Loading story…
The Netherlands’ Cybersecurity Act (Cyberbeveiligingswet, Cbw) has taken effect, transposing the EU’s NIS2 Directive and replacing the former Wbni framework. More than 8,000 organizations providing essential or important services across 18 sectors must register in the national entity register, manage network and information-system risks, report significant incidents to their designated CSIRT and competent authority, and establish board-level accountability for cybersecurity, including director training. The National Cyber Security Centre manages the register and can provide registered entities or their sectoral CSIRTs with threat intelligence and incident assistance; supervisory authorities will enforce compliance.
The accompanying Critical Entities Resilience Act (Wet weerbaarheid kritieke entiteiten, Wwke) implements the EU CER Directive and will designate roughly 500 critical entities. Those organizations must address resilience against cyber incidents as well as sabotage, terrorism, natural disasters, and other disruptions to essential services. Although the Cbw does not directly regulate suppliers, covered organizations must manage supply-chain risks and may require risk-proportionate security controls and supporting evidence from direct suppliers whose products or services could affect their systems or physical operations.
See the reporting duties and controls this puts on the clock.
7 events from the most recent confirmed update back to the earliest known activity.
The Netherlands' Cyberbeveiligingswet and Wet weerbaarheid kritieke entiteiten took effect. The Cbw implements NIS2 and establishes cybersecurity obligations for more than 8,000 essential or important entities, while the Wwke implements the CER Directive and supports designation of critical entities.
A remaining question from a parliamentary faction on the Cyberbeveiligingswet was identified; the government subsequently answered it, completing the bill's written consideration.
The Dutch Senate issued its report on the Cyberbeveiligingswet bill, raising questions concerning implementation, oversight, and effects on organizations.
Justice and Security Minister D.M. van Weel voluntarily submitted draft Cybersecurity Decree and Critical Entities Resilience Decree measures to the House of Representatives for consideration alongside the underlying bills.
A September 2024 Digital Trust Center survey found that 60% of suppliers familiar with NIS2 incorrectly believed all NIS2 obligations directly applied to suppliers of organizations covered by the directive.
The Dutch Cyberbeveiligingswet, incorporating the NIS2 Directive, was sent to the House of Representatives for legislative consideration.
The Auditdienst Rijk and NOREA launched the Cbw (NIS2) Control Framework, a modular assessment tool intended to help organizations prepare for Dutch NIS2-related cybersecurity requirements.
See what this changes for your reporting obligations and which controls it puts on the clock.
16 references tracked. Mallory keeps watching after this page renders.
nctv.nl
Open sourcenctv.nl
Open sourcenctv.nl
Open sourcencsc.nl
Open sourcencsc.nl
Open sourcetweedekamer.nl
Open sourcencsc.nl
Open sourceregelhulpenvoorbedrijven.nl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Dutch House of Representatives approved the **Cybersecurity Act** (`Cyberbeveiligingswet`), advancing the Netherlands’ implementation of the EU `NIS2` Directive. The act will replace the existing Network and Information Systems Security Act (`Wbni`) and impose statutory cybersecurity due-care, incident-reporting, and registration obligations on thousands of essential and important organizations. The National Cyber Security Centre’s remit is expected to expand to more than 8,000 organizations. The bill now proceeds to the Senate, while the government continues preparing the Cybersecurity Decree and sector-specific ministerial rules, including incident-reporting thresholds. The government has sought to align commencement of the act, its implementing measures, and the related Critical Entities Resilience Act—implementing the EU `CER` Directive—with a target effective date in the second quarter of 2026, subject to completion of the legislative process. Organizations likely to fall within scope have been urged to prepare controls, governance, supply-chain safeguards, and reporting processes ahead of enforcement.
Aug 31, 2026
The Netherlands integrated the Digital Trust Center (DTC) into the National Cyber Security Centre (NCSC) on 1 January 2026, consolidating the DTC, NCSC and CSIRT-DSP into a national capability for public- and private-sector cyber-threat, victim and target notifications. The organizations had already established a single NCSC intake point for threat and incident data and a common assessment framework, aiming to provide organizations with a scalable warning service from one sender. The **Wet bevordering digitale weerbaarheid bedrijven** provides the legal basis to process and share vulnerability, threat and incident information—including necessary IP-address and business-contact data—with non-critical businesses. The DTC’s notification service expanded from targeted alerts launched in 2021 to more than 140,000 company-specific warnings in 2023 and over 238,000 vulnerability warnings during 2024. Notifications covered exposed internet services, configuration errors, vulnerable software and leaked corporate credentials, including alerts connected to **Operation Endgame**. At Saxion University of Applied Sciences, a DTC alert about stolen email credentials enabled rapid password resets, log reviews and user notification; MFA prevented account misuse and the institution found no resulting damage. The integrated NCSC service will continue delivering actionable alerts and supporting Dutch organizations with NIS2 preparedness guidance, community intelligence sharing and cyber-resilience tools.
Aug 31, 2026
The EU Cyber Resilience Act (CRA) will impose cybersecurity requirements on hardware, software, and components sold in the EU, with broad applicability including commercially supplied offline firmware from microenterprises. Manufacturers will need to maintain technical documentation, issue an EU declaration of conformity, apply CE marking where required, provide security updates throughout the support period, and meet post-market vulnerability and incident-reporting obligations; some software not listed in Annex III may be eligible for self-assessment. The Netherlands has proposed an implementing law that assigns conformity assessment, market surveillance, and enforcement to the Minister of Economic Affairs through the Rijksinspectie Digitale Infrastructuur (RDI). The National Cyber Security Centre (NCSC) would operate the national reporting portal as the designated CSIRT. CRA market requirements take effect on 11 December 2027, while manufacturers must begin reporting actively exploited vulnerabilities and severe incidents on 11 September 2026.
Sep 3, 2026