Loading story…
The Dutch House of Representatives approved the Cybersecurity Act (Cyberbeveiligingswet), advancing the Netherlands’ implementation of the EU NIS2 Directive. The act will replace the existing Network and Information Systems Security Act (Wbni) and impose statutory cybersecurity due-care, incident-reporting, and registration obligations on thousands of essential and important organizations. The National Cyber Security Centre’s remit is expected to expand to more than 8,000 organizations.
The bill now proceeds to the Senate, while the government continues preparing the Cybersecurity Decree and sector-specific ministerial rules, including incident-reporting thresholds. The government has sought to align commencement of the act, its implementing measures, and the related Critical Entities Resilience Act—implementing the EU CER Directive—with a target effective date in the second quarter of 2026, subject to completion of the legislative process. Organizations likely to fall within scope have been urged to prepare controls, governance, supply-chain safeguards, and reporting processes ahead of enforcement.
See the reporting duties and controls this puts on the clock.
16 events from the most recent confirmed update back to the earliest known activity.
Six ministries opened consultation on draft sector-specific ministerial regulations under the Cybersecurity Act, while regulations under the Critical Entities Resilience Act were also made available by relevant ministries. The drafts include sectoral incident-reporting thresholds and duty-of-care requirements.
Minister of Justice and Security D.M. van Weel voluntarily submitted the draft Cybersecurity Decree and draft Critical Entities Resilience Decree to the House so they could be considered alongside the underlying bills.
The Dutch government submitted the Cyberbeveiligingswet and Wet weerbaarheid kritieke entiteiten bills to the House of Representatives. The bills respectively implement the EU NIS2 and CER directives.
The consultation period for the draft Cybersecurity Decree and Critical Entities Resilience Decree ended, after which the government began assessing responses and considering amendments.
The Dutch government consulted on the draft Cybersecurity Decree, Critical Entities Resilience Decree, and draft duty-of-care ministerial regulations. The decrees further specify obligations under the proposed NIS2 and CER implementing laws.
The Council of State issued advice on the proposed Cybersecurity Act and Critical Entities Resilience Act before their submission to the House of Representatives.
The public consultation on the Cyberbeveiligingswet closed after receiving 111 responses. The government planned to assess feedback, develop implementing measures, obtain Council of State advice, and submit the proposal to Parliament.
The Dutch government opened public consultation on the proposed Cyberbeveiligingswet, its national implementation of NIS2, including proposed duties of care, incident reporting, and compliance oversight.
The Rijksinspectie Digitale Infrastructuur released the NIS2 Quickscan to help organizations assess their preparedness for the forthcoming NIS2-based requirements.
The Dutch House of Representatives approved the Cybersecurity Act proposal, which implements NIS2 and replaces the Wbni. The legislative proposals were then sent to the Senate for consideration.
Members of the Dutch House of Representatives held a legislative consultation on the Cybersecurity Act and Critical Entities Resilience Act, discussing scope, duty of care, incident reporting, implementation, oversight, and overlap.
The Digital Trust Center was incorporated into the National Cyber Security Centre.
From the NIS2 transposition deadline, the NCSC provided certain CSIRT activities and voluntary incident-reporting services during the transition period, including risk-based support for organizations expected to enter the Cyberbeveiligingswet's scope.
The Netherlands did not transpose NIS2 into national law by the EU deadline, citing the size and complexity of the Cyberbeveiligingswet legislative process. NIS2-covered entities generally were not yet subject to its obligations, although some provisions had direct effect.
The Digital Trust Center and the Ministry of Economic Affairs and Climate Policy held a webinar on NIS2 implementation, covering duty-of-care, incident-reporting, registration, supervision, and preparatory security measures.
EU ministers agreed to the European Commission proposal to revise the Network and Information Security Directive, creating the proposed NIS2 framework with expanded sector coverage, incident reporting, and security requirements.
See what this changes for your reporting obligations and which controls it puts on the clock.
21 references tracked. Mallory keeps watching after this page renders.
ncsc.nl
Open sourcencsc.nl
Open sourcencsc.nl
Open sourcetweedekamer.nl
Open sourcencsc.nl
Open sourcencsc.nl
Open sourcencsc.nl
Open sourcencsc.nl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Netherlands’ **Cybersecurity Act** (`Cyberbeveiligingswet`, Cbw) has taken effect, transposing the EU’s NIS2 Directive and replacing the former Wbni framework. More than 8,000 organizations providing essential or important services across 18 sectors must register in the national entity register, manage network and information-system risks, report significant incidents to their designated CSIRT and competent authority, and establish board-level accountability for cybersecurity, including director training. The National Cyber Security Centre manages the register and can provide registered entities or their sectoral CSIRTs with threat intelligence and incident assistance; supervisory authorities will enforce compliance. The accompanying **Critical Entities Resilience Act** (`Wet weerbaarheid kritieke entiteiten`, Wwke) implements the EU CER Directive and will designate roughly 500 critical entities. Those organizations must address resilience against cyber incidents as well as sabotage, terrorism, natural disasters, and other disruptions to essential services. Although the Cbw does not directly regulate suppliers, covered organizations must manage supply-chain risks and may require risk-proportionate security controls and supporting evidence from direct suppliers whose products or services could affect their systems or physical operations.
Aug 31, 2026
The EU Cyber Resilience Act (CRA) will impose cybersecurity requirements on hardware, software, and components sold in the EU, with broad applicability including commercially supplied offline firmware from microenterprises. Manufacturers will need to maintain technical documentation, issue an EU declaration of conformity, apply CE marking where required, provide security updates throughout the support period, and meet post-market vulnerability and incident-reporting obligations; some software not listed in Annex III may be eligible for self-assessment. The Netherlands has proposed an implementing law that assigns conformity assessment, market surveillance, and enforcement to the Minister of Economic Affairs through the Rijksinspectie Digitale Infrastructuur (RDI). The National Cyber Security Centre (NCSC) would operate the national reporting portal as the designated CSIRT. CRA market requirements take effect on 11 December 2027, while manufacturers must begin reporting actively exploited vulnerabilities and severe incidents on 11 September 2026.
Sep 3, 2026
The Netherlands integrated the Digital Trust Center (DTC) into the National Cyber Security Centre (NCSC) on 1 January 2026, consolidating the DTC, NCSC and CSIRT-DSP into a national capability for public- and private-sector cyber-threat, victim and target notifications. The organizations had already established a single NCSC intake point for threat and incident data and a common assessment framework, aiming to provide organizations with a scalable warning service from one sender. The **Wet bevordering digitale weerbaarheid bedrijven** provides the legal basis to process and share vulnerability, threat and incident information—including necessary IP-address and business-contact data—with non-critical businesses. The DTC’s notification service expanded from targeted alerts launched in 2021 to more than 140,000 company-specific warnings in 2023 and over 238,000 vulnerability warnings during 2024. Notifications covered exposed internet services, configuration errors, vulnerable software and leaked corporate credentials, including alerts connected to **Operation Endgame**. At Saxion University of Applied Sciences, a DTC alert about stolen email credentials enabled rapid password resets, log reviews and user notification; MFA prevented account misuse and the institution found no resulting damage. The integrated NCSC service will continue delivering actionable alerts and supporting Dutch organizations with NIS2 preparedness guidance, community intelligence sharing and cyber-resilience tools.
Aug 31, 2026