Cbw/NIS2 for transport and logistics

• A customer demands that we comply with NIS2, but we are not covered by it. What now?

  If you are not covered by the Cbw yourself, the statutory duties do not apply to you. A customer that is covered must secure its supply chain and periodically check whether its direct suppliers meet its security requirements, insofar as their products or services can affect the security of its network and information systems. Those requirements reach you through the contract.

• Are handheld scanners, control systems and warehouse automation covered by the Cbw duty of care?

  Yes, if your company is covered by the Cbw and you use those systems for your work or your services. The act counts every device that automatically processes digital data on the basis of a program as part of the network and information systems, and the measures also protect the physical environment of those systems. So include handheld scanners, sorting and control systems, on-board computers and similar equipment in your inventory and risk analysis.

• Are port terminals, stevedores and other port companies covered by the Cyberbeveiligingswet?

  Often yes, if they are medium-sized or larger and work in a seaport. Next to port managers and their port facilities, Annex 1 of the Cbw expressly names the entities that manage works and equipment in ports. A terminal or stevedore that itself operates cranes or other equipment in a seaport is as a rule covered; a terminal in an inland port that serves only inland shipping is as a rule not. For transport companies on the water, an outage of transshipment of twelve hours or longer is also a significant incident.

• As an important entity, do you face inspections or an audit by the supervisory authority?

  For an important entity the supervisory authority acts only if there is evidence, an indication or information about a possible infringement. It can then have a security scan carried out, require an audit by an independent expert, give a binding instruction or demand publication of the infringement. For an essential entity that condition does not apply and it can also appoint a monitoring officer. The cost of an audit is as a rule borne by the entity.

• Can the minister forbid you from using products or services of a particular supplier?

  Yes, if that is necessary for national security. The minister can oblige an essential or important entity to use, in designated parts of its network and information systems, only products or services from parties other than a party he names. For what you already use, he sets a period for replacement or termination. An infringement falls under the highest fine maximum of the Cbw.

• Can the supervisory authority have a director suspended under the Cbw?

  Only for an essential entity, and only as a last step. If the entity has not ended an infringement before an end date that the authority may set only after earlier measures have not worked, the authority can ask the court to suspend one or more members of the management body for as long as the entity does not comply. For important entities the act has no such step. Every member of the management body can, however, be fined if it does not meet the knowledge and certificate requirements.

• Do you comply with the Cyberbeveiligingswet if you hold an ISO 27001 certificate?

  Not automatically. The Cbw does not prescribe ISO 27001 certification and, according to the act, a standard is not mandatory. You do take European and international standards into account, and the Cbb asks for a management system with which you demonstrably comply with the duty of care. The rules were drawn up with ISO 27001 as the starting point, so an existing management system is a good basis, but you check yourself that all Cbw requirements are in it.

• Do you have to report a near miss or a cyber threat under the Cbw?

  No, the reporting duty applies only to significant incidents. You may report an incident, near miss or cyber threat voluntarily to your CSIRT. You must, however, tell customers who may be affected by a significant cyber threat, without delay, which measures they can take.

• Does the Cbw duty of care also apply to your TMS, WMS or telematics in the cloud?

  Yes. The duty of care covers all network and information systems you use for your work or services, even if a supplier delivers them as SaaS or a cloud service. You remain responsible; the supplier falls under your supply chain security (Cbw 21).

• Does the Cbw management duty also apply to partners of a vof, maatschap or cv?

  Yes, if the maatschap (professional partnership), vof (general partnership) or cv (limited partnership) is itself an essential or important entity. The approval of the measures and the knowledge and certificate requirements then apply to every partner of the maatschap, every partner of the vof and the managing partners of the cv. If a legal person is a director, the knowledge and certificate requirements apply to the natural persons who sit on the management body on its behalf.

• How do you set up incident handling under the Cbw (NIS2 21(2)(b))?

  You draw up written policy for incident handling, assign roles for detecting, analysing, responding, documenting, reporting and learning, monitor relevant events and keep log files (Cbw 21(3)(b), Cbb 8).

• How do you show that your cybersecurity measures work (NIS2 21(2)(f))?

  You periodically evaluate the effectiveness of your measures and their effect in practice, record the result in writing and adjust the measures where necessary (Cbw 21(3)(f), Cbb 18).

• How long must you keep log files under the Cyberbeveiligingswet?

  The Cbw and the Cbb name no fixed number of months. You log the events that are relevant to security, determine in advance how long you keep the log files and protect them against unauthorised changes. Choose a period that lets you reconstruct an incident, and do not keep personal data in logs longer than necessary.

• Is multi-factor authentication mandatory under the Cbw (NIS2 21(2)(j))?

  The act requires multi-factor or continuous authentication and secure communication when appropriate: you assess it per access and record your decision. You check access and authorisations periodically (Cbw 21(3)(j), Cbb 15).

• Is my inland shipping or shipping line company covered by the Cyberbeveiligingswet?

  If you are medium-sized or larger, yes. Annex 1 of the Cbw names companies for transport by water, inland shipping, coastal and sea transport, of passengers and freight. It concerns the company that operates the vessels; the individual vessels are excluded. A small or micro company, like many single-ship businesses, is as a rule not covered.

• Is my road transport company covered by the Cyberbeveiligingswet?

  As a rule not. For road transport, Annex 1 of the Cbw names only road authorities and operators of intelligent transport systems, not carriers of goods or persons. You are covered if you are medium-sized or larger and also carry out an activity from Annex 1 or 2, for example as a postal or courier service.

• Is your company an essential or an important entity?

  A company in a sector of Annex 1 that is larger than medium-sized (250 or more employed persons, or annual turnover of more than 50 million euros and a balance sheet total of more than 43 million euros) is an essential entity. A medium-sized company in Annex 1, and a medium-sized or larger company in Annex 2 (such as postal and courier services), is an important entity. Small and micro enterprises are as a rule not covered, unless the minister designates them as essential entities. A company designated as a critical entity under the Wet weerbaarheid kritieke entiteiten (Wwke) is always an essential entity, regardless of size.

• May you share information about cyber threats and incidents with other logistics companies?

  Yes. The Cbw expressly allows companies, including companies not themselves covered by the act, to exchange cybersecurity information voluntarily in order to prevent, detect or mitigate incidents, for example in a sector exchange with agreements on confidentiality. If you fall under the Cbw, you report participation in or withdrawal from such an arrangement for the national register.

• Must you also report a cyber incident as a data breach to the Autoriteit Persoonsgegevens?

  Often yes. If a cyber incident affects personal data, you report it as a data breach to the Autoriteit Persoonsgegevens without undue delay and, where feasible, within 72 hours, unless it is unlikely to result in a risk to the data subjects. That GDPR duty is separate from the Cbw: it also applies to an incident that is not significant and also if you are not covered by the Cbw.

• Must you appoint a CISO or security officer under the Cyberbeveiligingswet?

  A function with that name is not mandatory. You do, however, record the roles, responsibilities and powers for security, separate conflicting roles as far as possible, designate the people with security tasks and make sure they receive regular training. When you report, you name an officer who is responsible for the report. The management body remains ultimately responsible.

• Must you have a policy on cryptography and encryption under the Cbw (NIS2 21(2)(h))?

  Yes. You record policy and procedures on the use of cryptography: when you use it, which encryption you use, and who is responsible for implementation and key management (Cbw 21(3)(h), Cbb 13).

• Must you inform your customers about a cyber incident?

  Yes, as the case may be without delay: about significant incidents that can harm the service to them, and in the event of a significant cyber threat about the measures they can take themselves (Cbw 30).

• Must you register your company under the Cyberbeveiligingswet, and when?

  Yes. An essential or important entity provides the data for the national register; that duty has applied since 15 August 2026, with no later deadline or transitional period. You report changes without undue delay or in any event within two weeks of the date of the change (Cbw 44, Cbb 27).

• Must you report an incident that takes place at your IT supplier or cloud provider?

  Yes, if it is a significant incident for your own services. The reporting duty depends on the consequences for your services, not on where the incident arises: if a disruption or hack at your supplier causes a serious operational disruption of your services or financial losses for you, you report it yourself, within 24 hours of becoming aware of it. A cloud provider that is itself covered by the Cbw also has its own reporting duty.

• Must you review your risk analysis and security policy every year under the Cbw?

  The Cbb names no fixed period. You evaluate your measures periodically and record the result, test your continuity, recovery and crisis plans periodically, and check suppliers and access rights periodically. You determine and justify yourself which period is appropriate, based on your risks. Only for cloud, IT and other digital service providers does at least once a year apply.

• Since when does the Cyberbeveiligingswet apply, and is there a transitional period?

  The Cyberbeveiligingswet and the Cyberbeveiligingsbesluit have applied since 15 August 2026. There is no transitional period for the duty of care, the reporting duty and registration; only members of the management body have until 15 August 2028 to meet the knowledge requirement.

• What are the Cbw requirements for cyber hygiene and staff training (NIS2 21(2)(g))?

  Your staff, as far as relevant for the function, are aware of the risks and apply cyber hygiene; employees with security tasks receive regular training (Cbw 21(3)(g), Cbb 12). This is an organisation-wide duty.

• What does the Cbw require on business continuity, backups and crisis management (NIS2 21(2)(c))?

  You have a business continuity policy and plan, a recovery plan and a crisis plan, make backups of software and data, check them periodically and test the plans (Cbw 21(3)(c), Cbb 9).

• What does the Cbw require on personnel, access management and an inventory of assets (NIS2 21(2)(i))?

  You assign security roles and set reliability requirements, have policy for logical and physical access with periodic checking of authorisations, and keep a complete and up-to-date inventory of your assets (Cbw 21(3)(i), Cbb 14 to 16).

• What does the Cbw require on vulnerabilities, patches and maintenance of systems (NIS2 21(2)(e))?

  You secure the acquisition, development and maintenance of systems, with processes for configuration and change management, and assess in writing what you do with targeted notifications about vulnerabilities (Cbw 21(3)(e), Cbb 11 and 17). The ministerial regulation for your sector additionally requires patch management within a reasonable period, vulnerability scans where appropriate and remedying vulnerabilities that pose a risk without delay.

• What does the duty of care of the Cyberbeveiligingswet involve?

  The duty of care (Cbw Article 21) obliges an essential or important entity to take appropriate and proportionate measures to manage the risks to its network and information systems. The act names ten topics that must be in it at least; the duty has applied since 15 August 2026 and the management body approves the measures.

• What is the difference between NIS2 and the Cyberbeveiligingswet?

  NIS2 is a European directive, addressed to the Member States; they had to transpose it into national law. In the Netherlands that was done with the Cyberbeveiligingswet and the Cyberbeveiligingsbesluit, which have applied since 15 August 2026 and replace the old Wet beveiliging netwerk- en informatiesystemen. As a company you are therefore tested against the Cbw, the decree and the ministerial regulation for your sector; cloud and IT service providers in addition against a directly applicable European implementing regulation.

• What must be in your policy for risk analysis and information security (NIS2 21(2)(a))?

  You record a security policy and a risk management policy in writing and demonstrably apply them: with a method, criteria for risk acceptance, a risk overview and the security requirements that follow from it (Cbw 21(3)(a), Cbb 6 and 7).

• What must the early warning within 24 hours contain?

  In the early warning you state whether the incident is presumably malicious, whether it can have cross-border effects and who the contact person is, plus the presumed start time and, where possible, the nature, the expected recovery time and the measures (Cbw 26, Cbb 24).

• What must the final report on an incident contain, and when is it due?

  No later than one month after the notification you submit a final report with a detailed description, the cause, the measures taken and any cross-border impact. If the incident is still ongoing by then, you submit a progress report and the final report follows within one month of handling (Cbw 29).

• What must the management body do under the Cyberbeveiligingswet?

  The management body approves the cybersecurity measures, every member of the management body has the knowledge and skills to assess risks and measures, and demonstrably keeps that knowledge up to date (Cbw 24).

• What must you arrange under the Cbw for your suppliers and IT service providers (NIS2 21(2)(d))?

  You establish policy for the security of your supply chain, determine how you deal with dependencies on suppliers and periodically check whether your direct suppliers and service providers meet your security requirements (Cbw 21(3)(d) and 21(4), Cbb 10).

• When and where do you report a significant incident under the Cbw?

  You report a significant incident in steps to your CSIRT and your competent authority: an early warning without undue delay or, if that is not possible, within 24 hours, a notification without undue delay or, if that is not possible, within 72 hours, and a final report no later than one month after the notification. For a trust service provider the notification deadline is 24 hours if the significant incident affects the provision of that service. If the incident is still ongoing at that point, you submit a progress report then and the final report follows within one month of handling. You report to the reporting point that the Minister of Justice and Security has set up for this.

• When is a cyber incident a significant incident?

  You test that first against the threshold values for your sector. For transport and chemicals they are in the Cyberbeveiligingsregeling IenW, for postal and courier services in the Regeling cyberbeveiliging EZK and for food in the Regeling cyberbeveiliging LVVN; if an incident reaches such a threshold or can reach it, it is significant. The act itself names as the yardstick a severe operational disruption or financial losses for your company, or considerable damage to others (Cbw 25, paragraph 2). Only significant incidents fall under the reporting duty.

• When must a director have completed the Cbw training and what is on the certificate?

  Directors who were already in office on 15 August 2026 must have the required knowledge by 15 August 2028 at the latest; a director appointed later, within two years of the appointment. The certificate states name, date, topics and provider, in Dutch or English (Cbw 24, Cbb 20 to 22).

• Where do you report a vulnerability you find in a supplier's software or equipment?

  Anyone can report a vulnerability voluntarily, and anonymously if desired, to the coordinator for coordinated vulnerability disclosure. That is the Minister of Justice and Security; in practice the Nationaal Cyber Security Centrum (NCSC) performs that role. The coordinator can mediate between you and the manufacturer or provider. If you are covered by the Cbw yourself, dealing with vulnerabilities is also part of your duty of care. For the manufacturer of the product, a reporting duty of its own also applies since 11 September 2026: it reports an actively exploited vulnerability via the single reporting platform of Enisa (Cyber Resilience Act, Article 14).

• Which Cbw rules apply if you are a cloud or IT service provider for logistics?

  If you are a provider of cloud, data centre or managed (security) services, Cbb Articles 6 to 18 do not apply. The duty of care of Cbw Article 21 remains, but Implementing Regulation (EU) 2024/2690 lays down the technical requirements and when an incident is significant.

• Which documents and policies must you have under the Cyberbeveiligingswet?

  The Cbb requires written policy for security, risk management, incident handling, business continuity, the supply chain, acquisition, cryptography, access and assets, plus a business continuity plan, a recovery plan, a crisis plan and an up-to-date inventory of your assets. You also record the outcome of evaluations and of assessments of targeted warnings. How many documents that becomes and how thick they are is up to you.

• Which measures does NIS2 Article 21 require and where are they in the Cbw?

  NIS2 Article 21(2) lists ten measures (a to j). The Netherlands has taken them over word for word in Article 21(3) of the Cyberbeveiligingswet and elaborated them in Articles 6 to 18 of the Cyberbeveiligingsbesluit.

• Which transport and logistics companies fall under the Cyberbeveiligingswet?

  Within transport, the Cbw names airlines, airports and air traffic control, railway undertakings and infrastructure managers, water transport companies and port authorities, and on the road only road authorities and operators of intelligent transport systems. Postal and courier services, wholesalers of food, distributors of chemicals and IT service providers may also fall under it. Small and micro enterprises as a rule do not.

• Who is your CSIRT under the Cbw and what help do you get after a report?

  For essential and important entities the Minister of Justice and Security is the CSIRT; in practice the Nationaal Cyber Security Centrum (NCSC) carries out that task. For transport and logistics, a different CSIRT has been designated only for the water boards (waterschappen). After an early warning the CSIRT gives an initial response without delay and, where possible, within 24 hours, at your request with advice on measures, and on request additional technical support. Responsibility for resolving the incident stays with you.

• Who supervises the Cbw in transport and logistics, and how high are the fines?

  For transport the Minister of Infrastructure and Water Management is the competent authority and the Inspectie Leefomgeving en Transport (ILT) supervises; for postal and courier services and the management of ICT services that is the Minister of Economic Affairs, with the Rijksinspectie Digitale Infrastructuur (RDI); for food it is the Minister of Agriculture, Fisheries, Food Security and Nature, with the Netherlands Food and Consumer Product Safety Authority (NVWA). If your company has also been designated as a critical entity under the Wet weerbaarheid kritieke entiteiten (Critical Entities Resilience Act), the competent authority under that act is also your competent authority under the Cbw. For a breach of the duty of care or the reporting duty the fine is at most EUR 10 million or 2% of worldwide annual turnover (essential) or EUR 7 million or 1.4% (important); a member of the management body can be fined up to EUR 25,000.

• Your parent company or a branch is in another EU country. Which NIS2 law applies to you?

  For a company established in the Netherlands that provides its services in the EU, the Dutch Cbw applies, even if the parent company is abroad. For your establishments in other Member States, the laws of those countries apply. Only for certain digital providers, such as cloud, data centre and managed IT service providers, does it matter where the main establishment is.

This page gives general information based on the text of the law. It is not legal advice for your situation.