NIS2 in Netherlands: What your organisation must do.
Cyberbeveiligingswet (Cbw) · In force Enforcement: October 1, 2026Netherlands has transposed the EU NIS2 Directive. If your organisation operates in a covered sector, you are likely in scope and must comply with NCSC-NL / RDI (Rijksinspectie Digitale Infrastructuur) requirements.
Full enforcement
The Cyberbeveiligingswet enters full force October 1, 2026. EU baseline obligations apply now.
Full enforcement starts October 2026 — EU baseline obligations apply now.
Entity classification
Are you an Essential or Important Entity?
Annex I sector + large enterprise (250+ employees or €50M+ turnover)
Penalties: up to €10M or 2% of global turnover
Proactive supervision — authorities can audit at any time
Annex I medium enterprise or Annex II medium/large enterprise
Penalties: up to €7M or 1.4% of global turnover
Reactive supervision — investigated when non-compliance is indicated
Not sure which classification applies to your organisation? The free self-check takes 3 minutes and tells you exactly where you stand — including Netherlands-specific rules. Start free self-check →
What Netherlands requires
Your obligations under Cyberbeveiligingswet (Cbw).
EU baseline NIS2 obligations apply now from October 18, 2024
Begin gap assessment and remediation immediately — October 2026 is closer than it appears
Register with NCSC-NL / RDI once registration portal opens
Implement Article 21 risk management measures
Report significant incidents within 24 hours (early warning) and 72 hours (full report)
Management body accountability — board must approve cybersecurity measures
Supply chain security due diligence
ISO 27001 in Netherlands
ISO 27001 is a useful framework for NIS2 compliance in the Netherlands but no formal presumption of conformity exists under Dutch law.
Sectors in scope in Netherlands
What makes Netherlands different
The Cyberbeveiligingswet was enacted but full enforcement starts October 1, 2026 — this is not a reason to delay preparation.
Finance supervised by DNB/AFM. DORA applies to financial entities and takes precedence over NIS2.
Energy and telecoms supervised by ACM (Authority for Consumers and Markets).
Start your gap assessment now — October 2026 allows just enough time to remediate before enforcement begins.
Know exactly where you stand on NIS2 in Netherlands.
The free self-check takes 3 minutes. It applies Netherlands-specific rules, tells you your entity type, and recommends the right assessment plan.
Start Netherlands self-check — free →