Skip to content

Knowledge base · Cbw/NIS2 for transport and logistics

Where do you report a vulnerability you find in a supplier's software or equipment?

Anyone can report a vulnerability voluntarily, and anonymously if desired, to the coordinator for coordinated vulnerability disclosure. That is the Minister of Justice and Security; in practice the Nationaal Cyber Security Centrum (NCSC) performs that role. The coordinator can mediate between you and the manufacturer or provider. If you are covered by the Cbw yourself, dealing with vulnerabilities is also part of your duty of care. For the manufacturer of the product, a reporting duty of its own also applies since 11 September 2026: it reports an actively exploited vulnerability via the single reporting platform of Enisa (Cyber Resilience Act, Article 14).

In force now (since 15 August 2026)Trusq editorial · checked against the official textLast verified:

Next step: Ask a specialist

Reporting to the coordinator

Anyone may report a vulnerability voluntarily to the coordinator, also anonymously; the coordinator guarantees that anonymity [1]. The Cbb designates the minister as coordinator [2], and that is the Minister of Justice and Security [3]. According to the explanatory memorandum, the NCSC performs that role in practice [8].

What the coordinator does

At the request of you or the manufacturer, the coordinator can act as an intermediary and facilitate the contacts [4].

The manufacturer's reporting duty

A manufacturer of a product with digital elements reports every actively exploited vulnerability of which it becomes aware, simultaneously to the CSIRT designated as coordinator and to Enisa, via the single reporting platform [9]. That duty applies since 11 September 2026 [10]. Your report to the coordinator does not replace the manufacturer's report.

If you are covered by the Cbw yourself

The duty of care includes security in the acquisition, development and maintenance of systems, including the response to and disclosure of vulnerabilities [5]. If you are specifically warned about a vulnerability that affects your systems, you assess whether your measures must change and record that [6]. Transport companies remedy vulnerabilities that pose a risk without delay, or record with reasons why that does not happen or happens later [7].

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Organisation: Secure acquisition, development and maintenance, including vulnerability handling. NIS2 21(2)(e), Cbw 21(3)(e)

Sources

  1. [1] Cbw Art. 34 (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Anyone can report a vulnerability voluntarily and anonymously to the coordinator. Original Dutch text:
    1. Eenieder kan op vrijwillige basis een melding maken van een kwetsbaarheid bij de coördinator met het oog op een gecoördineerde bekendmaking van kwetsbaarheden. 2. De melding kan anoniem worden gedaan. 3. De coördinator met het oog op een gecoördineerde bekendmaking van kwetsbaarheden geeft opvolging aan de melding door het verrichten van de taken, genoemd in artikel 17, tweede lid, en waarborgt de anonimiteit van de natuurlijke persoon of rechtspersoon die de kwetsbaarheid meldt.
    Source, retrieved on 3 October 2026.
  2. [2] Cbb Art. 2(3) (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). The minister is the coordinator for coordinated vulnerability disclosure. Original Dutch text:
    3. Onze Minister is de coördinator met het oog op een gecoördineerde bekendmaking van kwetsbaarheden, bedoeld in artikel 17 van de wet.
    Source, retrieved on 3 October 2026.
  3. [3] Cbw Art. 1 (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). In the Cbw and the provisions based on it, the minister is the Minister of Justice and Security. Original Dutch text:
    In deze wet en de daarop berustende bepalingen wordt verstaan onder: […] Onze Minister: Onze Minister van Justitie en Veiligheid;
    Source, retrieved on 3 October 2026.
  4. [4] Cbw Art. 17(2) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). At request, the coordinator acts as an intermediary between the reporter and the manufacturer or provider. Original Dutch text:
    2. De coördinator met het oog op een gecoördineerde bekendmaking van kwetsbaarheden heeft de volgende taken: a. het optreden als tussenpersoon en het waar nodig vergemakkelijken van de interactie tussen de natuurlijke persoon of rechtspersoon die een kwetsbaarheid op grond van artikel 34 meldt en de fabrikant of aanbieder van de mogelijk kwetsbare ICT-producten of -diensten, op verzoek van een van beide partijen;
    Source, retrieved on 3 October 2026.
  5. [5] Cbw Art. 21(3)(e) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). The duty of care includes the response to and disclosure of vulnerabilities. Original Dutch text:
    e. beveiliging bij het verwerven, ontwikkelen en onderhouden van netwerk- en informatiesystemen, met inbegrip van de respons op en bekendmaking van kwetsbaarheden;
    Source, retrieved on 3 October 2026.
  6. [6] Cbb Art. 17(1) (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). After a specific warning, the entity assesses its measures and records the outcome. Original Dutch text:
    1. Indien de essentiële entiteit of belangrijke entiteit gericht wordt geattendeerd op voor de beveiliging van haar netwerk- en informatiesystemen relevante kwetsbaarheden of cyberdreigingen, beoordeelt zij of op basis daarvan aanpassingen of aanvullingen nodig zijn van de maatregelen ter uitvoering van artikel 21 van de wet. De entiteit legt de uitkomsten van die beoordeling schriftelijk vast.
    Source, retrieved on 3 October 2026.
  7. [7] Cyberbeveiligingsregeling IenW Art. 12(3)(d) (Cyberbeveiligingsregeling IenW (Stcrt. 2026, 24093); Dutch law, unofficial translation). Transport companies remedy high-risk vulnerabilities without delay or justify and document why not. Original Dutch text:
    d. verhelpt de essentiële entiteit of belangrijke entiteit onverwijld kwetsbaarheden die een risico vormen voor de beveiliging van haar netwerk- en informatiesystemen, of motiveert waarom de kwetsbaarheid niet of op een later moment verholpen wordt en documenteert dit.
    Source, retrieved on 3 October 2026.
  8. [8] Explanatory note to the Cbb, article-by-article explanation to Article 2(3) (Explanatory note to the Dutch Cyberbeveiligingsbesluit (Stb. 2026, 189); Dutch law, unofficial translation). According to the explanatory memorandum, the NCSC performs the coordinator role in practice. Original Dutch text:
    Die rol van coördinator zal in de praktijk worden uitgevoerd door het NCSC.
    Source, retrieved on 3 October 2026.
  9. [9] CRA Art. 14(1) (Cyber Resilience Act, Regulation (EU) 2024/2847). Manufacturers report actively exploited vulnerabilities to the coordinating CSIRT and Enisa via the single reporting platform.
    1. A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA. The manufacturer shall notify that actively exploited vulnerability via the single reporting platform established pursuant to Article 16.
    Source, retrieved on 22 October 2026.
  10. [10] CRA Art. 71(2) (Cyber Resilience Act, Regulation (EU) 2024/2847). Article 14 applies from 11 September 2026.
    However, Article 14 shall apply from 11 September 2026
    Source, retrieved on 22 October 2026.

Related questions

What does the Cbw require on vulnerabilities, patches and maintenance of systems (NIS2 21(2)(e))?What must you arrange under the Cbw for your suppliers and IT service providers (NIS2 21(2)(d))?Who is your CSIRT under the Cbw and what help do you get after a report?

Next step

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed. Describe your question; we reply within one working day.

Ask a specialist

Not sure whether the Cbw applies to your business? Take the Cbw check (in Dutch).

This page gives general information based on the text of the law. It is not legal advice for your situation.