Since 15 August 2026, the Cyberbeveiligingswet (Cbw), the Dutch Cybersecurity Act, has applied in the Netherlands. It is the Dutch implementation of the European NIS2 legislation. If the law applies to you, you must register now, have your security in order and report incidents within 24 hours. Yet many business owners still do not know whether NIS2 applies to their company. For NIS2 in SMEs, it comes down to two questions: which sector do you work in, and how big is your company? Below is a short NIS2 checklist that helps you answer those questions and shows the ten areas you need to be able to tick off. Even if the law does not apply to you, keep reading. Large customers that do fall under the law increasingly impose the same requirements on their suppliers.
Your company falls under NIS2 if it operates in one of the sectors listed in the directive and is at least medium-sized: 50 employees or more, or an annual turnover and balance sheet total of more than €10 million. For a few services, such as DNS services and water boards, the law applies regardless of size.
According to the NCSC, this concerns around 8,000 organisations in the Netherlands. Whether you are one of them is something you have to determine yourself. The government does not check this for you in advance. You can find out on the NCTV page about which organisations fall under the Cyberbeveiligingswet (in Dutch).
Have you concluded that the law applies to you? Then the first obligation is simple: register your company. You do this in the entity register via MijnNCSC, using eHerkenning (the Dutch business login).
And then there is the route many SMEs underestimate. If you supply IT services, software or components to a hospital, an energy company or a transport company, that customer has to assess the security of its suppliers. That is not a legal obligation for you, but it does end up on your desk: as a questionnaire, a contract requirement or a condition in the next tender. So be prepared for it.
The directive lists 18 sectors, divided over two annexes.
Sectors of high criticality (Annex I):
Other critical sectors (Annex II):
That second list often surprises business owners. A machine builder with 80 employees or a food producer with 60 staff quickly assumes NIS2 is something for energy companies and hospitals. But they may fall under it too.
For NIS2 in SMEs, size is often the deciding factor. Companies with fewer than 50 employees and no more than €10 million in turnover or balance sheet total generally fall outside its scope. Unless you operate as an SME in one of the sectors above.
Above that threshold, the law distinguishes between two types of organisations:
That distinction has consequences. For an essential entity, the supervisory authority can visit on its own initiative, even when nothing is wrong. An important entity is supervised after the fact, for example following an incident or a complaint. The obligations themselves are largely the same. The fines are not; more on that below.
This NIS2 checklist follows the four core obligations of the law: you register your company with the NCSC, you carry out a risk analysis and take appropriate measures (the duty of care). You report significant incidents within 24 hours, followed by more information after 72 hours and a final report after one month (the reporting obligation). And the board approves the measures, oversees them and completes training itself.
Please note: following the checklist below does not automatically make you NIS2 compliant. You can use it as a guide to take the right steps with your company and ultimately comply with NIS2. We have tried to describe the 10 security measures as simply and concisely as possible.
Everything starts with a risk analysis. The NCSC puts it like this: you carry out a risk analysis and, based on it, take "appropriate and proportionate measures" to secure your network and information systems.
Appropriate and proportionate. That means a plumbing company with 55 employees does not have to do the same as a hospital. But it does mean you must be able to explain why you do or do not do something. Get a first view of the risks to your domain with the free cybersecurity scan.
Start with the question: which systems and data do you need to operate? Think of your ERP (your business administration system), your email environment, your planning, your customer data. What happens if that system is down for a week? And what if the data is leaked? The answers determine where measures are needed most. Backups you have actually restored belong here too, as does a plan to get back up and running after an outage.
It is Tuesday morning, 7:40 am. An employee calls: nobody can log in and the file server only contains encrypted files. Who makes the decisions now? Who takes systems off the network? Who calls the customers and who reports the incident to the supervisory authority?
If you still have to work out those answers in the moment, you are too late. An incident response plan sets them out in advance: the roles, the first steps (isolate, investigate, recover), the contact details of your IT partner and insurer, and who handles the reporting obligation. Without a plan, you will have to move very fast to meet the 24-hour reporting deadline.
A plan sitting in a folder is a start. A plan you have rehearsed once is better. So it is important not only to prepare your organisation for an incident, but also to let it practise.
The reporting obligation for cybersecurity incidents has three moments:
Incidents can be reported to the CSIRT (the Computer Security Incident Response Team for your sector) and to the central reporting point, the NCSC. An incident is significant if it seriously disrupts your services, causes substantial financial damage or affects others.
The clock starts ticking at discovery. And that is the real problem for many SMEs. A suspicious login on Friday evening that is only noticed on Monday morning is already 60 hours old by then.
Most breaches start with a stolen password. Multi-factor authentication (MFA), where you need a code or a prompt on your phone in addition to your password, makes a stolen password less effective. Enable it first on email, remote access (VPN, remote desktop) and all admin accounts, but make sure every application and account eventually has MFA.
In addition, give employees and suppliers access only to what they really need. Use separate accounts for administration and revoke access on the day someone leaves, not a month later. In short, set up processes for handling accounts, supplier access and authentication securely.
A phishing email that looks exactly like an invoice from your regular supplier will reach someone sooner or later. Technology catches a lot, but not everything. Employees who recognise and report a suspicious email, combined with the right tools, form a strong digital defence for your business.
NIS2 explicitly requires training, and not only for employees. Directors must also complete training, so they understand the risks they approve. Practising with simulated phishing emails and discussing the results therefore works well.
Your security is only as strong as that of your IT partner, your cloud provider and the software supplier with remote access. Under NIS2 you must assess those supply chain risks: which suppliers are critical and what have you agreed on security?
It also works the other way round. If the law does not apply to you but you supply an organisation that it does apply to, you will receive questionnaires about exactly this checklist. If you already have the answers ready, you have a head start on competitors who still have to begin. And as a supplier you come across as strong and convincing to your existing customers.
A backup you have never restored is an assumption. Only once you have actually tried to restore a server or mailbox do you know how long it takes and whether it works. NIS2 requires more than just backups. You also need a plan to get back up and running after an attack or outage, and an approach for the crisis itself: who takes the lead, how do you inform employees and customers, and what do you do if email and phones are down as well? This ties in with having an incident response plan.
For each critical system, decide how long it may be down at most and how much data you can afford to lose at most. Those two figures determine how often you make backups and how quickly you need to be able to recover. Keep at least one backup offline or immutable, so ransomware cannot reach it.
Every system you buy or have built is also a potential entry point for attackers. The law therefore requires you to take security into account from purchase until the moment a system is retired. In practice, it is mostly about maintenance. Most attacks exploit vulnerabilities that could have been patched long ago. In practice that is not always easy, but it still needs to be handled adequately.
Set a fixed timeframe for updates, and an even shorter one for critical vulnerabilities. Know which business systems no longer (can) receive updates, such as an old Windows server or an unsupported firewall, and make a plan to replace them. When buying new software or taking on a new supplier, make sure security requirements are included in the request for quotation.
Leaving a laptop on the train is annoying. A laptop without an encrypted drive, with customer data on it, is a data breach. Encryption makes data unreadable to anyone who does not have the key. NIS2 requires a policy for its use: where do you encrypt, with which method, and who manages the keys?
For most SMEs it starts with three things: encrypted drives on laptops and phones, encrypted connections (HTTPS, VPN) and encrypted backups. The law also requires secure communication.
Measures on paper say little about what they do in practice. The law therefore requires policies and procedures to assess the effectiveness of your measures. Is MFA really enabled on all accounts, or are there three exceptions nobody remembers? Are backups still being made since the last change?
Schedule fixed review moments. An internal or external audit, for example based on ISO 27001 (the international standard for information security), shows whether your policy and practice match. Record the results, so you can demonstrate to the supervisory authority and customers that you take your duty of care seriously.
NIS2 has a strict penalty regime. For essential entities, fines can reach €10 million or 2% of worldwide annual turnover. For important entities, the maximum is €7 million or 1.4%. Whichever amount is higher applies.
The board is also at risk. Directors must approve the measures and oversee their implementation, and can be held liable if they fail to do so. At essential entities, a director can even be temporarily suspended from their position.
First of all, we do not plan and run full NIS2 programmes. Other companies specialise in that. The legal assessment of whether the law applies to you, the policy and the board decisions also remain with you. If you are looking for full guidance with implementation, we are happy to refer you to partners we work with.
Where we do help is the part of the checklist that is hardest to arrange yourself: spotting incidents in time and responding to them.
Want to know exactly how detection and response contribute to the requirements of the law? Read how MDR helps with NIS2.
