Skip to content

Knowledge base · Cbw/NIS2 for transport and logistics

What are the Cbw requirements for cyber hygiene and staff training (NIS2 21(2)(g))?

Your staff, as far as relevant for the function, are aware of the risks and apply cyber hygiene; employees with security tasks receive regular training (Cbw 21(3)(g), Cbb 12). This is an organisation-wide duty.

In force now (since 15 August 2026)Trusq editorial · checked against the official textLast verified:

Next step: Set up the Cbw duties in Trusq

What the act requires

Basic cyber hygiene practices and training are a mandatory part of the duty of care [1]. The NIS2 directive names the same topic [2].

How the Cyberbeveiligingsbesluit elaborates this

The Cbb distinguishes two groups: everyone who works within the entity, as far as relevant for the function (awareness and cyber hygiene), and the people with security roles, who receive regular training. This covers staff and other persons working within the entity, such as hired workers who work within your organisation [3].

What you record in practice

  • which functions receive which instruction, for example planning, drivers and warehouse
  • who has security roles and which training they follow regularly
  • proof of participation

Does this also apply to cloud and IT service providers?

If your company falls under Cbb Article 4 (among others cloud, data centres and managed (security) services), Cbb Articles 6 to 18 do not apply [4] and Implementing Regulation (EU) 2024/2690 elaborates this measure. The obligation under Cbw Article 21 remains.

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Organisation: Maintain cyber hygiene and training. NIS2 21(2)(g), Cbw 21(3)(g)

Sources

  1. [1] Cbw Art. 21(3)(g) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Cbw Article 21(3)(g). Original Dutch text:
    3. De maatregelen, bedoeld in het eerste lid, zijn gebaseerd op een benadering die alle gevaren omvat en tot doel heeft netwerk- en informatiesystemen en de fysieke omgeving van die systemen tegen incidenten te beschermen, en omvatten ten minste het volgende: […] g. basispraktijken op het gebied van cyberhygiëne en opleiding op het gebied van cyberbeveiliging;
    Source, retrieved on 2 October 2026.
  2. [2] NIS2 Art. 21(2)(g) (Directive (EU) 2022/2555 (NIS2)). The NIS2 counterpart: Article 21(2)(g).
    2. The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following: […] (g) basic cyber hygiene practices and cybersecurity training;
    Source, retrieved on 2 October 2026.
  3. [3] Cbb Art. 12 (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). Cbb Article 12: awareness and cyber hygiene for staff and regular training for security functions. Original Dutch text:
    1. De essentiële entiteit of belangrijke entiteit zorgt ervoor dat haar personeel en andere binnen de entiteit werkzame personen, voor zover relevant voor hun functie: a. bewust zijn van de risico’s met betrekking tot de netwerk- en informatiesystemen van de entiteit; en b. praktijken op het gebied van cyberhygiëne toepassen. […] 2. De essentiële entiteit of belangrijke entiteit wijst het personeel en andere binnen de entiteit werkzame personen aan waarvan de rollen, verantwoordelijkheden en bevoegdheden vaardigheden en deskundigheid vereisen op het gebied van de beveiliging van netwerk- en informatiesystemen en zorgt ervoor dat zij regelmatig opleiding krijgen over de beveiliging van netwerk- en informatiesystemen.
    Source, retrieved on 2 October 2026.
  4. [4] Cbb Art. 4 (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). Cbb Article 4 excludes Articles 6 to 18 for, among others, cloud, data centre and managed service providers. Original Dutch text:
    Gelet op artikel 1 van de Uitvoeringsverordening (EU) 2024/2690 zijn de artikelen 6 tot en met 18 niet van toepassing op de volgende essentiële entiteiten en belangrijke entiteiten: a. DNS-dienstverleners; b. registers voor topleveldomeinnamen; c. aanbieders van cloudcomputingdiensten; d. aanbieders van datacentrumdiensten; e. aanbieders van netwerken voor de levering van inhoud; f. aanbieders van beheerde diensten; g. aanbieders van beheerde beveiligingsdiensten; h. aanbieders van onlinemarktplaatsen; i. aanbieders van onlinezoekmachines; j. aanbieders van platforms voor socialenetwerkdiensten; en k. verleners van vertrouwensdiensten.
    Source, retrieved on 2 October 2026.

Related questions

When must a director have completed the Cbw training and what is on the certificate?What does the Cbw require on personnel, access management and an inventory of assets (NIS2 21(2)(i))?What does the duty of care of the Cyberbeveiligingswet involve?Is multi-factor authentication mandatory under the Cbw (NIS2 21(2)(j))?

Next step

Register your organisation and your Cbw sector. Trusq sets up the duty of care, the reporting duty, the tasks of the management body and the registration as actions, each with the evidence that is expected and the article it rests on.

Set up the Cbw duties in Trusq

Not sure whether the Cbw applies to your business? Take the Cbw check (in Dutch).

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.