | Data and backups in a Hetzner data centre in Falkenstein (Germany); Cloudflare (US) is a sub-processor for CDN, DNS and TLS |
| Supply chain | All sub-processors are on [our list of sub-processors](/en/legal/sub-processors) |

## Sources

- [Directive (EU) 2022/2555 (NIS2), EUR-Lex](https://eur-lex.europa.eu/eli/dir/2022/2555/oj), consulted on 29 September 2026
- [Government of the Netherlands (Rijksoverheid): news item on the entry into force of the Cybersecurity Act and the Critical Entities Resilience Act](https://www.rijksoverheid.nl/actueel/nieuws/2026/08/15/cyberbeveiligingswet-en-wet-weerbaarheid-kritieke-entiteiten-vanaf-vandaag-van-kracht), news item of 15 August 2026 (in Dutch), consulted on 29 September 2026
- [Cybersecurity Decree (Cyberbeveiligingsbesluit), Staatsblad 2026, 189](https://zoek.officielebekendmakingen.nl/stb-2026-189.html) (in Dutch), consulted on 29 September 2026
- [National Cyber Security Centre (NCSC)](https://www.ncsc.nl/), consulted on 29 September 2026

---

*This document is informative. Ask for legal advice for your own situation.*