Skip to content

Knowledge base · Cbw/NIS2 for transport and logistics

Must you appoint a CISO or security officer under the Cyberbeveiligingswet?

A function with that name is not mandatory. You do, however, record the roles, responsibilities and powers for security, separate conflicting roles as far as possible, designate the people with security tasks and make sure they receive regular training. When you report, you name an officer who is responsible for the report. The management body remains ultimately responsible.

In force now (since 15 August 2026)Trusq editorial · checked against the official textLast verified:

Next step: Set up the Cbw duties in Trusq

What the decree asks

You establish the roles, responsibilities and powers for the security of your systems and separate conflicting roles as far as possible [1]. You designate the people who are given security tasks and evaluate that designation periodically [2]. Anyone who needs expertise for their role receives regular training [3]. For incident handling too, you record who detects, analyses, responds and reports [4].

Separate as far as possible

The words "as far as possible" were chosen deliberately: in the consultation it was pointed out that separating conflicting roles is not always possible for SMEs, and the provision was adjusted as a result [5]. A small company can therefore assign the tasks to an existing employee or a hired specialist, as long as it is recorded who does what and who stands in for them.

In the event of an incident

In the early warning about a significant incident you give the contact details of the officer who is responsible for the report [6]. So agree in advance who that is, outside office hours too.

The management body remains responsible

The measures need the approval of the management body [7], and every member of the management body must personally have the knowledge and skills to be able to assess risks [8]. A security officer does not take that over.

For cloud and IT service providers

These articles do not apply to the digital providers of Article 4 of the decree [9]. The European implementing regulation asks them to have at least one person who reports directly to the management body on security [10], with specific roles or tasks alongside existing roles, depending on size [11].

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Organisation: Maintain security and risk-management policies. NIS2 21(2)(a), Cbw 21(3)(a)
  • Organisation: Manage personnel security, access and assets. NIS2 21(2)(i), Cbw 21(3)(i)
  • Organisation: Maintain cyber hygiene and training. NIS2 21(2)(g), Cbw 21(3)(g)
  • Organisation: Organise incident handling. NIS2 21(2)(b), Cbw 21(3)(b)
  • Organisation: Submit an early warning of a significant incident. Cbw 26, Cbw 25, NIS2 23(4)(a), Cbb 24, Cbb 25
  • Organisation: Obtain board approval for cybersecurity risk-management measures. Cbw 24(1), NIS2 20(1)
  • Organisation: Ensure board members have the required knowledge and skills. Cbw 24(2), Cbw 24(3), NIS2 20(2)

Sources

  1. [1] Cbb Art. 6(2) (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). Roles, responsibilities and powers are established; conflicting roles are separated as far as possible. Original Dutch text:
    2. De essentiële entiteit of belangrijke entiteit stelt in het kader van de toepassing van het beleid, bedoeld in het eerste lid, de rollen, verantwoordelijkheden en bevoegdheden in relatie tot de beveiliging van haar netwerk- en informatiesystemen vast. De entiteit zorgt er zoveel mogelijk voor dat conflicterende rollen, verantwoordelijkheden en bevoegdheden gescheiden worden.
    Source, retrieved on 3 October 2026.
  2. [2] Cbb Art. 14(1)–(2) (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). Persons with security roles are designated; the designation is evaluated periodically. Original Dutch text:
    1. De essentiële entiteit of belangrijke entiteit wijst het personeel en andere binnen de entiteit werkzame personen aan die worden belast met rollen, verantwoordelijkheden en bevoegdheden met betrekking tot de beveiliging van haar netwerk- en informatiesystemen. 2. De essentiële entiteit of belangrijke entiteit evalueert periodiek de aanwijzing, bedoeld in het eerste lid, en werkt deze aanwijzing indien nodig bij.
    Source, retrieved on 3 October 2026.
  3. [3] Cbb Art. 12(2) (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). Anyone who needs expertise for security receives regular training. Original Dutch text:
    2. De essentiële entiteit of belangrijke entiteit wijst het personeel en andere binnen de entiteit werkzame personen aan waarvan de rollen, verantwoordelijkheden en bevoegdheden vaardigheden en deskundigheid vereisen op het gebied van de beveiliging van netwerk- en informatiesystemen en zorgt ervoor dat zij regelmatig opleiding krijgen over de beveiliging van netwerk- en informatiesystemen.
    Source, retrieved on 3 October 2026.
  4. [4] Cbb Art. 8(2) (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). Roles are established for incident handling, including for detecting and analysing. Original Dutch text:
    2. De essentiële entiteit of belangrijke entiteit stelt in het kader van de toepassing van het beleid, bedoeld in het eerste lid, de rollen, verantwoordelijkheden en bevoegdheden vast voor: a. het tijdig detecteren van incidenten; b. het analyseren en beoordelen van incidenten;
    Source, retrieved on 3 October 2026.
  5. [5] Explanatory note to the Cbb, section 4.6 (Duty of care) (Explanatory note to the Dutch Cyberbeveiligingsbesluit (Stb. 2026, 189); Dutch law, unofficial translation). After the consultation, Article 6, second paragraph, was adjusted because separation of roles is not always possible for SMEs. Original Dutch text:
    is aangegeven dat het scheiden van conflicterende rollen voor het mkb niet altijd mogelijk is en risicogebaseerd moet zijn. Naar aanleiding van dit commentaar is artikel 6, tweede lid, Cbb aangepast.
    Source, retrieved on 3 October 2026.
  6. [6] Cbw Art. 26(2) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). The early warning contains the contact details of the officer responsible for the report. Original Dutch text:
    2. Bij de vroegtijdige waarschuwing, bedoeld in het eerste lid: […] c. verstrekt de entiteit de contactgegevens van de functionaris die verantwoordelijk is voor de melding.
    Source, retrieved on 3 October 2026.
  7. [7] Cbw Art. 24(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). The measures require the approval of the management body. Original Dutch text:
    1. De maatregelen, bedoeld in artikel 21, behoeven de goedkeuring van het bestuur van de essentiële entiteit of belangrijke entiteit.
    Source, retrieved on 3 October 2026.
  8. [8] Cbw Art. 24(2) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Every member of the management body has the knowledge and skills to identify risks. Original Dutch text:
    2. Ieder lid van het bestuur van een essentiële entiteit of belangrijke entiteit beschikt over kennis en vaardigheden om: a. risico’s voor de beveiliging van netwerk- en informatiesystemen te kunnen identificeren;
    Source, retrieved on 3 October 2026.
  9. [9] Cbb Art. 4 (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). Articles 6 to 18 Cbb do not apply to the digital providers of Article 4 Cbb. Original Dutch text:
    Gelet op artikel 1 van de Uitvoeringsverordening (EU) 2024/2690 zijn de artikelen 6 tot en met 18 niet van toepassing op de volgende essentiële entiteiten en belangrijke entiteiten:
    Source, retrieved on 3 October 2026.
  10. [10] IR 2024/2690, Annex, point 1.2.3 (Implementing Regulation (EU) 2024/2690). At digital providers, at least one person reports directly to the management body on security.
    1.2.3. At least one person shall report directly to the management bodies on matters of network and information system security.
    Source, retrieved on 3 October 2026.
  11. [11] IR 2024/2690, Annex, point 1.2.4 (Implementing Regulation (EU) 2024/2690). Depending on size, security is covered by specific roles or tasks alongside existing roles.
    1.2.4. Depending on the size of the relevant entities, network and information system security shall be covered by dedicated roles or duties carried out in addition to existing roles.
    Source, retrieved on 3 October 2026.

Related questions

What must the management body do under the Cyberbeveiligingswet?What does the Cbw require on personnel, access management and an inventory of assets (NIS2 21(2)(i))?How do you set up incident handling under the Cbw (NIS2 21(2)(b))?Which documents and policies must you have under the Cyberbeveiligingswet?

Next step

Register your organisation and your Cbw sector. Trusq sets up the duty of care, the reporting duty, the tasks of the management body and the registration as actions, each with the evidence that is expected and the article it rests on.

Set up the Cbw duties in Trusq

Not sure whether the Cbw applies to your business? Take the Cbw check (in Dutch).

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.