Skip to content

Knowledge base · Cbw/NIS2 for transport and logistics

Do you comply with the Cyberbeveiligingswet if you hold an ISO 27001 certificate?

Not automatically. The Cbw does not prescribe ISO 27001 certification and, according to the act, a standard is not mandatory. You do take European and international standards into account, and the Cbb asks for a management system with which you demonstrably comply with the duty of care. The rules were drawn up with ISO 27001 as the starting point, so an existing management system is a good basis, but you check yourself that all Cbw requirements are in it.

In force now (since 15 August 2026)Trusq editorial · checked against the official textLast verified:

Next step: Set up the Cbw duties in Trusq

What the act says about standards

In your measures you take into account the state of the art, the cost of implementation and, where applicable, European and international standards [1]. The act describes a standard as a technical specification compliance with which is not mandatory [2].

A management system is mandatory

You use a management system so that you can demonstrably comply with the duty of care [3]. According to the explanatory memorandum, existing standards frameworks such as ISO 27001 were the starting point, and you keep the freedom to continue using your existing standards framework, provided the measures from the decree are secured [4].

What a certificate does not cover by itself

  • the reporting duty with an early warning within 24 hours for a significant incident [5]
  • registration in the national register [6]
  • a certificate of a training for every member of the management body [7]
  • the recorded assessment after a specific warning about a vulnerability or threat [8]

Also check the scope of your certificate: the duty of care applies to all systems you use for your work or services [9], not only to the department or location that is certified.

Does a certificate count in supervision?

In enforcement, the supervisory authority takes into account, among other things, compliance with approved codes of conduct or approved certification mechanisms [10]. The act does not say which certifications fall under that.

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Per ICT system: Include this ICT system in the cybersecurity risk analysis and treat its risks. Cbw 21(1), Cbw 21(2), Cbw 21(3)(a), NIS2 21(1), NIS2 21(2)(a)
  • Organisation: Maintain security and risk-management policies. NIS2 21(2)(a), Cbw 21(3)(a)
  • Organisation: Submit an early warning of a significant incident. Cbw 26, Cbw 25, NIS2 23(4)(a), Cbb 24, Cbb 25
  • Organisation: Provide the required national-register information. Cbw 44(1), Cbb 27, NIS2 3(4)
  • Organisation: Hold a training certificate covering the required subjects. Cbw 24(5), NIS2 20(2), Cbb 20, Cbb 21, Cbb 22

Sources

  1. [1] Cbw Art. 21(2) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). In taking measures, the entity takes into account the state of the art, the cost and, where applicable, European and international standards. Original Dutch text:
    Bij het nemen van de maatregelen houdt de entiteit in ieder geval rekening met de stand van de techniek, de uitvoeringskosten en, indien van toepassing, de desbetreffende Europese en internationale normen.
    Source, retrieved on 3 October 2026.
  2. [2] Cbw Art. 1 (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). A standard is a technical specification compliance with which is not mandatory. Original Dutch text:
    norm: een door een erkende normalisatie-instelling vastgestelde technische specificatie voor herhaalde of voortdurende toepassing, waarvan de naleving niet verplicht is
    Source, retrieved on 3 October 2026.
  3. [3] Cbb Art. 6(4) (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). The entity uses a management system to demonstrably comply with Article 21 Cbw. Original Dutch text:
    4. De essentiële entiteit of belangrijke entiteit hanteert een managementsystematiek voor de beveiliging van haar netwerk- en informatiesystemen om aantoonbaar te kunnen voldoen aan het bepaalde bij of krachtens artikel 21 van de wet.
    Source, retrieved on 3 October 2026.
  4. [4] Explanatory note to the Cbb, section 4.3 (ATR advice) (Explanatory note to the Dutch Cyberbeveiligingsbesluit (Stb. 2026, 189); Dutch law, unofficial translation). According to the explanatory memorandum, ISO 27001 and NEN 7510 were the starting point; entities may keep using their standards framework if the Cbb measures are secured. Original Dutch text:
    Zowel voor de Cbw als voor de uitwerking van de zorgplicht in het Cbb zijn bestaande normenkaders gehanteerd als uitgangspunt, zoals de ISO 27001 en NEN7510. Hierbij is gecontroleerd of de Cbw en het Cbb deze normenkaders niet doorkruist. […] Entiteiten houden met de Cbw en het Cbb de ruimte om hun bestaande normenkader te blijven hanteren, waarbij ze wel moeten zorgen dat de maatregelen uit het Cbb geborgd zijn.
    Source, retrieved on 3 October 2026.
  5. [5] Cbw Art. 26(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). The early warning follows without undue delay or, if that is not possible, within 24 hours. Original Dutch text:
    Dit doet zij onverwijld of, indien dat niet mogelijk is, binnen 24 uur nadat zij kennis heeft gekregen van het significante incident.
    Source, retrieved on 3 October 2026.
  6. [6] Cbw Art. 44(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Entities provide data for the national register. Original Dutch text:
    1. Een essentiële entiteit, belangrijke entiteit en een entiteit die domeinnaamregistratiediensten verleent verstrekt ten behoeve van de registratie in het nationale register, bedoeld in artikel 43, aan Onze Minister de volgende informatie middels het daarvoor opgezette mechanisme:
    Source, retrieved on 3 October 2026.
  7. [7] Cbw Art. 24(5) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Every member of the management body holds a certificate of a training on the topics of paragraph 2. Original Dutch text:
    5. Met het oog op het aantonen van de kennis en vaardigheden bezit ieder lid van het bestuur van een essentiële entiteit of belangrijke entiteit een certificaat, waaruit de deelname blijkt aan een training die de onderwerpen, bedoeld in het tweede lid, behandelt.
    Source, retrieved on 3 October 2026.
  8. [8] Cbb Art. 17(1) (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). After a specific warning, the entity records its assessment in writing. Original Dutch text:
    1. Indien de essentiële entiteit of belangrijke entiteit gericht wordt geattendeerd op voor de beveiliging van haar netwerk- en informatiesystemen relevante kwetsbaarheden of cyberdreigingen, beoordeelt zij of op basis daarvan aanpassingen of aanvullingen nodig zijn van de maatregelen ter uitvoering van artikel 21 van de wet. De entiteit legt de uitkomsten van die beoordeling schriftelijk vast.
    Source, retrieved on 3 October 2026.
  9. [9] Cbw Art. 21(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). The duty of care applies to the systems the entity uses for its activities or services. Original Dutch text:
    1. De essentiële entiteit of belangrijke entiteit neemt passende en evenredige technische, operationele en organisatorische maatregelen om de risico’s voor de beveiliging van de netwerk- en informatiesystemen, die zij voor haar werkzaamheden of voor het verlenen van haar diensten gebruikt, te beheersen.
    Source, retrieved on 3 October 2026.
  10. [10] Cbw Art. 69 (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). In enforcement, the competent authority takes into account, among other things, compliance with approved codes of conduct or certification mechanisms. Original Dutch text:
    Onverminderd artikel 3:4, tweede lid, van de Algemene wet bestuursrecht houdt de bevoegde autoriteit bij de toepassing van de artikelen 70, 72, eerste lid, onderdeel c, 73 tot en met 78, 80, 83, eerste lid, onderdeel c, 84 tot en met 87 en 89 tot en met 93 rekening met de omstandigheden van elk afzonderlijk geval, alsmede: […] g. de naleving van goedgekeurde gedragscodes of goedgekeurde certificeringsmechanismen;
    Source, retrieved on 3 October 2026.

Related questions

What does the duty of care of the Cyberbeveiligingswet involve?Which documents and policies must you have under the Cyberbeveiligingswet?Which measures does NIS2 Article 21 require and where are they in the Cbw?Who supervises the Cbw in transport and logistics, and how high are the fines?

Next step

Register your organisation and your Cbw sector. Trusq sets up the duty of care, the reporting duty, the tasks of the management body and the registration as actions, each with the evidence that is expected and the article it rests on.

Set up the Cbw duties in Trusq

Not sure whether the Cbw applies to your business? Take the Cbw check (in Dutch).

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.