Skip to content

Knowledge base · Cbw/NIS2 for transport and logistics

How do you set up incident handling under the Cbw (NIS2 21(2)(b))?

You draw up written policy for incident handling, assign roles for detecting, analysing, responding, documenting, reporting and learning, monitor relevant events and keep log files (Cbw 21(3)(b), Cbb 8).

In force now (since 15 August 2026)Trusq editorial · checked against the official textLast verified:

Next step: Set up the Cbw duties in Trusq

What the act requires

Incident handling is the second mandatory topic of the duty of care [1]. The NIS2 directive names the same topic [2].

How the Cyberbeveiligingsbesluit elaborates this

The Cbb requires policy, fixed roles and processes for the whole cycle: detecting in time, analysing and assessing, responding and recovering, documenting, reporting and learning. Relevant events are logged; you set the retention period yourself in advance [3].

What you record in practice

  • an established policy for incident handling
  • who does what in an incident, also outside office hours and in planning
  • which systems you log, how long you keep log files and how you protect them
  • how an incident flows into the 24-hour reporting duty

Does this also apply to cloud and IT service providers?

If your company falls under Cbb Article 4 (among others cloud, data centres and managed (security) services), Cbb Articles 6 to 18 do not apply [4] and Implementing Regulation (EU) 2024/2690 elaborates this measure. The obligation under Cbw Article 21 remains.

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Organisation: Organise incident handling. NIS2 21(2)(b), Cbw 21(3)(b)
  • Per ICT system: Log and monitor security-relevant events in this ICT system to detect incidents. Cbw 21(3)(b), NIS2 21(2)(b)

Sources

  1. [1] Cbw Art. 21(3)(b) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Cbw Article 21(3)(b). Original Dutch text:
    3. De maatregelen, bedoeld in het eerste lid, zijn gebaseerd op een benadering die alle gevaren omvat en tot doel heeft netwerk- en informatiesystemen en de fysieke omgeving van die systemen tegen incidenten te beschermen, en omvatten ten minste het volgende: […] b. incidentenbehandeling;
    Source, retrieved on 2 October 2026.
  2. [2] NIS2 Art. 21(2)(b) (Directive (EU) 2022/2555 (NIS2)). The NIS2 counterpart: Article 21(2)(b).
    2. The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following: […] (b) incident handling;
    Source, retrieved on 2 October 2026.
  3. [3] Cbb Art. 8 (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). Cbb Article 8: roles for the whole incident cycle and keeping and protecting log files. Original Dutch text:
    2. De essentiële entiteit of belangrijke entiteit stelt in het kader van de toepassing van het beleid, bedoeld in het eerste lid, de rollen, verantwoordelijkheden en bevoegdheden vast voor: a. het tijdig detecteren van incidenten; b. het analyseren en beoordelen van incidenten; c. het reageren op, beperken van de gevolgen van, wegnemen van de oorzaak van en herstellen van incidenten; d. het documenteren van incidenten; e. het rapporteren van incidenten; en f. het leren van incidenten. […] 6. De essentiële entiteit of belangrijke entiteit logt de voor de beveiliging van haar netwerk- en informatiesystemen relevante gebeurtenissen in haar netwerk- en informatiesystemen. De entiteit houdt gedurende een vooraf bepaalde periode deze logbestanden bij en beschermt deze tegen ongeautoriseerde wijzigingen.
    Source, retrieved on 2 October 2026.
  4. [4] Cbb Art. 4 (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). Cbb Article 4 excludes Articles 6 to 18 for, among others, cloud, data centre and managed service providers. Original Dutch text:
    Gelet op artikel 1 van de Uitvoeringsverordening (EU) 2024/2690 zijn de artikelen 6 tot en met 18 niet van toepassing op de volgende essentiële entiteiten en belangrijke entiteiten: a. DNS-dienstverleners; b. registers voor topleveldomeinnamen; c. aanbieders van cloudcomputingdiensten; d. aanbieders van datacentrumdiensten; e. aanbieders van netwerken voor de levering van inhoud; f. aanbieders van beheerde diensten; g. aanbieders van beheerde beveiligingsdiensten; h. aanbieders van onlinemarktplaatsen; i. aanbieders van onlinezoekmachines; j. aanbieders van platforms voor socialenetwerkdiensten; en k. verleners van vertrouwensdiensten.
    Source, retrieved on 2 October 2026.

Related questions

When and where do you report a significant incident under the Cbw?When is a cyber incident a significant incident?What does the duty of care of the Cyberbeveiligingswet involve?What does the Cbw require on business continuity, backups and crisis management (NIS2 21(2)(c))?How long must you keep log files under the Cyberbeveiligingswet?

Next step

Register your organisation and your Cbw sector. Trusq sets up the duty of care, the reporting duty, the tasks of the management body and the registration as actions, each with the evidence that is expected and the article it rests on.

Set up the Cbw duties in Trusq

Not sure whether the Cbw applies to your business? Take the Cbw check (in Dutch).

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.