Skip to content

Knowledge base · Cbw/NIS2 for transport and logistics

Must you report an incident that takes place at your IT supplier or cloud provider?

Yes, if it is a significant incident for your own services. The reporting duty depends on the consequences for your services, not on where the incident arises: if a disruption or hack at your supplier causes a serious operational disruption of your services or financial losses for you, you report it yourself, within 24 hours of becoming aware of it. A cloud provider that is itself covered by the Cbw also has its own reporting duty.

In force now (since 15 August 2026)Trusq editorial · checked against the official textLast verified:

Next step: Set up the Cbw duties in Trusq

Why it is your report

You report every significant incident [1]. An incident is an event that compromises the availability, authenticity, integrity or confidentiality of data or of services offered via network and information systems [2]; the act does not limit that to systems you manage yourself. The duty of care also applies to systems you use but do not own, such as a TMS in the cloud [3].

When it is significant

What is decisive is whether the incident causes or can cause a serious operational disruption of your services or financial losses for you, or can cause considerable damage to others [4]. For transport companies the regulation of the Minister of Infrastructure and Water Management sets threshold values per subsector; these are deliberately independent of the cause of the incident [9]. Planned maintenance interruptions do not count [5].

From when the clock runs

You make the early warning without undue delay or, if that is not possible, within 24 hours of becoming aware of the significant incident [6]. If you notice yourself that your services are seriously disrupted, you know of the incident and do not wait for the supplier's analysis. Make agreements on how quickly the supplier informs you.

Agreements with the supplier

Your supply chain policy governs how you deal with dependencies on suppliers that can affect the security of your systems [7]. A cloud provider that is itself covered by the Cbw must inform the recipients of its services without delay of significant incidents that may affect its service provision [8].

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Organisation: Submit the incident notification and available initial assessment. Cbw 27(1)–(2), Cbw 25, NIS2 23(4)(b), Cbb 25
  • Per ICT system: Include this ICT system in the cybersecurity risk analysis and treat its risks. Cbw 21(1), Cbw 21(2), Cbw 21(3)(a), NIS2 21(1), NIS2 21(2)(a)
  • Organisation: Submit an early warning of a significant incident. Cbw 26, Cbw 25, NIS2 23(4)(a), Cbb 24, Cbb 25
  • Organisation: Manage supply-chain security. NIS2 21(2)(d), Cbw 21(3)(d)
  • Organisation: Inform service recipients about relevant incidents and cyber threats. Cbw 30(1)–(2), NIS2 23(1), NIS2 23(2)

Sources

  1. [1] Cbw Art. 25(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). The reporting duty applies to every significant incident. Original Dutch text:
    1. De essentiële entiteit of belangrijke entiteit meldt overeenkomstig de artikelen 26 tot en met 29 ieder significant incident.
    Source, retrieved on 3 October 2026.
  2. [2] Cbw Art. 1 (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Definition of incident. Original Dutch text:
    incident: een gebeurtenis die de beschikbaarheid, authenticiteit, integriteit of vertrouwelijkheid van opgeslagen, verzonden of verwerkte gegevens of van de diensten die worden aangeboden door of toegankelijk zijn via netwerk- en informatiesystemen, in gevaar brengt;
    Source, retrieved on 3 October 2026.
  3. [3] Cbw Art. 21(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). The duty of care applies to the systems the entity uses for its activities or services. Original Dutch text:
    1. De essentiële entiteit of belangrijke entiteit neemt passende en evenredige technische, operationele en organisatorische maatregelen om de risico’s voor de beveiliging van de netwerk- en informatiesystemen, die zij voor haar werkzaamheden of voor het verlenen van haar diensten gebruikt, te beheersen.
    Source, retrieved on 3 October 2026.
  4. [4] Cbw Art. 25(2) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). When an incident is significant. Original Dutch text:
    2. Een incident is een significant incident als het: a. een ernstige operationele verstoring van de diensten of financiële verliezen voor de betrokken entiteit veroorzaakt of kan veroorzaken; of b. andere entiteiten heeft getroffen of kan treffen door aanzienlijke materiële of immateriële schade te veroorzaken.
    Source, retrieved on 3 October 2026.
  5. [5] Cyberbeveiligingsregeling IenW Art. 14 (Cyberbeveiligingsregeling IenW (Stcrt. 2026, 24093); Dutch law, unofficial translation). Planned service interruptions and maintenance do not count as a significant incident. Original Dutch text:
    Geplande dienstonderbrekingen en geplande gevolgen van geplande onderhoudswerkzaamheden die door of namens de belangrijke entiteit of essentiële entiteit worden uitgevoerd, worden niet als significante incidenten beschouwd.
    Source, retrieved on 3 October 2026.
  6. [6] Cbw Art. 26(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). The early warning follows without undue delay or, if that is not possible, within 24 hours of becoming aware. Original Dutch text:
    Dit doet zij onverwijld of, indien dat niet mogelijk is, binnen 24 uur nadat zij kennis heeft gekregen van het significante incident.
    Source, retrieved on 3 October 2026.
  7. [7] Cbb Art. 10(1) (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). The supply chain policy governs dealing with dependencies on suppliers that can affect security. Original Dutch text:
    De entiteit bepaalt in dat beleid haar omgang met afhankelijkheden van de producten en diensten van haar leveranciers en dienstverleners die invloed kunnen hebben op de beveiliging van haar netwerk- en informatiesystemen.
    Source, retrieved on 3 October 2026.
  8. [8] Cbw Art. 30(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). An entity informs recipients of its services without delay of significant incidents that may affect service provision. Original Dutch text:
    1. De essentiële entiteit of belangrijke entiteit stelt in voorkomend geval onverwijld de ontvangers van haar diensten in kennis van significante incidenten die een nadelige invloed kunnen hebben op de verlening van die diensten.
    Source, retrieved on 3 October 2026.
  9. [9] Cyberbeveiligingsregeling IenW, explanatory note, section 5 (Cyberbeveiligingsregeling IenW (Stcrt. 2026, 24093); Dutch law, unofficial translation). According to the explanatory memorandum, the threshold values are formulated independently of the cause of an incident. Original Dutch text:
    Bij het formuleren van de drempelwaarden is nadrukkelijk gezocht naar een benadering die onafhankelijk is van de oorzaak van een incident.
    Source, retrieved on 3 October 2026.

Related questions

When is a cyber incident a significant incident?Does the Cbw duty of care also apply to your TMS, WMS or telematics in the cloud?What must you arrange under the Cbw for your suppliers and IT service providers (NIS2 21(2)(d))?What must the early warning within 24 hours contain?

Next step

Register your organisation and your Cbw sector. Trusq sets up the duty of care, the reporting duty, the tasks of the management body and the registration as actions, each with the evidence that is expected and the article it rests on.

Set up the Cbw duties in Trusq

Not sure whether the Cbw applies to your business? Take the Cbw check (in Dutch).

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.