Skip to content

Knowledge base · Cbw/NIS2 for transport and logistics

Do you have to report a near miss or a cyber threat under the Cbw?

No, the reporting duty applies only to significant incidents. You may report an incident, near miss or cyber threat voluntarily to your CSIRT. You must, however, tell customers who may be affected by a significant cyber threat, without delay, which measures they can take.

In force now (since 15 August 2026)Trusq editorial · checked against the official textLast verified:

Next step: Set up the Cbw duties in Trusq

What is mandatory

You report every significant incident [1]. An incident is significant if it causes or can cause severe operational disruption of your services or financial loss for you, or can cause considerable damage to others [2]. For transport companies, the Cyberbeveiligingsregeling IenW sets thresholds per subsector [9]; see the question on what a significant incident is.

What you can report voluntarily

A near miss is an event that could have compromised the availability, authenticity, integrity or confidentiality of data or of services offered via network and information systems, but that was successfully prevented or did not materialise [3]. You may report such an event, an incident that is not significant and a cyber threat voluntarily to your CSIRT [4]. The CSIRT may give mandatory reports priority [5].

A duty for significant cyber threats

If recipients of your services may be affected by a significant cyber threat, you tell them without delay which measures they can take, and where necessary also what the threat is [6]. A threat is significant if, on the basis of its technical characteristics, it can have severe consequences by causing considerable damage [7].

Record it internally

Even if you do not report, recording helps. Your incident-handling procedures include, among other things, documenting incidents and learning from them [8].

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Organisation: Submit the incident notification and available initial assessment. Cbw 27(1)–(2), Cbw 25, NIS2 23(4)(b), Cbb 25
  • Organisation: Inform service recipients about relevant incidents and cyber threats. Cbw 30(1)–(2), NIS2 23(1), NIS2 23(2)
  • Organisation: Organise incident handling. NIS2 21(2)(b), Cbw 21(3)(b)

Sources

  1. [1] Cbw Art. 25(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). The reporting duty applies to every significant incident. Original Dutch text:
    1. De essentiële entiteit of belangrijke entiteit meldt overeenkomstig de artikelen 26 tot en met 29 ieder significant incident.
    Source, retrieved on 3 October 2026.
  2. [2] Cbw Art. 25(2) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). When an incident is significant. Original Dutch text:
    2. Een incident is een significant incident als het: a. een ernstige operationele verstoring van de diensten of financiële verliezen voor de betrokken entiteit veroorzaakt of kan veroorzaken; of b. andere entiteiten heeft getroffen of kan treffen door aanzienlijke materiële of immateriële schade te veroorzaken.
    Source, retrieved on 3 October 2026.
  3. [3] Cbw Art. 1 (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Definition of near miss. Original Dutch text:
    bijna-incident: een gebeurtenis die de beschikbaarheid, authenticiteit, integriteit of vertrouwelijkheid van opgeslagen, verzonden of verwerkte gegevens of van de diensten die worden aangeboden door of toegankelijk zijn via netwerk- en informatiesystemen, in gevaar had kunnen brengen, maar die met succes is voorkomen of zich niet heeft voorgedaan;
    Source, retrieved on 3 October 2026.
  4. [4] Cbw Art. 33(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). An entity may report incidents, near misses and cyber threats voluntarily to its CSIRT. Original Dutch text:
    1. Onverminderd artikel 25 kan op vrijwillige basis een melding worden ingediend door: a. een essentiële entiteit of belangrijke entiteit bij haar CSIRT, over incidenten, bijna-incidenten en cyberdreigingen;
    Source, retrieved on 3 October 2026.
  5. [5] Cbw Art. 33(2) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). The CSIRT may give mandatory reports priority over voluntary ones. Original Dutch text:
    Het CSIRT kan daarbij voorrang geven aan de verwerking van verplichte meldingen als bedoeld in artikel 25 boven vrijwillige meldingen als bedoeld in het eerste lid.
    Source, retrieved on 3 October 2026.
  6. [6] Cbw Art. 30(2) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). In the case of a significant cyber threat, the entity tells recipients of its services without delay which measures they can take. Original Dutch text:
    2. De essentiële entiteit of belangrijke entiteit deelt de ontvangers van haar diensten, die mogelijkerwijs door een significante cyberdreiging in relatie tot het ontvangen van die diensten worden getroffen, onverwijld mee welke maatregelen die ontvangers kunnen nemen in reactie op die dreiging. Indien nodig stelt de entiteit die ontvangers ook in kennis van de desbetreffende significante cyberdreiging.
    Source, retrieved on 3 October 2026.
  7. [7] Cbw Art. 1 (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Definition of significant cyber threat. Original Dutch text:
    significante cyberdreiging: een cyberdreiging waarvan op basis van de technische kenmerken kan worden aangenomen dat zij ernstige gevolgen kan hebben voor de netwerk- en informatiesystemen van een entiteit of de gebruikers van de diensten van de entiteit door het veroorzaken van aanzienlijke materiële of immateriële schade;
    Source, retrieved on 3 October 2026.
  8. [8] Cbb Art. 8(4) (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). The incident-handling procedures include documenting incidents and learning from them. Original Dutch text:
    4. De essentiële entiteit of belangrijke entiteit stelt in het kader van de toepassing van het beleid, bedoeld in het eerste lid, processen en procedures vast voor: […] d. het documenteren van incidenten; e. het rapporteren van incidenten; en f. het leren van incidenten.
    Source, retrieved on 3 October 2026.
  9. [9] Cyberbeveiligingsregeling IenW, explanatory note, article-by-article explanation to section 5 (Cyberbeveiligingsregeling IenW (Stcrt. 2026, 24093); Dutch law, unofficial translation). According to the explanatory note, an incident is significant if it meets or may come to meet one of the thresholds in section 5 of the regulation. Original Dutch text:
    Een incident is significant wanneer het aan een van de in paragraaf 5 genoemde criteria voldoet of kan gaan voldoen (drempelwaarden).
    Source, retrieved on 3 October 2026.

Related questions

When is a cyber incident a significant incident?When and where do you report a significant incident under the Cbw?Must you inform your customers about a cyber incident?Who is your CSIRT under the Cbw and what help do you get after a report?

Next step

Register your organisation and your Cbw sector. Trusq sets up the duty of care, the reporting duty, the tasks of the management body and the registration as actions, each with the evidence that is expected and the article it rests on.

Set up the Cbw duties in Trusq

Not sure whether the Cbw applies to your business? Take the Cbw check (in Dutch).

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.