Skip to content
IT-Checklist

NIS2 / Cybersecurity Act (EU): checklist and advice

Last updated: · IT-Checklist editorial team · All changes

The Cybersecurity Act (Cyberbeveiligingswet) is the Dutch version of the EU NIS2 directive. It has been in force since 15 August 2026 and applies to medium and large organisations in 18 designated sectors. Through the supply chain it also affects many smaller businesses that supply those organisations.

This topic helps you decide whether the law applies to you. And if it does, whether the main obligations are in place.

Check where your business stands on nis2 / cybersecurity act (eu)

The free IT check asks you these questions. Then you see your score per topic and advice for every gap. You don't need an account.

Start the IT check →

Why this matters

Organisations covered by the law must register with the NCSC via mijn.ncsc.nl. There is no transition period for this.

You must report a significant incident quickly to the CSIRT and the supervisor. First an early warning within 24 hours, then a notification within 72 hours and a final report within one month. Without a procedure ready, that is hard to manage in the chaos of an incident.

Directors are personally responsible for approving and overseeing the measures. They must also take suitable training.

The 5 questions in this topic, with advice

Each question describes the situation you want to have. The label shows how much the measure weighs in your score. 'Do first' counts the most.

  1. We have checked whether the EU's NIS2 directive — implemented in the Netherlands as the Cybersecurity Act — applies to our business, including as a supplier to a larger company.

    Do first

    This EU directive is transposed in the Netherlands as the Cybersecurity Act, which applies to 'essential' and 'important' entities in 18 designated sectors (incl. energy, transport, healthcare, digital services, manufacturing) and also affects smaller suppliers through supply chain security. Do a self-assessment via ncsc.nl or seek advice.

  2. We have registered our organisation with the NCSC via mijn.ncsc.nl, if the Netherlands' Cybersecurity Act — the national implementation of the EU's NIS2 directive — applies to us.

    Important

    The Dutch Cybersecurity Act has been in force since 15 August 2026. Essential and important entities are legally required to register in the NCSC's entity register; do this even if you are unsure whether the law applies to you, so you know for certain.

  3. We have implemented the basic measures of the NIS2 duty of care: risk analysis, incident procedures and supply chain security.

    Do first

    Start with a risk analysis: what are your key systems and data, what can go wrong and which measures address it? Document incident procedures and supplier agreements.

  4. We know that under the Dutch Cybersecurity Act (the national implementation of the EU's NIS2 directive), serious incidents must be reported to the NCSC quickly (an early warning within 24 hours, a notification within 72 hours, and a final report after one month at the latest).

    Important

    Put the reporting deadlines and the reporting desk (the NCSC, in addition to the privacy authority for data breaches) in your incident plan so you don't have to search during an incident.

  5. Management is demonstrably involved in information security and bears final responsibility for it (a requirement under the Dutch Cybersecurity Act, which implements the EU's NIS2 directive).

    Important

    This EU-derived law explicitly places responsibility with the board, including personal liability in cases of serious negligence. Put information security on the management agenda periodically and document decisions.

    Applies to: SMEs, larger companies

Where to start

  • Do the NCSC self-assessment. It tells you whether you are an essential or important entity, or only affected indirectly through the supply chain.
  • Register your organisation via mijn.ncsc.nl if the law applies to you.
  • Write down the reporting procedure. Who decides whether an incident is significant, who reports it and through which channel?
  • Schedule cybersecurity training for the board and keep proof that they attended.

Common mistakes

  • Assuming the law doesn't apply because you are below the size thresholds, while a large customer requires the same measures in your contract.
  • Leaving responsibility entirely with the IT partner. The law places it with the board.
  • Putting off the risk analysis until the supervisor comes knocking.

Official sources

Read next

All topics in the checklist