Skip to content

Knowledge base · Cbw/NIS2 for transport and logistics

Are port terminals, stevedores and other port companies covered by the Cyberbeveiligingswet?

Often yes, if they are medium-sized or larger and work in a seaport. Next to port managers and their port facilities, Annex 1 of the Cbw expressly names the entities that manage works and equipment in ports. A terminal or stevedore that itself operates cranes or other equipment in a seaport is as a rule covered; a terminal in an inland port that serves only inland shipping is as a rule not. For transport companies on the water, an outage of transshipment of twelve hours or longer is also a significant incident.

In force now (since 15 August 2026)Trusq editorial · checked against the official textLast verified:

Next step: Take the Cbw check (in Dutch)

What Annex 1 names

In the water subsector are managers of ports, including their port facilities, and entities that manage works and equipment in ports, and also operators of vessel traffic services [1]. For the concept of port, the annex refers to the European port security directive: an area with works and facilities for commercial transport by sea [6].

Size decides

A company from Annex 1 above the threshold for medium-sized enterprises is essential [2], a medium-sized company is important [3]. Smaller port companies are as a rule not covered. A port company that was designated as a provider of an essential service under the Wet beveiliging netwerk- en informatiesystemen (Wbni, the previous Dutch network and information systems security act) before 16 January 2023 can be designated by the Minister as an essential entity [7].

For size, it does not count that governments together control 25% or more of the capital or the voting rights. Under the SME definition such an undertaking is as a rule not an SME [10], but that rule does not apply to the Cbw [8] [9]. For a port or rail company in government hands too, the number of persons employed, the turnover and the balance sheet total therefore decide.

When an incident is significant

For transport by water, the regulation of the Minister of Infrastructure and Water Management names, among other things: transshipment in the port unavailable for twelve hours or longer, or access to the port and nautical services unavailable for twelve hours or longer [4]. Planned maintenance interruptions do not count [5].

What you do now

Find out which systems control your cranes, gate processes and terminal operating systems. They fall under the duty of care and belong in your inventory and risk analysis. See also the question about control systems and automation.

Sources

  1. [1] Cbw, Annex 1 (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Annex 1, water subsector: port managers with port facilities, entities that manage works and equipment in ports, and VTS operators. Original Dutch text:
    – Beheerders van havens als bedoeld in artikel 3, onderdeel 1, van Richtlijn 2005/65/EG, inclusief hun havenfaciliteiten als bedoeld in artikel 2, onderdeel 11, van Verordening (EG) nr. 725/2004; alsook entiteiten die werken en uitrusting in havens beheren – Exploitanten van verkeersbegeleidingssystemen (VBS)
    Source, retrieved on 3 October 2026.
  2. [2] Cbw Art. 8(1)(f) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Entities from Annex 1 above the medium-sized threshold are essential entities. Original Dutch text:
    1. De volgende entiteiten zijn essentiële entiteiten: […] f. andere entiteiten, genoemd in bijlage 1 van deze wet, die de in artikel 2, eerste lid, van de bijlage bij Aanbeveling 2003/361/EG bedoelde drempel voor middelgrote ondernemingen overschrijden;
    Source, retrieved on 3 October 2026.
  3. [3] Cbw Art. 12(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Medium-sized entities from Annex 1 are important entities. Original Dutch text:
    1. De volgende entiteiten zijn belangrijke entiteiten: a. entiteiten, genoemd in bijlage 1 van deze wet, niet zijnde een essentiële entiteit, die in aanmerking komen als middelgrote onderneming uit hoofde van artikel 2 van de bijlage bij de Aanbeveling 2003/361/EG;
    Source, retrieved on 3 October 2026.
  4. [4] Cyberbeveiligingsregeling IenW Art. 17 (Cyberbeveiligingsregeling IenW (Stcrt. 2026, 24093); Dutch law, unofficial translation). Criteria for significant incidents in the subsector transport by water. Original Dutch text:
    Een incident is voor essentiële entiteiten en belangrijke entiteiten in de sector vervoer, subsector vervoer over water, significant als: a. dienstverlening met betrekking tot toegang tot de haven en nautische dienstverlening voor een periode van twaalf uur of langer niet beschikbaar is; b. overslag in de haven voor een periode van twaalf uur of langer niet beschikbaar is; of c. dienstverlening met betrekking tot transport in het maritieme achterland over, op en langs het hoofdvaarwegennet voor een periode van vierentwintig uur of langer niet beschikbaar is.
    Source, retrieved on 3 October 2026.
  5. [5] Cyberbeveiligingsregeling IenW Art. 14 (Cyberbeveiligingsregeling IenW (Stcrt. 2026, 24093); Dutch law, unofficial translation). Planned service interruptions and maintenance do not count as a significant incident. Original Dutch text:
    Geplande dienstonderbrekingen en geplande gevolgen van geplande onderhoudswerkzaamheden die door of namens de belangrijke entiteit of essentiële entiteit worden uitgevoerd, worden niet als significante incidenten beschouwd.
    Source, retrieved on 3 October 2026.
  6. [6] Directive 2005/65/EC Art. 3(1) (Directive 2005/65/EC on enhancing port security). A port is an area with works and facilities for commercial transport by sea.
    ‘port’ means any specified area of land and water, with boundaries defined by the Member State in which the port is situated, containing works and equipment designed to facilitate commercial maritime transport operations;
    Source, retrieved on 3 October 2026.
  7. [7] Cbw Art. 10 (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). A provider that was designated as a provider of an essential service under the Wbni before 16 January 2023 can be designated as an essential entity. Original Dutch text:
    Bij regeling of besluit van Onze Minister die het aangaat, na overleg met Onze Minister, kan worden aangewezen als essentiële entiteit: een aanbieder die voor 16 januari 2023 op grond van de Wet beveiliging netwerk- en informatiesystemen is aangewezen als aanbieder van een essentiële dienst.
    Source, retrieved on 6 November 2026.
  8. [8] Cbw Art. 8(2) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). For essential entities by operation of law under d to f, Article 3, fourth paragraph, of the annex to Recommendation 2003/361/EC does not apply. Original Dutch text:
    2. Ten aanzien van het bepaalde in het eerste lid, onderdelen d tot en met f, is artikel 3, vierde lid, van de bijlage bij Aanbeveling 2003/361/EG niet van toepassing.
    Source, retrieved on 6 November 2026.
  9. [9] Cbw Art. 12(2) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). For important entities by operation of law, Article 3, fourth paragraph, of the annex to Recommendation 2003/361/EC does not apply. Original Dutch text:
    2. Ten aanzien van het bepaalde in het eerste lid is artikel 3, vierde lid, van de bijlage bij de Aanbeveling 2003/361/EG niet van toepassing.
    Source, retrieved on 6 November 2026.
  10. [10] Recommendation 2003/361/EC, Annex, Article 3(4) (Commission Recommendation 2003/361/EC (definition of SMEs)). An undertaking of which governments together control 25% or more of the capital or the voting rights is not an SME under the SME definition.
    4. Except in the cases set out in paragraph 2, second subparagraph, an enterprise cannot be considered an SME if 25 % or more of the capital or voting rights are directly or indirectly controlled, jointly or individually, by one or more public bodies.
    Source, retrieved on 6 November 2026.

Related questions

Which transport and logistics companies fall under the Cyberbeveiligingswet?Is my inland shipping or shipping line company covered by the Cyberbeveiligingswet?Are handheld scanners, control systems and warehouse automation covered by the Cbw duty of care?Is your company an essential or an important entity?

Next step

Six questions about the activities and size of your business. You see at once whether the Cbw probably applies to you, as an essential or important entity, through which sector and under which ministerial regulation. You do not have to enter any data. The check is in Dutch.

Take the Cbw check (in Dutch)

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.