Netherlands implements Cybersecurity Act following digital vulnerabilities

The Netherlands has implemented the Cybersecurity Act (Cbw), the national execution of the European NIS2 directive. The law, which came into effect in August, establishes a framework of obligations and responsibilities to enhance digital resilience across eighteen sectors.

Approximately 8,000 organizations are subject to the act, specifically those providing services essential to society and the economy. Under the new regulations, covered entities face three primary obligations: a duty of care to implement appropriate measures against cyber risks, a mandatory reporting requirement for significant incidents, and a registration requirement.

The legislation also imposes specific responsibilities on boards and supervisors. Recent digital vulnerabilities, such as the precautionary shutdown of logistics systems at Albert Heijn and the temporary offline status of Dutch government websites like DigiD due to PHP vulnerabilities, have highlighted the necessity of this regulatory framework.