No. Organizations with ISO 27001 certification often already have a strong foundation for the Cybersecurity Act, because areas such as risk management, access control, incident management, and continuous improvement are already in place. Nevertheless, they must assess which additional Cybersecurity Act requirements still need to be met.

ISO 27001 and the Cybersecurity Act have many similarities. Both help organizations manage risks and improve their information security. The main difference is that ISO 27001 is a certification, while the Cybersecurity Act is a legal requirement.

Organizations subject to the Cybersecurity Act must comply with additional requirements that are not explicitly included in ISO 27001.

The Cybersecurity Act makes cybersecurity the responsibility of management and the board of directors. Directors must approve appropriate measures, oversee their implementation, and possess sufficient knowledge to assess cyber risks. Although a cyber incident does not automatically lead to personal liability, the importance of demonstrable governance and oversight is increasing significantly. That is why many organizations are investing in board training and structured support from a CISO.

The Cybersecurity Act makes cybersecurity the responsibility of executive management and the board of directors. Directors must ensure that cyber risks are managed, appropriate measures are taken, and the organization complies with its legal obligations. In addition, they must have sufficient knowledge to fulfill this responsibility. That is why more and more organizations are investing in NIS2 or CBW training for directors.

The Cybersecurity Act gives regulators the authority to impose administrative fines when organizations fail to meet their legal obligations. The amount of the penalty depends on the nature and severity of the violation, its impact on service delivery, and the extent to which appropriate security measures have been implemented. Organizations would therefore be wise to ensure that their compliance and cyber resilience are demonstrably in order.

Organizations subject to the Cybersecurity Act may be subject to oversight and enforcement if they fail to comply with their legal obligations. Depending on the situation, a regulatory authority may impose measures such as an order, a penalty payment, or an administrative fine. In addition, cyber incidents can lead to operational damage, reputational damage, and liability risks. That is why it is important to gain insight into risks in a timely manner, take appropriate measures, and demonstrably fulfill the duty of care.

The law does not require organizations to appoint a CISO. However, the law does require that cyber risks be actively managed, that responsibilities be clearly assigned, and that executives be demonstrably involved in cybersecurity.

Because many organizations do not have this expertise in-house, they opt for CISO as a Service. This gives them access to experienced security specialists who assist with risk management, compliance, governance, and fulfilling the responsibilities of executive management and the board of directors.

You can determine this by conducting a CBW Gap Analysis. This will provide insight into which measures are already in place, which components are missing, and what actions are needed to comply with the Cybersecurity Act.

The Cybersecurity Act requires organizations to address at least the following ten due diligence measures:

1. Risk Analysis
Identify cyber risks, threats, and vulnerabilities within your organization.

2. Incident Response
Establish processes for identifying, managing, and resolving cyber incidents.

3. Business Continuity and Recovery
Ensure you have backups, recovery plans, and crisis management in place so that business processes can continue after an incident.

4. Supply Chain Security
Identify supplier risks and take measures to increase the resilience of the supply chain.

5. Cyber Hygiene and Security Awareness
Promote safe digital behavior, cybersecurity training, and a strong security culture.

6. Network and Information Systems Security
Protect systems through patch management, hardening, and vulnerability management.

7. Access and Asset Management
Manage user permissions, company assets, and sensitive information in a controlled manner.

8. Strong Authentication
Use passkeys, multi-factor authentication (MFA), and secure communication channels whenever possible.

9. Cryptography and Encryption
Protect sensitive data with appropriate encryption and a cryptography policy.

10. Assessing the Effectiveness of Measures
Periodically check whether security measures are still effective and make adjustments as needed.

Organizations subject to the Cybersecurity Act are subject to various legal obligations. The most important ones are:

Registration Requirement Organizations subject to the Cybersecurity Act must register in the entity registry so that regulators, CSIRTs, and government agencies know which organizations are subject to the Act.

Duty of Care Organizations must take appropriate technical, organizational, and operational measures to manage cyber risks and enhance their digital resilience. The law outlines ten duty of care measures for this purpose.

Reporting Requirement Significant cyber incidents must be reported to the designated authorities within the statutory time limits.

Directors’ Responsibilities
Directors must approve cybersecurity measures, oversee their implementation, and possess sufficient knowledge to fulfill this responsibility. For this reason, directors are also required to undergo training.

Supervision and Enforcement
Organizations may be inspected by supervisory authorities that monitor compliance with the Cybersecurity Act.

Even if your organization is not directly subject to the Cybersecurity Act, you may still be indirectly affected by it. This is because organizations that are subject to the law are required to manage risks in their supply chains. As a result, they are increasingly imposing requirements on suppliers, IT partners, and service providers.

For example, you may be asked to:

• To have demonstrably implemented security measures.
• To provide insight into vulnerabilities and risks.
• Be able to provide information security policies and procedures.
• Conduct awareness training sessions for employees.
• Conduct regular penetration tests or security assessments.
• To demonstrate how cyber incidents are handled.
• To comply with standards such as ISO 27001, NEN 7510, or comparable security standards.

By investing in cybersecurity resilience now, you not only enhance your organization’s security, but you also make it easier to meet the requirements of customers, tenders, and supply chain partners. This prevents cybersecurity from becoming an obstacle to existing or new contracts.

The law applies to organizations in essential and critical sectors, such as healthcare, government, energy, manufacturing, transportation, ICT, and digital services. Suppliers to these organizations are also increasingly facing additional requirements from customers and supply chain partners.

The Cybersecurity Act took effect on August 15, 2026. Since that date, organizations subject to the Act have been required to comply with its obligations.