The Cybersecurity Act (Cbw): What Are Your Legal Obligations, and How Do You Comply With Them?
The Cybersecurity Act (Cbw) is the Dutch implementation of the European NIS2 Directive. The law is designed to significantly increase the European Union’s digital resilience. Whereas previous legislation focused primarily on traditional critical sectors, the Cbw brings a much larger group of organizations under the scope of the law.
Does your organization fall within the scope of these regulations? If so, you’ll be subject to strict duties of care and reporting requirements. Furthermore, directors can be held personally liable for any failure to comply. This article outlines the key obligations and the steps you need to take.
The Cybersecurity Act?
The law distinguishes between essential and important entities, which are generally classified based on sector and size (medium-sized and large companies with more than 50 employees or revenue/total assets exceeding €10 million).
- Critically important sectors: These include energy, transportation, banking, healthcare, digital infrastructure, and government agencies (essential).
- Other critical sectors: Including waste management, manufacturing, postal services, food, and digital service providers (important).
From the Cbw
Organizations subject to the law must comply with a number of fundamental legal requirements:
1. Duty of Care (Risk Management Measures)
Organizations are legally required to implement appropriate and proportionate technical, operational, and organizational measures to ensure the security of network and information systems. These measures must minimize risks and limit the impact of incidents. They must include, at a minimum:
- Policy on Risk Analysis and Information Security.
- Incident Response.
- Business continuity, such as backup management and disaster recovery.
- Security in the supply chain and in the procurement and development of systems.
- The use of encryption and multi-factor authentication (MFA).
2. Mandatory Reporting (Reporting Incidents)
The CBW has a strict and tiered reporting procedure for significant cyber incidents.
- Early Warning: Within 24 hours of a significant incident being detected, an initial report must be filed with the exchanges/authorities (such as the CSIRT/NCSC).
- Incident Report: A detailed report, including an initial assessment of the severity and impact, will be provided within 72 hours.
- Final Report: A complete final report must be submitted no later than one month after the incident is reported.
3. Management Liability and Oversight
A significant change from previous legislation is the responsibility of management.
- The board is required to approve the risk management measures and ensure compliance with them.
- Board members may be held personally liable or face substantial administrative fines if they systematically disregard their duty of care.
- Directors are required to complete mandatory cybersecurity training to maintain sufficient knowledge of cyber risks.
What specific actions should be taken to comply?
To comply with the law and effectively mitigate risks, a structured approach is necessary:
1. Scope and Legal Analysis
Determine whether your organization formally falls under the definition of an essential or significant entity.
2. Baseline Assessment and Risk Assessments
Conduct a thorough gap analysis to evaluate how current security measures measure up against standards such as ISO 27001, CIS 18, or specific CBRN requirements.
3. Governance and Awareness
Ensure that management is demonstrably involved and schedule training sessions for executives and employees.
4. Develop an Incident Response Plan
Ensure that procedures are in place to enable you to respond and report appropriately within the statutory timeframes of 24 and 72 hours.