Tackling cybercrime is necessary. In the Netherlands, the European NIS2 directive is being fleshed out with the Cyber Security Act (Cbw), which is expected to come into force in 2026. This new law requires organisations that are essential or important under the NIS2 directive to put their digital resilience in order and be accountable for it. It is vital that organisations check whether they are covered by the law and ensure they are well prepared. "Start this in time," warns Matthijs van Amelsfort, director of the National Cybersecurity Centre (NCSC). "It requires awareness throughout the organisation."
The number of ransomware attacks aimed at data theft has doubled in the past year. Cyber attacks at Clinical Diagnostics and several municipalities show that it can happen to anyone, with all its consequences. Cybercrime can lead to financial damage, operational disruptions, reputation damage to potential privacy breaches. Strengthening organisations' digital resilience is more important than ever. Yet taking action on cybercrime lags behind. For instance, the Business Alert Online 2025 sub-report shows that in almost half (47%) of the cases in which an employee faced cybercrime, no report or notification was made.
Cybersecurity law
The Cyber Security Act obliges organisations, with its accompanying duty of care, notification, registration and monitoring, to set up their processes in such a way as to increase their cyber resilience. In doing so, they not only better protect their own organisational interests, processes and systems against cybercrime, but also the digital security of the Netherlands and Europe.
Organisations, prepare
Taking appropriate measures requires good preparation. Think about doing a risk analysis, identifying critical processes and taking security measures. "Doing a proper risk analysis and taking appropriate measures is time-consuming," Van Amelsfort stresses. "So don't wait, but start preparing in time. Also realise that the Cybersecurity Act goes beyond compliancy. It requires awareness and a new action perspective throughout the organisation. Support must be created for it by taking action and that takes time and energy."
Realise that the Cybersecurity Act goes beyond compliance. It requires awareness and a new action perspective across the organisation.Matthijs van Amelsfort, director of the National Cybersecurity Centre (NCSC)
Concrete steps - Register
Companies can take various steps to improve their digital resilience.
• Assess as soon as possible whether your organisation falls under the new legislation. You can use the RDI’s self-assessment tool, amongst other resources, to do this.
• Register your organisation via mijn.ncsc.nl. Following registration – which is currently still voluntary – Cbw organisations will gain access to the services provided by the relevant sectoral CSIRT, such as information on threats, vulnerabilities and incidents.
Duty of care and steps towards compliance
• Get started with your duty of care: implement security measures and identify areas for improvement.
• The recently launched Cbw Control Framework, developed by the Central Government Audit Service and NOREA, provides directors and CISOs with insight into the current state of digital resilience and the steps required to achieve compliance.
Action after cybercrime
• Draw up an Incident Response Plan setting out measures for dealing with incidents.
• If you do not have the necessary in-house expertise, consider seeking assistance from an IT security firm.
• Join the DTC Community and discuss the Cyber Security Act with other professionals. In the Cbw collaboration space for professionals, you can ask questions, find relevant information and benefit from knowledge sharing. The DTC Community is facilitated by the Digital Trust Centre (which will become part of the NCSC in 2026).
Support and participation
Several government organisations provide information to support organisations on their way to the Cybersecurity Act. For example, the National Cyber Security Centre (NCSC) offers practical tools such as infosheets and knowledge products on the website ncsc.nl. Webinars are also organised to prepare for the law together with the National Coordinator for Counterterrorism and Security (NCTV) and other cooperation partners.
Structural good security
Importantly, it is essentially not just about complying with the Cybersecurity Act. The core lies in structurally securing one's own organisation properly, so that the risk of serious disruptions to key processes is reduced and the organisation can remain operational.
Also read: Dutch manufacturing industry increasingly vulnerable to serious cyber attacks
Opening photo: Jaydeep Joshi via Pixabay
