Skip to content

Knowledge base · Cbw/NIS2 for transport and logistics

Which Cbw rules apply if you are a cloud or IT service provider for logistics?

If you are a provider of cloud, data centre or managed (security) services, Cbb Articles 6 to 18 do not apply. The duty of care of Cbw Article 21 remains, but Implementing Regulation (EU) 2024/2690 lays down the technical requirements and when an incident is significant.

In force now (since 15 August 2026)Trusq editorial · checked against the official textLast verified:

Next step: Take the Cbw check (in Dutch)

The exception

Cbb Article 4 excludes Articles 6 to 18 for eleven types of entities, including providers of cloud computing services, data centre services, managed services and managed security services [1].

What takes its place

Implementing Regulation (EU) 2024/2690 lays down for these entities the technical and methodological requirements of the measures in NIS2 Article 21(2) and specifies when an incident is significant [2]. The Regulation applies directly.

What stays the same

The training and certificate for directors (Cbb 20 to 22), the reporting duty and the registration also apply to these entities. If you supply software or management to transport companies, they also set requirements for you as a supplier.

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Organisation: Maintain security and risk-management policies. NIS2 21(2)(a), Cbw 21(3)(a)

Sources

  1. [1] Cbb Art. 4 (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). Cbb Article 4 excludes Articles 6 to 18 for eleven types of entities. Original Dutch text:
    Gelet op artikel 1 van de Uitvoeringsverordening (EU) 2024/2690 zijn de artikelen 6 tot en met 18 niet van toepassing op de volgende essentiële entiteiten en belangrijke entiteiten: a. DNS-dienstverleners; b. registers voor topleveldomeinnamen; c. aanbieders van cloudcomputingdiensten; d. aanbieders van datacentrumdiensten; e. aanbieders van netwerken voor de levering van inhoud; f. aanbieders van beheerde diensten; g. aanbieders van beheerde beveiligingsdiensten; h. aanbieders van onlinemarktplaatsen; i. aanbieders van onlinezoekmachines; j. aanbieders van platforms voor socialenetwerkdiensten; en k. verleners van vertrouwensdiensten.
    Source, retrieved on 2 October 2026.
  2. [2] IR 2024/2690 Art. 1 (Implementing Regulation (EU) 2024/2690). The implementing regulation sets out the requirements and the significance of incidents for these entities.
    This Regulation, with regard to DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online market places, of online search engines and of social networking services platforms, and trust service providers (the relevant entities) lays down the technical and the methodological requirements of the measures referred to in Article 21(2) of Directive (EU) 2022/2555 and further specifies the cases in which an incident shall be considered to be significant as referred to in Article 23(3) of Directive (EU) 2022/2555.
    Source, retrieved on 2 October 2026.

Related questions

Which measures does NIS2 Article 21 require and where are they in the Cbw?What must you arrange under the Cbw for your suppliers and IT service providers (NIS2 21(2)(d))?Which transport and logistics companies fall under the Cyberbeveiligingswet?When is a cyber incident a significant incident?

Next step

Six questions about the activities and size of your business. You see at once whether the Cbw probably applies to you, as an essential or important entity, through which sector and under which ministerial regulation. You do not have to enter any data. The check is in Dutch.

Take the Cbw check (in Dutch)

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.