Skip to content

Knowledge base · Cbw/NIS2 for transport and logistics

What does the Cbw require on personnel, access management and an inventory of assets (NIS2 21(2)(i))?

You assign security roles and set reliability requirements, have policy for logical and physical access with periodic checking of authorisations, and keep a complete and up-to-date inventory of your assets (Cbw 21(3)(i), Cbb 14 to 16).

In force now (since 15 August 2026)Trusq editorial · checked against the official textLast verified:

Next step: Set up the Cbw duties in Trusq

What the act requires

Security aspects of personnel, access policy and asset management are point i [1]. The NIS2 directive names the same topic [2].

How the Cyberbeveiligingsbesluit elaborates this

The Cbb elaborates point i in three articles: personnel (assigning roles and reliability requirements), access policy (issuing, changing and withdrawing identities and authorisations, with periodic checking) and assets (classification, rules for use and a complete inventory) [3] [4] [5].

Privileged accounts

The ministerial regulation for your sector requires your access policy to also cover privileged accounts and system administrator accounts, with strong identification, authentication and authorisation procedures [9]. For transport and chemicals that is in the Cyberbeveiligingsregeling IenW [7]; for, among others, postal and courier services and food, equivalent regulations apply [8].

What you record in practice

  • who has which security role and which reliability requirements apply
  • how accounts are created and withdrawn, also on departure or after a period of hire
  • periodic checking of rights, including administrator accounts
  • an inventory of systems, devices and software, with owner and classification

Does this also apply to cloud and IT service providers?

If your company falls under Cbb Article 4 (among others cloud, data centres and managed (security) services), Cbb Articles 6 to 18 do not apply [6] and Implementing Regulation (EU) 2024/2690 elaborates this measure. The obligation under Cbw Article 21 remains.

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Organisation: Manage personnel security, access and assets. NIS2 21(2)(i), Cbw 21(3)(i)
  • Per ICT system: Record this ICT system in the asset inventory and classify it. Cbw 21(3)(i), NIS2 21(2)(i)

Sources

  1. [1] Cbw Art. 21(3)(i) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Cbw Article 21(3)(i). Original Dutch text:
    3. De maatregelen, bedoeld in het eerste lid, zijn gebaseerd op een benadering die alle gevaren omvat en tot doel heeft netwerk- en informatiesystemen en de fysieke omgeving van die systemen tegen incidenten te beschermen, en omvatten ten minste het volgende: […] i. beveiligingsaspecten ten aanzien van personeel, toegangsbeleid en beheer van assets;
    Source, retrieved on 2 October 2026.
  2. [2] NIS2 Art. 21(2)(i) (Directive (EU) 2022/2555 (NIS2)). The NIS2 counterpart: Article 21(2)(i).
    2. The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following: […] (i) human resources security, access control policies and asset management;
    Source, retrieved on 2 October 2026.
  3. [3] Cbb Art. 14 (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). Cbb Article 14: reliability requirements for personnel with security tasks. Original Dutch text:
    3. De essentiële entiteit of belangrijke entiteit stelt betrouwbaarheidseisen op waaraan haar personeel en andere binnen de entiteit werkzame personen moeten voldoen, voor zover deze passend en noodzakelijk zijn voor hun taakuitoefening met betrekking tot de beveiliging van de netwerk- en informatiesystemen van de entiteit.
    Source, retrieved on 2 October 2026.
  4. [4] Cbb Art. 15 (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). Cbb Article 15: periodic checking of identities, authentication means and authorisations. Original Dutch text:
    3. De essentiële entiteit of belangrijke entiteit controleert identiteiten, authenticatiemiddelen en autorisaties periodiek op de noodzakelijkheid, juistheid en actualiteit en voert indien nodig wijzigingen door in de identiteiten, authenticatiemiddelen en autorisaties.
    Source, retrieved on 2 October 2026.
  5. [5] Cbb Art. 16 (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). Cbb Article 16: a complete and up-to-date inventory of assets. Original Dutch text:
    4. De essentiële entiteit of belangrijke entiteit heeft een volledige en actuele inventaris van haar assets, en houdt deze bij.
    Source, retrieved on 2 October 2026.
  6. [6] Cbb Art. 4 (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). Cbb Article 4 excludes Articles 6 to 18 for, among others, cloud, data centre and managed service providers. Original Dutch text:
    Gelet op artikel 1 van de Uitvoeringsverordening (EU) 2024/2690 zijn de artikelen 6 tot en met 18 niet van toepassing op de volgende essentiële entiteiten en belangrijke entiteiten: a. DNS-dienstverleners; b. registers voor topleveldomeinnamen; c. aanbieders van cloudcomputingdiensten; d. aanbieders van datacentrumdiensten; e. aanbieders van netwerken voor de levering van inhoud; f. aanbieders van beheerde diensten; g. aanbieders van beheerde beveiligingsdiensten; h. aanbieders van onlinemarktplaatsen; i. aanbieders van onlinezoekmachines; j. aanbieders van platforms voor socialenetwerkdiensten; en k. verleners van vertrouwensdiensten.
    Source, retrieved on 2 October 2026.
  7. [7] Cyberbeveiligingsregeling IenW Art. 2(1) (Cyberbeveiligingsregeling IenW (Stcrt. 2026, 24093); Dutch law, unofficial translation). The Cyberbeveiligingsregeling IenW applies to essential and important entities in, among others, transport (air, rail, water, road) and the chemical sector. Original Dutch text:
    1. Deze regeling is van toepassing op alle essentiële entiteiten en belangrijke entiteiten in de volgende sectoren dan wel subsectoren: Sector Subsector Vervoer Lucht Spoor Water Weg Drinkwater Afvalwater Afvalstoffenbeheer Vervaardiging, productie en distributie van chemische stoffen
    Source, retrieved on 3 October 2026.
  8. [8] Cyberbeveiligingsregeling IenW, explanatory note, section 4.3 (Cyberbeveiligingsregeling IenW (Stcrt. 2026, 24093); Dutch law, unofficial translation). According to the explanatory memorandum, the elaboration of the duty of care is identical for the sectors of EZ, KGG, LVVN and IenW. Original Dutch text:
    De uitwerking van de zorgplicht is gelijkluidend voor entiteiten in de sectoren waarvoor de Minister van Economische Zaken (EZ), Klimaat en Groene Groei (KGG), Landbouw, Visserij, Voedselzekerheid en Natuur (LVVN) en Infrastructuur en Waterstaat (IenW) de bevoegde autoriteit zijn.
    Source, retrieved on 3 October 2026.
  9. [9] Cyberbeveiligingsregeling IenW Art. 13 (Cyberbeveiligingsregeling IenW (Stcrt. 2026, 24093); Dutch law, unofficial translation). The access policy covers privileged accounts and system administrator accounts, with strong identification, authentication and authorisation. Original Dutch text:
    1. Het beleid, bedoeld in artikel 15, eerste lid, van het besluit, omvat het beleid over bevoorrechte accounts en systeembeheeraccounts. 2. Het beleid, bedoeld in artikel 15, eerste lid, van het besluit, zorgt ervoor dat: a. sterke identificatie-, authenticatie-, en autorisatieprocedures voor bevoorrechte accounts en systeembeheeraccounts worden toegepast;
    Source, retrieved on 3 October 2026.

Related questions

Is multi-factor authentication mandatory under the Cbw (NIS2 21(2)(j))?What are the Cbw requirements for cyber hygiene and staff training (NIS2 21(2)(g))?What does the duty of care of the Cyberbeveiligingswet involve?Does the Cbw duty of care also apply to your TMS, WMS or telematics in the cloud?

Next step

Register your organisation and your Cbw sector. Trusq sets up the duty of care, the reporting duty, the tasks of the management body and the registration as actions, each with the evidence that is expected and the article it rests on.

Set up the Cbw duties in Trusq

Not sure whether the Cbw applies to your business? Take the Cbw check (in Dutch).

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.