Skip to content

Knowledge base · Cbw/NIS2 for transport and logistics

Is my inland shipping or shipping line company covered by the Cyberbeveiligingswet?

If you are medium-sized or larger, yes. Annex 1 of the Cbw names companies for transport by water, inland shipping, coastal and sea transport, of passengers and freight. It concerns the company that operates the vessels; the individual vessels are excluded. A small or micro company, like many single-ship businesses, is as a rule not covered.

In force now (since 15 August 2026)Trusq editorial · checked against the official textLast verified:

Next step: Take the Cbw check (in Dutch)

What Annex 1 names

In the transport sector, water subsector, are companies for transport by water (inland shipping, coastal and sea transport) of passengers and freight, with the exception of the individual vessels they operate [1].

Size decides

A company from Annex 1 that exceeds the threshold for medium-sized enterprises is an essential entity [2]; a medium-sized company is an important entity [3]. Below that you are as a rule not covered. If linked undertakings count, a small company in a group can also be medium-sized; see the question about essential and important entities.

What applies for water

For transport, the regulation of the Minister of Infrastructure and Water Management applies alongside the act and the decree [4]. The act allows criteria for significant incidents to be laid down [5]. For transport by water, the regulation names, among other things: access to the port and nautical services or transshipment in the port unavailable for twelve hours or longer, or transport over the main waterway network unavailable for twenty-four hours or longer [6].

Even if you are not covered

Shippers, terminals and port companies that are covered must secure their chain and can therefore make demands of you. See the question about customers who demand NIS2.

Sources

  1. [1] Cbw, Annex 1 (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Annex 1, water subsector: companies for transport by water, with the exception of individual vessels. Original Dutch text:
    Water – Bedrijven voor vervoer over water (binnenvaart, kust- en zeevervoer) van passagiers en vracht zoals voor maritiem transport gedefinieerd in bijlage I bij Verordening (EG) nr. 725/2004, met uitzondering van de door deze bedrijven geëxploiteerde individuele vaartuigen
    Source, retrieved on 3 October 2026.
  2. [2] Cbw Art. 8(1)(f) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Entities from Annex 1 above the medium-sized threshold are essential entities. Original Dutch text:
    1. De volgende entiteiten zijn essentiële entiteiten: […] f. andere entiteiten, genoemd in bijlage 1 van deze wet, die de in artikel 2, eerste lid, van de bijlage bij Aanbeveling 2003/361/EG bedoelde drempel voor middelgrote ondernemingen overschrijden;
    Source, retrieved on 3 October 2026.
  3. [3] Cbw Art. 12(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Medium-sized entities from Annex 1 are important entities. Original Dutch text:
    1. De volgende entiteiten zijn belangrijke entiteiten: a. entiteiten, genoemd in bijlage 1 van deze wet, niet zijnde een essentiële entiteit, die in aanmerking komen als middelgrote onderneming uit hoofde van artikel 2 van de bijlage bij de Aanbeveling 2003/361/EG;
    Source, retrieved on 3 October 2026.
  4. [4] Cyberbeveiligingsregeling IenW Art. 2(1) (Cyberbeveiligingsregeling IenW (Stcrt. 2026, 24093); Dutch law, unofficial translation). The IenW regulation applies to essential and important entities in transport, water included. Original Dutch text:
    1. Deze regeling is van toepassing op alle essentiële entiteiten en belangrijke entiteiten in de volgende sectoren dan wel subsectoren: Sector Subsector Vervoer Lucht Spoor Water Weg
    Source, retrieved on 3 October 2026.
  5. [5] Cbw Art. 25(3) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Criteria for significant incidents can be laid down by or pursuant to an order in council. Original Dutch text:
    3. Bij of krachtens algemene maatregel van bestuur kunnen de criteria worden vastgesteld op basis waarvan wordt bepaald of sprake is van een significant incident als bedoeld in het tweede lid,
    Source, retrieved on 3 October 2026.
  6. [6] Cyberbeveiligingsregeling IenW Art. 17 (Cyberbeveiligingsregeling IenW (Stcrt. 2026, 24093); Dutch law, unofficial translation). Criteria for significant incidents in the subsector transport by water. Original Dutch text:
    Een incident is voor essentiële entiteiten en belangrijke entiteiten in de sector vervoer, subsector vervoer over water, significant als: a. dienstverlening met betrekking tot toegang tot de haven en nautische dienstverlening voor een periode van twaalf uur of langer niet beschikbaar is; b. overslag in de haven voor een periode van twaalf uur of langer niet beschikbaar is; of c. dienstverlening met betrekking tot transport in het maritieme achterland over, op en langs het hoofdvaarwegennet voor een periode van vierentwintig uur of langer niet beschikbaar is.
    Source, retrieved on 3 October 2026.

Related questions

Which transport and logistics companies fall under the Cyberbeveiligingswet?Is your company an essential or an important entity?Are port terminals, stevedores and other port companies covered by the Cyberbeveiligingswet?A customer demands that we comply with NIS2, but we are not covered by it. What now?

Next step

Six questions about the activities and size of your business. You see at once whether the Cbw probably applies to you, as an essential or important entity, through which sector and under which ministerial regulation. You do not have to enter any data. The check is in Dutch.

Take the Cbw check (in Dutch)

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.