Skip to content

Knowledge base · Cbw/NIS2 for transport and logistics

Are handheld scanners, control systems and warehouse automation covered by the Cbw duty of care?

Yes, if your company is covered by the Cbw and you use those systems for your work or your services. The act counts every device that automatically processes digital data on the basis of a program as part of the network and information systems, and the measures also protect the physical environment of those systems. So include handheld scanners, sorting and control systems, on-board computers and similar equipment in your inventory and risk analysis.

In force now (since 15 August 2026)Trusq editorial · checked against the official textLast verified:

Next step: Record your ICT systems in Trusq

What counts as a network and information system

The act names three kinds: an electronic communications network, any device or group of connected devices that automatically processes digital data on the basis of a program, and the data stored or transmitted with them [1]. A PLC that controls a sorting belt or a handheld scanner that books orders falls under it.

Which systems the duty of care touches

The duty of care concerns the systems you use for your activities or for providing your services [2]. The measures follow an all-hazards approach and also protect the physical environment of the systems [3], such as the room where control cabinets or servers stand.

What that asks in practice

  • a complete and up-to-date inventory of your assets, so also of equipment on the work floor [4]
  • an overview of the risks based on your risk analysis [5]
  • agreements with the suppliers of these systems, if their products or services can affect security [6]

For a transport company too

For transport companies, the regulation of the Minister of Infrastructure and Water Management also asks that you segment your network and information systems into networks or zones based on your risk analysis [7]. With linked control systems and office IT, that is an important measure.

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Per ICT system: Include this ICT system in the cybersecurity risk analysis and treat its risks. Cbw 21(1), Cbw 21(2), Cbw 21(3)(a), NIS2 21(1), NIS2 21(2)(a)
  • Organisation: Maintain security and risk-management policies. NIS2 21(2)(a), Cbw 21(3)(a)
  • Per ICT system: Record this ICT system in the asset inventory and classify it. Cbw 21(3)(i), NIS2 21(2)(i)
  • Organisation: Manage supply-chain security. NIS2 21(2)(d), Cbw 21(3)(d)

Sources

  1. [1] Cbw Art. 1 (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). A network and information system includes any device that automatically processes digital data on the basis of a program. Original Dutch text:
    netwerk- en informatiesysteem: a. een elektronisch communicatienetwerk; of b. elk apparaat of elke groep van onderling verbonden of verwante apparaten, waarvan er een of meer, op grond van een programma, een automatische verwerking van digitale gegevens uitvoeren; of c. digitale gegevens die worden opgeslagen, verwerkt, opgehaald of verzonden met behulp van de in punten a. en b. bedoelde elementen met het oog op de werking, het gebruik, de bescherming en het onderhoud ervan;
    Source, retrieved on 3 October 2026.
  2. [2] Cbw Art. 21(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). The duty of care applies to the systems the entity uses for its activities or services. Original Dutch text:
    1. De essentiële entiteit of belangrijke entiteit neemt passende en evenredige technische, operationele en organisatorische maatregelen om de risico’s voor de beveiliging van de netwerk- en informatiesystemen, die zij voor haar werkzaamheden of voor het verlenen van haar diensten gebruikt, te beheersen.
    Source, retrieved on 3 October 2026.
  3. [3] Cbw Art. 21(3) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). The measures follow an all-hazards approach and also protect the physical environment of the systems. Original Dutch text:
    3. De maatregelen, bedoeld in het eerste lid, zijn gebaseerd op een benadering die alle gevaren omvat en tot doel heeft netwerk- en informatiesystemen en de fysieke omgeving van die systemen tegen incidenten te beschermen,
    Source, retrieved on 3 October 2026.
  4. [4] Cbb Art. 16(4) (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). The entity has a complete and up-to-date inventory of its assets. Original Dutch text:
    4. De essentiële entiteit of belangrijke entiteit heeft een volledige en actuele inventaris van haar assets, en houdt deze bij.
    Source, retrieved on 3 October 2026.
  5. [5] Cbb Art. 7(4) (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). On the basis of the risk analysis, the entity prepares an overview of the risks. Original Dutch text:
    4. De essentiële entiteit of belangrijke entiteit maakt op basis van de uitgevoerde risicoanalyse een overzicht van de risico’s met betrekking tot de beveiliging van haar netwerk- en informatiesystemen.
    Source, retrieved on 3 October 2026.
  6. [6] Cbb Art. 10(1) (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). The supply chain policy governs dealing with dependencies on suppliers that can affect security. Original Dutch text:
    De entiteit bepaalt in dat beleid haar omgang met afhankelijkheden van de producten en diensten van haar leveranciers en dienstverleners die invloed kunnen hebben op de beveiliging van haar netwerk- en informatiesystemen.
    Source, retrieved on 3 October 2026.
  7. [7] Cyberbeveiligingsregeling IenW Art. 12(4) (Cyberbeveiligingsregeling IenW (Stcrt. 2026, 24093); Dutch law, unofficial translation). Transport companies segment their systems into networks or zones based on the risk analysis. Original Dutch text:
    4. Ter uitvoering van artikel 21, derde lid, onderdeel g, van de wet segmenteert de essentiële entiteit of belangrijke entiteit: a. haar netwerk- en informatiesystemen in netwerken of zones overeenkomstig de resultaten van de in artikel 7, vijfde lid, van het besluit bedoelde risicoanalyse; b. waar passend, haar netwerk- en informatiesystemen van de netwerk- en informatiesystemen van derden.
    Source, retrieved on 3 October 2026.

Related questions

Does the Cbw duty of care also apply to your TMS, WMS or telematics in the cloud?What does the Cbw require on personnel, access management and an inventory of assets (NIS2 21(2)(i))?What must be in your policy for risk analysis and information security (NIS2 21(2)(a))?What does the duty of care of the Cyberbeveiligingswet involve?

Next step

Register your organisation and systems such as your TMS, WMS or scanners. Trusq sets up the Cbw measures per system, each with the evidence that is expected and the article it rests on.

Record your ICT systems in Trusq

Not sure whether the Cbw applies to your business? Take the Cbw check (in Dutch).

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.