NIS2 / Dutch Cybersecurity Act: checklist and advice

Last updated: 27 October 2026 · IT-Checklist editorial team

If the Dutch Cybersecurity Act applies to you, you have a duty of care. The law lists the measures you must have in place, from risk analysis and incident handling to backups, supply chain security, encryption and MFA. The board approves them and oversees them.

This checklist goes through those measures one by one. Not sure yet whether the law applies to you? Start with the NIS2 / Cybersecurity Act topic in the regular checklist.

Check where your business stands on nis2 / dutch cybersecurity act

The free IT check asks you these questions. Then you see your score per topic and advice for every gap. You don't need an account.

Start the IT check →

Why it matters

Directors are personally responsible. They must approve the measures, oversee them and take cybersecurity training themselves.

The reporting deadlines are short: an early warning within 24 hours, a notification within 72 hours and a final report within one month. Without a fixed procedure you won't make it.

The duty of care extends to your suppliers. Weak security at an IT or cloud provider becomes your problem.

The 12 questions in this topic, with advice

Each question describes the situation you want to have. The label shows how much the measure weighs in your score. 'Do first' counts the most.

Our management has approved the cybersecurity measures, oversees their implementation and takes cybersecurity training itself.
Do first
NIS2 places responsibility with management (Article 20 of the directive). Board members must approve the measures, oversee them and take training themselves. They can be held liable if things go wrong. Put cybersecurity on the management meeting agenda as a fixed item.
We have carried out a risk analysis and, based on it, documented a security policy for our network and information systems.
Do first
The duty of care starts with risk analysis and policy (Article 21(2)(a)). Map which systems your services depend on, what can go wrong and which measures fit. Document it so you can show it to the supervisory authority.
We know which incidents are significant and have a reporting procedure: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month.
Do first
These are the deadlines from Article 23 of NIS2. Reports go through the reporting portal on mijn.ncsc.nl. Document who may report, who informs management and how you combine this with a data breach notification to the Dutch Data Protection Authority.
We have an incident handling procedure: detecting, analysing, containing and recovering.
Important
Incident handling is one of the mandatory measures (Article 21(2)(b)). Describe the steps, the roles and the contact details, including those of your IT supplier. Practise it at least once a year.
We have backups, a recovery plan and a crisis plan, so our services continue or restart quickly after an attack or outage.
Important
Business continuity is covered by Article 21(2)(c): backup management, disaster recovery and crisis management. Keep at least one backup separate from your network and test restoring it. Our emergency plan template helps you get started.
We assess the security of our suppliers and service providers and have made agreements with them about it.
Important
Supply chain security is mandatory (Article 21(2)(d)). Start with suppliers that can access your systems or data, such as your IT provider and cloud services. Ask how they handle security and put minimum requirements in the contract.
When buying, developing and maintaining systems we take security into account and we fix vulnerabilities quickly.
Important
Article 21(2)(e) requires security across a system's whole lifecycle, including handling and disclosing vulnerabilities. Set security requirements when buying and agree a fixed timeframe for installing updates.
We periodically check whether our security measures work, for example with an internal audit, scan or penetration test.
Important
Taking measures is not enough. You also have to assess whether they are effective (Article 21(2)(f)). Plan a yearly vulnerability scan, for example, and discuss the results with management.
Employees regularly take cybersecurity training and know the basic rules for working securely.
Important
Basic cyber hygiene and training are covered by Article 21(2)(g). Think of strong passwords, updates, recognising phishing and reporting incidents. Repeat it every year and keep track of who completed it.
Applies to: SMEs, larger companies
We have documented where we use encryption, for example on laptops, phones, backups and connections.
Important
NIS2 requires a policy on cryptography and encryption (Article 21(2)(h)). Turn on disk encryption on all laptops and phones, encrypt backups and only use secure connections.
We manage access based on role, keep an inventory of our systems and revoke rights when someone leaves.
Important
Article 21(2)(i) covers human resources security, access control and asset management. Make a fixed checklist for people joining and leaving and check periodically who can access what.
We use multi-factor authentication and have a secure means of communication for emergencies, for when email or the network is down.
Do first
Article 21(2)(j) mentions multi-factor authentication and secured communications, including in emergencies. Turn on MFA on all accounts and agree how you reach each other when your own systems are down, for example with a phone list on paper.

Where to start

Record the board's approval in a formal decision. Schedule the board's training too.
Write an incident procedure: who assesses an incident, who reports it, and that reports go through mijn.ncsc.nl.
Put in a continuity plan how you keep working after an attack, and test that your backups can be restored.
Turn on MFA for all accounts and arrange an emergency channel for when email and the network are down.

Common mistakes

Only looking at IT measures and forgetting the board's role.
Having an incident procedure nobody knows or has ever practised.
Not assessing suppliers because they are 'big and therefore secure'.

NIS2 / Dutch Cybersecurity Act: checklist and advice

Why it matters

The 12 questions in this topic, with advice

Our management has approved the cybersecurity measures, oversees their implementation and takes cybersecurity training itself.

We have carried out a risk analysis and, based on it, documented a security policy for our network and information systems.

We know which incidents are significant and have a reporting procedure: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month.

We have an incident handling procedure: detecting, analysing, containing and recovering.

We have backups, a recovery plan and a crisis plan, so our services continue or restart quickly after an attack or outage.

We assess the security of our suppliers and service providers and have made agreements with them about it.

When buying, developing and maintaining systems we take security into account and we fix vulnerabilities quickly.

We periodically check whether our security measures work, for example with an internal audit, scan or penetration test.

Employees regularly take cybersecurity training and know the basic rules for working securely.

We have documented where we use encryption, for example on laptops, phones, backups and connections.

We manage access based on role, keep an inventory of our systems and revoke rights when someone leaves.

We use multi-factor authentication and have a secure means of communication for emergencies, for when email or the network is down.

Where to start

Common mistakes

Official sources

Read next