Skip to content

Knowledge base · Cbw/NIS2 for transport and logistics

Does the Cbw duty of care also apply to your TMS, WMS or telematics in the cloud?

Yes. The duty of care covers all network and information systems you use for your work or services, even if a supplier delivers them as SaaS or a cloud service. You remain responsible; the supplier falls under your supply chain security (Cbw 21).

In force now (since 15 August 2026)Trusq editorial · checked against the official textLast verified:

Next step: Record your ICT systems in Trusq

Use counts, not ownership

Article 21 speaks of the systems the entity uses for its activities or for its services [1]. A transport management system, warehouse system or telematics platform that you purchase therefore falls under it, even if it runs at the supplier.

What you do per system

Include the system in your inventory and risk analysis [2], and arrange access, backups, logging and the agreements with the supplier. The ministerial regulation for your sector also asks you to segment your systems into networks or zones on the basis of your risk analysis and, where appropriate, relative to systems of third parties [5], and to take measures against malicious software [6]. For transport and chemicals that is the Cyberbeveiligingsregeling IenW [3]; for postal and courier services and food, among others, regulations with the same wording apply [4].

What stays organisation-wide

Cyber hygiene and training, secure communication, management body approval, the reporting duty and registration are duties of the organisation as a whole, not per system.

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Per ICT system: Include this ICT system in the cybersecurity risk analysis and treat its risks. Cbw 21(1), Cbw 21(2), Cbw 21(3)(a), NIS2 21(1), NIS2 21(2)(a)
  • Per ICT system: Identify the direct suppliers and service providers of this ICT system and check them against your security requirements. Cbw 21(3)(d), Cbw 21(4), NIS2 21(2)(d), NIS2 21(3)
  • Per ICT system: Record this ICT system in the asset inventory and classify it. Cbw 21(3)(i), NIS2 21(2)(i)

Sources

  1. [1] Cbw Art. 21(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). The duty of care covers the systems the entity uses. Original Dutch text:
    1. De essentiële entiteit of belangrijke entiteit neemt passende en evenredige technische, operationele en organisatorische maatregelen om de risico’s voor de beveiliging van de netwerk- en informatiesystemen, die zij voor haar werkzaamheden of voor het verlenen van haar diensten gebruikt, te beheersen.
    Source, retrieved on 2 October 2026.
  2. [2] Cbw Art. 21(3)(a) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Every system belongs in the risk analysis and the inventory. Original Dutch text:
    3. De maatregelen, bedoeld in het eerste lid, zijn gebaseerd op een benadering die alle gevaren omvat en tot doel heeft netwerk- en informatiesystemen en de fysieke omgeving van die systemen tegen incidenten te beschermen, en omvatten ten minste het volgende: […] a. beleid inzake risicoanalyse en beveiliging van informatiesystemen;
    Source, retrieved on 2 October 2026.
  3. [3] Cyberbeveiligingsregeling IenW Art. 2(1) (Cyberbeveiligingsregeling IenW (Stcrt. 2026, 24093); Dutch law, unofficial translation). The Cyberbeveiligingsregeling IenW applies to essential and important entities in, among others, transport (air, rail, water, road) and the chemical sector. Original Dutch text:
    1. Deze regeling is van toepassing op alle essentiële entiteiten en belangrijke entiteiten in de volgende sectoren dan wel subsectoren: Sector Subsector Vervoer Lucht Spoor Water Weg Drinkwater Afvalwater Afvalstoffenbeheer Vervaardiging, productie en distributie van chemische stoffen
    Source, retrieved on 3 October 2026.
  4. [4] Cyberbeveiligingsregeling IenW, explanatory note, section 4.3 (Cyberbeveiligingsregeling IenW (Stcrt. 2026, 24093); Dutch law, unofficial translation). According to the explanatory memorandum, the elaboration of the duty of care is worded the same for the sectors of EZ, KGG, LVVN and IenW. Original Dutch text:
    De uitwerking van de zorgplicht is gelijkluidend voor entiteiten in de sectoren waarvoor de Minister van Economische Zaken (EZ), Klimaat en Groene Groei (KGG), Landbouw, Visserij, Voedselzekerheid en Natuur (LVVN) en Infrastructuur en Waterstaat (IenW) de bevoegde autoriteit zijn.
    Source, retrieved on 3 October 2026.
  5. [5] Cyberbeveiligingsregeling IenW Art. 12(4) (Cyberbeveiligingsregeling IenW (Stcrt. 2026, 24093); Dutch law, unofficial translation). Network segmentation on the basis of the risk analysis and, where appropriate, relative to systems of third parties. Original Dutch text:
    4. Ter uitvoering van artikel 21, derde lid, onderdeel g, van de wet segmenteert de essentiële entiteit of belangrijke entiteit: a. haar netwerk- en informatiesystemen in netwerken of zones overeenkomstig de resultaten van de in artikel 7, vijfde lid, van het besluit bedoelde risicoanalyse; b. waar passend, haar netwerk- en informatiesystemen van de netwerk- en informatiesystemen van derden.
    Source, retrieved on 3 October 2026.
  6. [6] Cyberbeveiligingsregeling IenW Art. 12(3) (Cyberbeveiligingsregeling IenW (Stcrt. 2026, 24093); Dutch law, unofficial translation). Measures against malicious software, periodic vulnerability scans where appropriate, and remedying high-risk vulnerabilities without delay or a reasoned postponement. Original Dutch text:
    3. Ter uitvoering van artikel 21, derde lid, onderdeel e, van de wet: a. implementeert de essentiële entiteit of belangrijke entiteit maatregelen om het gebruik van kwaadaardige en ongeoorloofde software in haar netwerk- en informatiesystemen te detecteren en te voorkomen; b. voert de essentiële entiteit of belangrijke entiteit, waar passend, periodiek kwetsbaarheidsscans uit en legt zij de resultaten van deze scans vast; […] d. verhelpt de essentiële entiteit of belangrijke entiteit onverwijld kwetsbaarheden die een risico vormen voor de beveiliging van haar netwerk- en informatiesystemen, of motiveert waarom de kwetsbaarheid niet of op een later moment verholpen wordt en documenteert dit.
    Source, retrieved on 3 October 2026.

Related questions

What must you arrange under the Cbw for your suppliers and IT service providers (NIS2 21(2)(d))?What does the duty of care of the Cyberbeveiligingswet involve?What does the Cbw require on personnel, access management and an inventory of assets (NIS2 21(2)(i))?What does the Cbw require on business continuity, backups and crisis management (NIS2 21(2)(c))?Are handheld scanners, control systems and warehouse automation covered by the Cbw duty of care?Must you report an incident that takes place at your IT supplier or cloud provider?

Next step

Register your organisation and systems such as your TMS, WMS or scanners. Trusq sets up the Cbw measures per system, each with the evidence that is expected and the article it rests on.

Record your ICT systems in Trusq

Not sure whether the Cbw applies to your business? Take the Cbw check (in Dutch).

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.