Skip to content

Knowledge base · Cbw/NIS2 for transport and logistics

What must the management body do under the Cyberbeveiligingswet?

The management body approves the cybersecurity measures, every member of the management body has the knowledge and skills to assess risks and measures, and demonstrably keeps that knowledge up to date (Cbw 24).

In force now (since 15 August 2026)Trusq editorial · checked against the official textLast verified:

Next step: Set up the Cbw duties in Trusq

Approving

The measures of the duty of care require the approval of the management body [1]. Record that decision, with the date and the documents that were approved.

Knowledge and skills

Every member of the management body must be able to identify risks, assess measures and estimate the consequences for the services [2]. Directors who were already in office on 15 August 2026 must comply by 15 August 2028 at the latest; a member of the management body appointed later, within two years of the appointment [3].

Keeping it up to date

The knowledge and skills must demonstrably remain up to date [4]. This is a national addition to the Cbw; NIS2 has no separate duty to keep them up to date. The certificate of a training is the evidence of the knowledge.

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Organisation: Obtain board approval for cybersecurity risk-management measures. Cbw 24(1), NIS2 20(1)
  • Organisation: Ensure board members have the required knowledge and skills. Cbw 24(2), Cbw 24(3), NIS2 20(2)
  • Organisation: Keep board knowledge and skills demonstrably current. Cbw 24(4)

Sources

  1. [1] Cbw Art. 24(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). The measures of Article 21 require approval by the management body. Original Dutch text:
    1. De maatregelen, bedoeld in artikel 21, behoeven de goedkeuring van het bestuur van de essentiële entiteit of belangrijke entiteit.
    Source, retrieved on 2 October 2026.
  2. [2] Cbw Art. 24(2) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Every member of the management body has knowledge and skills on three topics. Original Dutch text:
    2. Ieder lid van het bestuur van een essentiële entiteit of belangrijke entiteit beschikt over kennis en vaardigheden om: a. risico’s voor de beveiliging van netwerk- en informatiesystemen te kunnen identificeren; b. risicobeheersmaatregelen op het gebied van cyberbeveiliging te kunnen beoordelen; en c. de gevolgen van de risico’s en risicobeheersmaatregelen voor de diensten die door de entiteit worden verleend te kunnen beoordelen.
    Source, retrieved on 2 October 2026.
  3. [3] Cbw Art. 24(3) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Period of two years after paragraph 2 enters into force, or after a later appointment. Original Dutch text:
    3. Ieder lid van het bestuur van een essentiële entiteit of belangrijke entiteit voldoet binnen twee jaar na de inwerkingtreding van het tweede lid aan het bepaalde in het tweede lid.
    Source, retrieved on 2 October 2026.
  4. [4] Cbw Art. 24(4) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Knowledge and skills are demonstrably kept up to date. Original Dutch text:
    4. Ieder lid van het bestuur van een essentiële entiteit of belangrijke entiteit houdt de kennis en vaardigheden, bedoeld in het tweede lid, aantoonbaar actueel.
    Source, retrieved on 2 October 2026.

Related questions

When must a director have completed the Cbw training and what is on the certificate?What does the duty of care of the Cyberbeveiligingswet involve?Who supervises the Cbw in transport and logistics, and how high are the fines?Does the Cbw management duty also apply to partners of a vof, maatschap or cv?Must you appoint a CISO or security officer under the Cyberbeveiligingswet?

Next step

Register your organisation and your Cbw sector. Trusq sets up the duty of care, the reporting duty, the tasks of the management body and the registration as actions, each with the evidence that is expected and the article it rests on.

Set up the Cbw duties in Trusq

Not sure whether the Cbw applies to your business? Take the Cbw check (in Dutch).

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.