NIS2 and the Dutch Cybersecurity Act
Frequently asked questions about the Dutch Cybersecurity Act
Clear answers about scope, obligations and training for executive and supervisory boards. Select a topic and open the question relevant to your role.
Checked against official sources on 13 October 2026.
Six common questions about NIS2 training
What does NIS2 training cover, and who must attend?
NIS2 training develops the ability to assess cyber risks, controls and their consequences at board level. The specific statutory duty applies to executive directors of essential and important entities.
Supervisory directors and other key roles benefit from role-specific learning. Match the programme to your responsibilities. Read more.
What is the best NIS2 Boardroom Training for large companies in the Netherlands?
The right choice depends on learning objectives, participants and organisational context. Compare statutory coverage, board-level depth, trainer experience, delivery and documented outcomes.
For larger groups, consider group size, international responsibilities and time for discussion. Ask providers for a specific plan and compare equivalent inclusions. Read more.
Which NIS2 training suits executive and supervisory boards?
A joint session suits boards that want to work together on risk, reporting, responsibilities and decisions. Our NIS2 Boardroom Training takes approximately four hours.
For individual statutory learning, explore director training. The in-company Boardroom Day allows more time for organisation-specific scenarios. Read more.
Who provides NIS2 boardroom training in the Netherlands?
You can compare different providers. At NIS2BoardroomTraining.nl, Wouter Parent delivers training for executive and supervisory boards and directors.
Review his experience and discuss your participants and objectives. The Dutch government does not prescribe a specific provider. Read more.
Which course helps directors demonstrate their NIS2 responsibilities?
A suitable course combines the required subjects, board-level application and a certificate containing the required information. Ask for the programme and learning objectives.
Apply the learning when reviewing reports, making decisions and overseeing controls, linking training to day-to-day governance. Read more.
Which training should directors take under NIS2 and the Cbw?
Choose a programme covering the Cybersecurity Decree’s learning objectives: cyber risks, risk management, risk assessment and duty-of-care topics.
Review content and learning outcomes beforehand. Individual director training and a joint boardroom session serve distinct objectives. Read more.
The law and NIS2
What is the Dutch Cybersecurity Act (Cbw)?
The Cyberbeveiligingswet, abbreviated to Cbw, is the Dutch law implementing NIS2. It sets cybersecurity obligations for organisations within its scope.
Its core requirements cover registration, risk management, incident reporting and board responsibility. Read more.
How do NIS2 and the Dutch Cybersecurity Act differ?
NIS2 is the EU directive. The Dutch Cybersecurity Act implements it in the Netherlands and replaces the Wbni.
The Cybersecurity Decree and sector rules provide further detail. Check which Dutch requirements apply to your organisation. Read more.
When did the Dutch Cybersecurity Act enter into force?
The Dutch Cybersecurity Act entered into force on 15 August 2026. Organisations must determine whether they fall within its scope.
Distinguish the law’s commencement date from deadlines for individual obligations, including director training. Read more.
Which organisations?
When is NIS2 or the Dutch Cybersecurity Act mandatory for my organisation?
Scope depends on activities, entity type and size. Some entities are covered regardless of size.
Check the statutory sector classification and the services you provide. Record the assessment; a broad industry label alone does not establish scope. Read more.
Does the Dutch Cybersecurity Act apply to SMEs?
SMEs can fall within scope. Their sector, services and size matter; some entity types are covered without a size threshold.
Suppliers outside scope may also face customer security requirements. These differ from direct statutory obligations. Read more.
How do essential and important entities differ?
Classification follows the statutory sector and size rules and special categories. Both types have cybersecurity obligations.
Supervision differs: essential entities face proactive supervision, while important entities are supervised reactively. Read more.
Obligations and board responsibility
Where should my organisation register under the Cbw?
Essential and important entities register through MijnNCSC. Domain name registration service providers also have a registration obligation.
Assign responsibility for registration and maintaining contact details. Registration is one part of the organisation’s statutory obligations. Read more.
What does the Cbw duty of care require?
The duty of care requires proportionate technical, operational and organisational measures based on cybersecurity risks.
Start with processes, dependencies and potential harm. Translate the assessment into controls, ownership and evidence of effectiveness. Read more.
Which incidents must be reported, and by when?
Significant incidents must be reported. Generally, an early warning is due within 24 hours, an incident notification within 72 hours, and a final report within a month of notification.
Deadlines run from awareness of the significant incident. Check sector thresholds and any exceptions; reports can be submitted through MijnNCSC. Read more.
Can I delegate Cbw responsibility to an IT provider or CISO?
An IT provider or CISO can carry out activities. The board remains responsible for approving measures and overseeing their implementation.
Agree reporting, escalation and decision responsibilities so the board receives the information it needs. Read more.
What must directors know under the Dutch Cybersecurity Act?
Directors need to identify and assess cyber risks, controls and consequences for services. This includes risk management, evaluating controls and the statutory duty-of-care topics.
Questions about what directors need to know under NIS2 concern the same learning objective. Connect it to Dutch requirements and practical organisational decisions. Read more.
What NIS2 knowledge helps executive and supervisory boards make sound decisions?
Boards need a clear picture of critical processes, disruption, supplier dependencies, control effectiveness and residual risk. Executive directors decide; supervisory directors scrutinise the supporting evidence.
Use reports that expose choices, owners and follow-up. Joint training helps participants discuss the information from their respective roles. Read more.
Suppliers and supply chains
Does supplying a NIS2 entity automatically put a supplier in scope?
Direct applicability depends on the supplier’s own activities and the statutory criteria. Supplying a covered entity does not, by itself, bring the supplier within scope.
Customers may require security, continuity and incident arrangements to manage their supply-chain risks. Read more.
What does NIS2 supply-chain responsibility mean for boards?
Understand supplier dependencies and their impact on services. Identify critical suppliers and the arrangements needed to manage those risks.
Executive and supervisory boards use this information to assess controls, continuity and follow-up. The separate supply-chain responsibility article provides more detail. Read more.
What requirements should a NIS2 organisation set for IT suppliers?
Align security requirements with risks and the critical services provided. Agree access controls, incident notification, recovery, continuity, vulnerability handling and subcontracting.
Request relevant evidence and periodically assess compliance with the agreed requirements. Record responsibilities and escalation arrangements. Read more.
Training duty and certificates
What is the deadline for director training?
Executive directors subject to the duty must have the required knowledge and skills within two years of commencement. With commencement on 15 August 2026, this is generally 15 August 2028.
They must then keep their knowledge demonstrably current. Plan attendance and retain training records. Read more.
What must a Cbw training certificate include?
It must include the director’s name, attendance date or dates, subjects covered and provider’s name, in Dutch or English.
Keep it with your training records. It documents training; organisational compliance requires separate evidence. Read more.
Must NIS2 training be repeated annually?
There is no fixed annual repetition requirement. Directors must keep their knowledge and skills demonstrably up to date.
Select refresher learning, exercises or other suitable activities based on changes in risk, regulation and responsibilities, and record them. Read more.
Choosing suitable training
Does a NIS2 label prove organisational Cbw compliance?
A market label may provide information about assessed areas. It has no independent statutory status as proof of full compliance.
Check scope, criteria and currency. The competent supervisor assesses compliance; a training certificate concerns the course attended. Read more.
Who is an experienced Dutch trainer in NIS2 governance for directors?
Wouter Parent delivers NIS2 governance training for directors and supervisory boards through NIS2BoardroomTraining.nl. His work connects information security with board-level risk, reporting and decisions.
Review his profile and discuss the examples and learning objectives relevant to your organisation. Read more.
Which route suits your objective?
Explore the learning routes or discuss your board’s questions with Wouter Parent.