Knowledge base · Cbw/NIS2 for transport and logistics

When and where do you report a significant incident under the Cbw?

You report a significant incident in steps to your CSIRT and your competent authority: an early warning without undue delay or, if that is not possible, within 24 hours, a notification without undue delay or, if that is not possible, within 72 hours, and a final report no later than one month after the notification. For a trust service provider the notification deadline is 24 hours if the significant incident affects the provision of that service. If the incident is still ongoing at that point, you submit a progress report then and the final report follows within one month of handling. You report to the reporting point that the Minister of Justice and Security has set up for this.

In force now (since 15 August 2026)Trusq editorial · checked against the official textLast verified: 8 November 2026

Next step: Set up the Cbw duties in Trusq

The deadlines at a glance

Within 24 hours of becoming aware: early warning ^[2]
Within 72 hours of becoming aware: the notification with an update and an initial assessment ^[3]. For a trust service provider the deadline is 24 hours if the significant incident affects the provision of that service ^[6].
On request: an interim report
No later than one month after the notification: the final report; if the incident is still ongoing then, a progress report and the final report within one month of handling ^[4]

For the early warning and the notification the rule is first “without undue delay”; the hours are the last moment, for when earlier is not possible.

Which incidents

The reporting duty applies to every significant incident ^[1]. When an incident is significant, you can read on the page about significant incidents.

To whom and how

The reports go to the CSIRT and the competent authority of your sector. You make the report at the reporting point that the Minister of Justice and Security has set up for this ^[5] ^[7]. For most sectors, transport included, that minister acts as the CSIRT ^[8]; in practice the NCSC carries out that task ^[9].

Who it applies to

The reporting duty applies to essential and important entities ^[1].

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

Organisation: Submit an early warning of a significant incident. Cbw 26, Cbw 25, NIS2 23(4)(a), Cbb 24, Cbb 25
Organisation: Submit the incident notification and available initial assessment. Cbw 27(1)–(2), Cbw 25, NIS2 23(4)(b), Cbb 25
Organisation: Submit the final incident report. Cbw 29(1)–(2), Cbw 25, NIS2 23(4)(d), NIS2 23(4)(e), Cbb 25
Organisation: Provide a progress report when the incident is still ongoing. Cbw 29(2), Cbw 25, NIS2 23(4)(e), Cbb 25

Sources

[1] Cbw Art. 25(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). An essential or important entity reports every significant incident in accordance with Articles 26 to 29. Original Dutch text:
1. De essentiële entiteit of belangrijke entiteit meldt overeenkomstig de artikelen 26 tot en met 29 ieder significant incident.
Source, retrieved on 2 October 2026.
[2] Cbw Art. 26(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Early warning without undue delay or, if that is not possible, within 24 hours. Original Dutch text:
1. De essentiële entiteit of belangrijke entiteit geeft ten behoeve van de melding, bedoeld in artikel 27, eerste lid, een vroegtijdige waarschuwing over het significante incident aan haar CSIRT en haar bevoegde autoriteit. Dit doet zij onverwijld of, indien dat niet mogelijk is, binnen 24 uur nadat zij kennis heeft gekregen van het significante incident.
Source, retrieved on 2 October 2026.
[3] Cbw Art. 27(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Notification without undue delay or, if that is not possible, within 72 hours. Original Dutch text:
1. De essentiële entiteit of belangrijke entiteit dient onverwijld of, indien dat niet mogelijk is, binnen 72 uur nadat zij kennis heeft gekregen van het significante incident een melding in bij haar CSIRT en haar bevoegde autoriteit met:
Source, retrieved on 2 October 2026.
[4] Cbw Art. 29 (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Final report no later than one month after the notification; if the incident is ongoing, a progress report. Original Dutch text:
1. De essentiële entiteit of belangrijke entiteit dient uiterlijk één maand na de melding, bedoeld in artikel 27, eerste lid, een eindverslag in bij haar CSIRT en haar bevoegde autoriteit […] 2. Indien het incident nog voortduurt op het moment dat het eindverslag had moeten worden ingediend, dient de essentiële entiteit of belangrijke entiteit op dat moment in plaats van een eindverslag een voortgangsverslag in waarin wordt ingegaan op de aspecten, genoemd in het eerste lid. Zij dient een eindverslag in binnen één maand nadat het incident is afgehandeld.
Source, retrieved on 2 October 2026.
[5] Cbb Art. 25 (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). The report is made at the Minister's reporting point. Original Dutch text:
De melding, bedoeld in artikel 25, eerste lid, van de wet, wordt gedaan bij een hiervoor door Onze Minister ingericht meldpunt.
Source, retrieved on 2 October 2026.
[6] Cbw Art. 27(2) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). A trust service provider reports without undue delay or, if that is not possible, within 24 hours if the significant incident affects the provision of that service. Original Dutch text:
binnen 24 uur […] als dat incident gevolgen heeft voor de verlening van haar vertrouwensdienst.
Source, retrieved on 7 November 2026.
[7] Explanatory note to the Cbb, article by article, Article 25 (how a report is made) (Explanatory note to the Dutch Cyberbeveiligingsbesluit (Stb. 2026, 189); Dutch law, unofficial translation). The reporting point has been set up by the Minister of Justice and Security. Original Dutch text:
Artikel 25 Cbb verplicht essentiële entiteiten en belangrijke entiteiten om meldingen van significante incidenten te doen bij een hiervoor door de Minister van Justitie en Veiligheid ingericht meldpunt.
Source, retrieved on 8 November 2026.
[8] Cbb Art. 2(1) (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). The Minister of Justice and Security is the CSIRT for essential and important entities, unless another has been designated by regulation. Original Dutch text:
Onze Minister wordt voor essentiële entiteiten en belangrijke entiteiten aangewezen als het CSIRT, bedoeld in artikel 16, eerste lid, van de wet.
Source, retrieved on 8 November 2026.
[9] Explanatory note to the Cbb, article by article, Article 2(1) (Explanatory note to the Dutch Cyberbeveiligingsbesluit (Stb. 2026, 189); Dutch law, unofficial translation). For the sectors of Infrastructure and Water Management too, the CSIRT task lies with the Minister of Justice and Security; in practice the NCSC carries it out. Original Dutch text:
de Minister van Infrastructuur en Waterstaat […] hebben in samenspraak met de Minister van Justitie en Veiligheid besloten de CSIRT-taak te beleggen bij de Minister van Justitie en Veiligheid voor de sectoren waar zij politiek verantwoordelijk voor zijn. De taken die de Minister van Justitie en Veiligheid als CSIRT op grond van de Cbw moet verrichten zullen in de praktijk worden uitgevoerd door het NCSC.
Source, retrieved on 8 November 2026.

Next step

Register your organisation and your Cbw sector. Trusq sets up the duty of care, the reporting duty, the tasks of the management body and the registration as actions, each with the evidence that is expected and the article it rests on.

Set up the Cbw duties in Trusq

Not sure whether the Cbw applies to your business? Take the Cbw check (in Dutch).

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.