Skip to content

Knowledge base · Cbw/NIS2 for transport and logistics

What is the difference between NIS2 and the Cyberbeveiligingswet?

NIS2 is a European directive, addressed to the Member States; they had to transpose it into national law. In the Netherlands that was done with the Cyberbeveiligingswet and the Cyberbeveiligingsbesluit, which have applied since 15 August 2026 and replace the old Wet beveiliging netwerk- en informatiesystemen. As a company you are therefore tested against the Cbw, the decree and the ministerial regulation for your sector; cloud and IT service providers in addition against a directly applicable European implementing regulation.

In force now (since 15 August 2026)Trusq editorial · checked against the official textLast verified:

Next step: Take the Cbw check (in Dutch)

A directive works through national law

NIS2 is addressed to the Member States [1]. They had to adopt and apply the provisions necessary to comply with the directive [2]. The Cbw refers to the directive as the NIS2 directive [3].

The Dutch rules

The Cbw contains the main rules, such as the duty of care, the reporting duty and registration. The Cyberbeveiligingsbesluit elaborates the duty of care in Articles 6 to 18 [4]. Act and decree entered into force on 15 August 2026 [5]. The Wet beveiliging netwerk- en informatiesystemen has been repealed [6]. For transport, the Minister of Infrastructure and Water Management sets further requirements in a regulation [7].

European rules that apply directly

For cloud, data centre, managed IT and other digital providers, Articles 6 to 18 of the decree do not apply [8]; for them Implementing Regulation (EU) 2024/2690 lays down the technical requirements [9]. The Dutch supervisory authority enforces such directly applicable implementing acts [10].

What that means in practice

Texts that mention "NIS2" are usually about the same subjects. For the precise duties, deadlines and fines in the Netherlands, the Cbw and the rules based on it apply.

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Organisation: Maintain security and risk-management policies. NIS2 21(2)(a), Cbw 21(3)(a)

Sources

  1. [1] NIS2 Art. 46 (Directive (EU) 2022/2555 (NIS2)). The NIS2 directive is addressed to the Member States.
    This Directive is addressed to the Member States.
    Source, retrieved on 3 October 2026.
  2. [2] NIS2 Art. 41(1) (Directive (EU) 2022/2555 (NIS2)). The Member States had to adopt and apply the necessary provisions.
    1. By 17 October 2024, Member States shall adopt and publish the measures necessary to comply with this Directive. They shall immediately inform the Commission thereof. They shall apply those measures from 18 October 2024.
    Source, retrieved on 3 October 2026.
  3. [3] Cbw Art. 1 (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). The Cbw defines the NIS2 directive. Original Dutch text:
    NIS2-richtlijn: Richtlijn (EU) 2022/2555 van het Europees Parlement en de Raad van 14 december 2022 betreffende maatregelen voor een hoog gezamenlijk niveau van cyberbeveiliging in de Unie
    Source, retrieved on 3 October 2026.
  4. [4] Cbb Art. 5 (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). The Cbb elaborates the duty of care in Articles 6 to 18. Original Dutch text:
    Ter uitvoering van artikel 21 van de wet neemt de essentiële entiteit of belangrijke entiteit ten minste de maatregelen, bedoeld in de artikelen 6 tot en met 18.
    Source, retrieved on 3 October 2026.
  5. [5] Cbb Art. 35 (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). The Cbw and the Cbb entered into force on 15 August 2026. Original Dutch text:
    De Cyberbeveiligingswet en dit besluit treden in werking met ingang van 15 augustus 2026.
    Source, retrieved on 3 October 2026.
  6. [6] Cbw Art. 106 (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). The Wet beveiliging netwerk- en informatiesystemen is repealed. Original Dutch text:
    De Wet beveiliging netwerk- en informatiesystemen wordt ingetrokken.
    Source, retrieved on 3 October 2026.
  7. [7] Cyberbeveiligingsregeling IenW Art. 2(1) (Cyberbeveiligingsregeling IenW (Stcrt. 2026, 24093); Dutch law, unofficial translation). The IenW regulation applies to essential and important entities in transport. Original Dutch text:
    1. Deze regeling is van toepassing op alle essentiële entiteiten en belangrijke entiteiten in de volgende sectoren dan wel subsectoren: Sector Subsector Vervoer Lucht Spoor Water Weg
    Source, retrieved on 3 October 2026.
  8. [8] Cbb Art. 4 (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). Articles 6 to 18 Cbb do not apply to the digital providers of Article 4 Cbb. Original Dutch text:
    Gelet op artikel 1 van de Uitvoeringsverordening (EU) 2024/2690 zijn de artikelen 6 tot en met 18 niet van toepassing op de volgende essentiële entiteiten en belangrijke entiteiten:
    Source, retrieved on 3 October 2026.
  9. [9] IR 2024/2690 Art. 1 (Implementing Regulation (EU) 2024/2690). Implementing Regulation 2024/2690 lays down technical and methodological requirements for digital providers.
    lays down the technical and the methodological requirements of the measures referred to in Article 21(2) of Directive (EU) 2022/2555
    Source, retrieved on 3 October 2026.
  10. [10] Cbw Art. 15(6) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). The competent authority enforces directly applicable implementing acts. Original Dutch text:
    b. het zorgen voor de bestuursrechtelijke handhaving van het bepaalde in de op grond van de artikelen 21, vijfde lid, en 23, elfde lid, van de NIS2-richtlijn vastgestelde uitvoeringshandelingen
    Source, retrieved on 3 October 2026.

Related questions

Since when does the Cyberbeveiligingswet apply, and is there a transitional period?Which measures does NIS2 Article 21 require and where are they in the Cbw?Which Cbw rules apply if you are a cloud or IT service provider for logistics?What does the duty of care of the Cyberbeveiligingswet involve?

Next step

Six questions about the activities and size of your business. You see at once whether the Cbw probably applies to you, as an essential or important entity, through which sector and under which ministerial regulation. You do not have to enter any data. The check is in Dutch.

Take the Cbw check (in Dutch)

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.