Skip to content

Knowledge base · Cbw/NIS2 for transport and logistics

May you share information about cyber threats and incidents with other logistics companies?

Yes. The Cbw expressly allows companies, including companies not themselves covered by the act, to exchange cybersecurity information voluntarily in order to prevent, detect or mitigate incidents, for example in a sector exchange with agreements on confidentiality. If you fall under the Cbw, you report participation in or withdrawal from such an arrangement for the national register.

In force now (since 15 August 2026)Trusq editorial · checked against the official textLast verified:

Next step: Ask a specialist

What the act allows

Essential, important and other entities may voluntarily exchange relevant cybersecurity information in order to prevent, detect, respond to or recover from incidents [1]. This can take place within communities of entities and with their suppliers, on the basis of agreements on the sensitivity of the information [2].

Registration

If you fall under the Cbw, you also pass on for the national register participation in and withdrawal from such an information-sharing arrangement [3], and you report changes without undue delay or in any event within two weeks of the date of the change [4].

What you do with information you receive

If you receive targeted security advisories or threat information, for example from a CSIRT or a supplier, you assess whether your measures need to change and record that [5]. The CSIRT itself also exchanges information with entities and communities of entities [6].

In practice

Share indicators and attacker methods, not customer data. If the information contains personal data, such as names or email addresses, limit it to what is necessary.

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Organisation: Provide the required national-register information. Cbw 44(1), Cbb 27, NIS2 3(4)
  • Organisation: Report changes to registered information. Cbw 44(2), NIS2 3(4)

Sources

  1. [1] Cbw Art. 62(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Entities may voluntarily exchange cybersecurity information. Original Dutch text:
    1. Essentiële entiteiten, belangrijke entiteiten, entiteiten die domeinnaamregistratiediensten verlenen en andere entiteiten die niet de hiervoor genoemde entiteiten betreffen, kunnen op vrijwillige basis relevante informatie over cyberbeveiliging uitwisselen om incidenten te voorkomen, te detecteren, erop te reageren of ervan te herstellen of de gevolgen ervan te beperken en om het cyberbeveiligingsniveau te verhogen.
    Source, retrieved on 3 October 2026.
  2. [2] Cbw Art. 62(2) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Exchange can take place within communities of entities and with suppliers, on the basis of arrangements. Original Dutch text:
    2. De informatie-uitwisseling, bedoeld in het eerste lid, kan plaatsvinden binnen gemeenschappen van entiteiten en, indien van toepassing, hun leveranciers en dienstverleners op basis van informatie-uitwisselingsregelingen op het gebied van cyberbeveiliging met betrekking tot de potentieel gevoelige aard van de uitgewisselde informatie.
    Source, retrieved on 3 October 2026.
  3. [3] Cbw Art. 44(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). For the register, participation in or withdrawal from an information-sharing arrangement is passed on. Original Dutch text:
    e. indien van toepassing, de deelname aan en terugtrekking uit een informatie-uitwisselingsregeling als bedoeld in artikel 62, tweede lid;
    Source, retrieved on 3 October 2026.
  4. [4] Cbw Art. 44(2) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Changes are reported without undue delay or in any event within two weeks of the date of the change. Original Dutch text:
    2. De entiteiten, bedoeld in het eerste lid, melden Onze Minister onverwijld of in elk geval binnen twee weken na de datum van de wijziging, elke wijziging van de informatie die zij op grond van het eerste lid hebben verstrekt.
    Source, retrieved on 3 October 2026.
  5. [5] Cbb Art. 17(2) (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). Targeted security advisories and threat information are assessed and the outcome is recorded. Original Dutch text:
    2. Het eerste lid is van overeenkomstige toepassing op gerichte beveiligingsadviezen en dreigingsinformatie, die relevant zijn voor de beveiliging van de netwerk- en informatiesystemen van de essentiële entiteit of belangrijke entiteit, en zijn ontvangen van relevante organisaties, waaronder CSIRT’s, bevoegde autoriteiten, andere betrokken overheidsinstanties, rechtstreekse leveranciers en rechtstreekse dienstverleners.
    Source, retrieved on 3 October 2026.
  6. [6] Cbw Art. 53 (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). CSIRTs exchange information with entities and communities of entities. Original Dutch text:
    De CSIRT’s wisselen relevante informatie uit met essentiële entiteiten, belangrijke entiteiten, entiteiten die domeinnaamregistratiediensten verlenen en gemeenschappen van entiteiten
    Source, retrieved on 3 October 2026.

Related questions

Must you register your company under the Cyberbeveiligingswet, and when?Do you have to report a near miss or a cyber threat under the Cbw?What must you arrange under the Cbw for your suppliers and IT service providers (NIS2 21(2)(d))?

Next step

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed. Describe your question; we reply within one working day.

Ask a specialist

Not sure whether the Cbw applies to your business? Take the Cbw check (in Dutch).

This page gives general information based on the text of the law. It is not legal advice for your situation.