Skip to content

Knowledge base · Cbw/NIS2 for transport and logistics

What must the early warning within 24 hours contain?

In the early warning you state whether the incident is presumably malicious, whether it can have cross-border effects and who the contact person is, plus the presumed start time and, where possible, the nature, the expected recovery time and the measures (Cbw 26, Cbb 24).

In force now (since 15 August 2026)Trusq editorial · checked against the official textLast verified:

Next step: Set up the Cbw duties in Trusq

Mandatory content under the act

The Cbw names three items [1]:

  • whether the incident is presumably caused by an unlawful or malicious act
  • whether it can have cross-border effects
  • the contact details of the officer who is responsible for the report

In addition under the Cyberbeveiligingsbesluit

The Cbb adds [2]:

  • the presumed time at which the incident began
  • where possible, the nature and the effects noticeable at that moment
  • where possible, a forecast of the recovery time
  • where possible, the measures to limit the effects or prevent recurrence

In practice

Record in advance who the officer is, for nights and weekends too, and keep a template ready with these fields. Note the moment at which you became aware of the incident: that is where the deadline begins.

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Organisation: Submit an early warning of a significant incident. Cbw 26, Cbw 25, NIS2 23(4)(a), Cbb 24, Cbb 25

Sources

  1. [1] Cbw Art. 26(2) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). The early warning contains the three items of Cbw 26, paragraph 2. Original Dutch text:
    2. Bij de vroegtijdige waarschuwing, bedoeld in het eerste lid: a. geeft de entiteit aan of het significante incident vermoedelijk door een onrechtmatige of kwaadwillige handeling is veroorzaakt; b. geeft de entiteit aan of het significante incident grensoverschrijdende gevolgen kan hebben; en c. verstrekt de entiteit de contactgegevens van de functionaris die verantwoordelijk is voor de melding.
    Source, retrieved on 2 October 2026.
  2. [2] Cbb Art. 24 (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). Cbb Article 24 supplements the content. Original Dutch text:
    De vroegtijdige waarschuwing, bedoeld in artikel 26, eerste lid, van de wet, omvat naast de gegevens, genoemd in artikel 26, tweede lid, van de wet, tevens de volgende gegevens: a. het vermoedelijke tijdstip van de aanvang van het significante incident; b. zo mogelijk, een beschrijving van de aard en op dat moment merkbare gevolgen van het incident; c. zo mogelijk, een prognose van de hersteltijd; en d. zo mogelijk, de door de essentiële entiteit of belangrijke entiteit voorgenomen of genomen maatregelen om de gevolgen van het significante incident te beperken of herhaling hiervan te voorkomen.
    Source, retrieved on 2 October 2026.

Related questions

When and where do you report a significant incident under the Cbw?When is a cyber incident a significant incident?What must the final report on an incident contain, and when is it due?How do you set up incident handling under the Cbw (NIS2 21(2)(b))?

Next step

Register your organisation and your Cbw sector. Trusq sets up the duty of care, the reporting duty, the tasks of the management body and the registration as actions, each with the evidence that is expected and the article it rests on.

Set up the Cbw duties in Trusq

Not sure whether the Cbw applies to your business? Take the Cbw check (in Dutch).

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.