NIS2 and the Cybersecurity Act: does your company fall under it?
Since August 15, 2026, the Cyber Security Act applies in the Netherlands. You may have already heard the term NIS2 from a customer, a supplier, or an advisor. This article briefly explains what the law is, who it applies to, and what it means for a small business that isn't covered by it itself.
This article provides general information and is not legal advice. The current rules can be found at the NCSC and in the text of the law.
What is it?
NIS2 is a European directive from 2022 (Directive (EU) 2022/2555) designed to make organizations in key sectors more digitally resilient. Each country implements the directive through its own law. In the Netherlands, this is the Cyber Security Act (Cbw). The law has applied since August 15, 2026, with no transition period, and replaces the old Network and Information Systems Security Act (Wbni). According to the NCSC, over 8,000 organizations are covered by it. The NCSC is the point of contact.
Does my company fall under it?
That depends on two questions: your sector and your size.
1. Do you work in a sector covered by the law?
| Annex 1 | Annex 2 |
|---|---|
| Energy, transport, banking, financial market infrastructure, healthcare, drinking water, waste water, digital infrastructure, ICT service management, public administration, space | Postal and courier services, waste management, chemicals, food, manufacturing, digital providers, research |
Additional conditions apply to some sectors. So not every company that does something with food automatically falls under it.
2. Are you big enough? In short, medium-sized and large organizations are covered. You count if you:
- have 50 or more employees (FTE), or
- have fewer than 50 employees, but your annual turnover and your balance sheet total are both above 10 million euros.
Partner enterprises and linked enterprises count as well. So a company with 20 employees that belongs to a group of 200 can still fall under it.
Exceptions, regardless of size. A few types of organizations always fall under it, no matter how small. For example, DNS service providers, top-level domain name registries, providers of public electronic communications networks and services, trust service providers, and government organizations. If you've been designated under the Critical Entities Resilience Act, you also fall under the Cyber Security Act.
Check for yourself with the self-assessment
The Netherlands Authority for Digital Infrastructure (RDI) has a free NIS2 self-assessment. You answer questions about your sector, size, and services and get a result. This also shows whether you're an essential or an important entity. The difference lies mainly in the supervision: for essential entities, the regulator may also inspect on its own initiative, while for important entities this mainly happens afterward. Does your company belong to a group, or do you operate in multiple countries? Then the NCSC's guidance on complex business models can help.
What do you need to do if it applies to you?
- Register. You register your organization via MijnNCSC.
- Duty of care. You carry out a risk analysis and take appropriate and proportionate measures. The NCSC lists at least ten topics, including incident handling, backups and recovery, the security of your supply chain, training, updates, access management, multi factor authentication or passkeys, encryption, and testing whether your measures work. The board approves the measures and supervises them.
- Reporting duty. You report a significant incident via MijnNCSC: an initial warning within 24 hours, a report with an initial assessment of severity and impact within 72 hours, and a final report within one month.
This report is separate from the data breach reporting duty under the GDPR. That applies to everyone who processes personal data, including sole traders, and is reported to the Dutch Data Protection Authority. So an attack in which customer data was also stolen may need to be reported to both.
Doesn't it apply to you? The supply chain can still affect you
Most small businesses aren't covered by the law. In that case, you have no registration duty, no reporting duty to the NCSC, and no supervision. However, organizations that are covered also need to take into account the risks at their direct suppliers and service providers. According to the NCSC, the law doesn't impose obligations on suppliers themselves, but customers are allowed to set requirements for their digital security. These are then included in a contract or a questionnaire.
Do you supply to a larger organization, for example as a web developer, IT manager, or accounting firm? Then you might get questions like: do you use two-step verification, who has access to our data, where are the backups stored, and how quickly do you report an incident?
- Requirements should be appropriate to the risk of your service. A supplier with access to the systems will face stricter requirements than the bakery that delivers the lunch.
- It concerns direct suppliers. The suppliers of your suppliers fall outside the scope.
- The law doesn't require a certificate. It can help in the conversation, but it's not a guarantee.
- Start on time: map out which measures you already have in place and record agreements with your customer.