Security3 April 2026
NIS2 Directive: does it apply and what to arrange?
The NIS2 directive sets stricter cybersecurity requirements. We explain who it applies to, what you need to arrange and how to prepare your organisation.
Mohammad MoghtaderBecome NIS2 compliant with your IT partner
Since 15 August 2026 the Dutch Cybersecurity Act (Cyberbeveiligingswet) has applied: the Dutch implementation of NIS2. Take the free quickscan below: three questions, no email needed. Does your SME fall under it, directly or as a supplier? Then we help with the gap analysis, the technical measures in your IT and the documentation.
The Dutch Cybersecurity Act has applied since 15 August 2026
The Cbw is the Dutch implementation of NIS2 and replaces the Wbni. If your organisation falls under it, you must be registered with the NCSC, meet the duty of care and report significant incidents within 24 hours. Not sure where you stand yet?
Book a free quickcall2000+
Cloud workspaces
6000+
Microsoft 365 accounts
20+
Years of experience
ISO 27001
certified
ISO 9001
certified
Microsoft
Solutions Partner
FD Gazelle
2022 / 2024 / 2025
NIS2 compliance for SMEs
What is the Dutch Cybersecurity Act?
The Cyberbeveiligingswet (Cbw), the Dutch Cybersecurity Act, is the Dutch implementation of the European NIS2 directive. It has applied since 15 August 2026 and replaces the Wet beveiliging netwerk- en informatiesystemen (Wbni). More than 8,000 organisations in 18 sectors fall under it, from energy and healthcare to digital infrastructure, transport and manufacturing.
The act asks three things of these organisations: register, manage their digital risks demonstrably and report serious incidents quickly. The board is responsible for this itself.
Want to read the background first? In NIS2 directive: does it apply to your business? we explain the sectors and thresholds. In our article on the Dutch Cybersecurity Act you read which five measures to arrange first. On this page you read how we help you become and stay NIS2 compliant.
ISO 27001 and ISO 9001 certified
Free three-question quickscan
Gap analysis against the Cbw duty of care
24/7 monitoring of your managed IT
Own data centres in Eindhoven and Den Bosch
Does the Cbw apply to you, directly or as a supplier?
Whether the act applies to you directly depends on two things: your sector and your size.
Sector. The act has two lists. The first contains sectors of high criticality, such as energy, transport, banking, healthcare, drinking water, digital infrastructure, ICT service management and government. The second includes postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research.
Size. In those sectors you are covered from medium size under the European SME definition: 50 employees or more, or an annual turnover and balance sheet total of more than 10 million euro each. Large organisations from the first list are essential entities. Medium-sized organisations, and organisations from the second list, are as a rule important entities. A few types of organisation are covered regardless of size, such as DNS service providers, top-level domain name registries, trust service providers, telecoms providers and government bodies.
Supplier. Even if you are not covered yourself, it can still affect you. Organisations under the Cbw must include the security of their suppliers in their measures. If you supply a healthcare institution, energy company or government body, their requirements come back to you in questionnaires, audits and contracts.
Not sure? Take the free quickscan further down this page. For a more extensive check there is the NIS2 Zelfevaluatie (self-assessment) of the Dutch Authority for Digital Infrastructure (RDI).
Quickscan and gap analysis
Your current IT and arrangements compared with the Cbw duty of care, with a list of what is missing.
Technical measures
MFA, Microsoft Defender, updates, backups and logging in the IT we manage for you.
Policies and documentation
Help with your risk analysis, incident response plan and business continuity plan, based on your actual IT.
24/7 monitoring
We detect incidents and supply the technical information for your notification. You submit it yourself.
Evidence for your clients
Our ISO 27001 certificate and a data processing agreement when clients or regulators ask how your supplier works.
What does the Cbw require of your organisation?
Registration. Since 15 August 2026, essential and important entities must be registered in the national register. You do this at mijn.ncsc.nl, logged in with eHerkenning at level EH2+. You report changes within two weeks.
Duty of care. You take appropriate and proportionate measures based on your risks. The act lists, among other things, policies for risk analysis and information security, incident handling, backups, recovery plans and crisis management, the security of your suppliers, basic cyber hygiene and training, cryptography, access policies and, where appropriate, multi-factor authentication.
Reporting obligation. You report a significant incident to your CSIRT and your supervisory authority. First an early warning, no later than 24 hours after you become aware of it. Within 72 hours a notification with an initial assessment follows, and no later than one month after that a final report.
Board members. The board approves the measures. Within two years, every board member must have enough knowledge to assess risks and measures, keep that knowledge up to date and hold a certificate from a training course.
Supervision and fines. Each sector has its own supervisory authority. Essential entities are supervised proactively, important entities after the fact, for example after an incident or a report. If you breach the duty of care or the reporting obligation, fines can reach 10 million euro or 2% of global annual turnover for essential entities, and 7 million euro or 1.4% for important entities.
How we help you become NIS2 compliant
Virtual Computing is an MSP based in Oisterwijk with its own data centres in Eindhoven and Den Bosch. We are ISO 27001 and ISO 9001 certified ourselves. That certificate covers our own organisation and services, not automatically yours. What we do: help you meet the requirements of the Cbw in your own organisation.
1. Quickscan and gap analysis. With the quickscan on this page you see in a minute whether you are likely to be covered. Then, in a gap analysis, we compare your current IT and arrangements with the duty of care. You get an overview of what is already in place, what is missing and what comes first.
2. Technical measures in your IT. In the IT we manage for you, we set up the measures that cover the technical side of the duty of care: MFA on accounts, Microsoft Defender on your devices, timely updates, backups, logging and monitoring. Want to know how your Microsoft 365 is doing first? Take the free Microsoft 365 security check. Read more about our security services under cybersecurity for SMEs.
3. Policies and documentation. We help with the documents that belong to the duty of care, as far as they concern your IT: the risk analysis, an incident response plan and a business continuity plan. We draw them up together with you, based on how your IT is actually set up. Your board makes the choices about risks and priorities.
4. Monitoring and help with the reporting obligation. We monitor the IT we manage 24/7. If we see an incident, we handle it technically and supply the information you need for your notification: what happened, when, with what impact and which measures we took. You submit the notification to your CSIRT and supervisory authority yourself. We do not report on your behalf.
5. Evidence as a supplier. We are also a link in your chain. If a client or supervisory authority asks how your IT supplier works, we provide our ISO 27001 certificate and sign a data processing agreement with you. We also help you with the IT questions in your clients' supplier questionnaires.
Want your company to be ISO 27001, NEN 7510 or NIS2 compliant? Then choose Virtual Computing. Book a no-obligation call and we will look at where you stand together.
What stays with your organisation?
An IT partner can do a lot of the work, but the act places responsibility with your organisation and your board. That stays the same when we manage your IT. These tasks always remain yours:
- your registration at mijn.ncsc.nl;
- reporting significant incidents to your CSIRT and supervisory authority;
- the board's approval of the measures;
- the training and certificate of every board member;
- measures outside the IT we manage, such as arrangements with other suppliers and the physical security of your premises.
NIS2 Quickscan
Does NIS2 apply to your organisation?
Three questions, a direct indication. No account, no email, no salesperson.
Question 1 of 360 seconds
Which sector does your organisation operate in?
Pick the closest match.
Contact
Arrange it the way you prefer
Prefer a quote with numbers first, a direct conversation, or to get started right away? Pick the route that suits you — no strings attached.
We'll call you back
An experienced IT specialist on the line within 1 working day — often the same day.
Customer stories
What our customers
We've trusted Virtual Computing with our IT for over 18 years. From a handful of workstations we've grown to 250+ users spread across Europe. Online Workplace, Microsoft 365, Windows 365 — it scales effortlessly. Fantastic service and excellent knowledge.
M
Matija Jolic
Aushi BV — 250 workspaces across Europe
Good to know
Frequently asked questions
Since 15 August 2026. The House of Representatives passed the act on 15 April 2026 and the Senate approved it on 7 July 2026. The Cbw is the Dutch implementation of the European NIS2 directive and replaces the Wbni. Registration, the duty of care and the reporting obligation apply from entry into force. Board members have two years to meet the knowledge requirement.
That depends on your sector and your size. In the sectors listed in the act you are covered if you are medium-sized or large: 50 employees or more, or an annual turnover and balance sheet total of more than 10 million euro each. A few types of organisation are covered regardless of size, such as DNS service providers, telecoms providers and government bodies. The quickscan on this page gives a first indication. For a more extensive check there is the NIS2 Zelfevaluatie of the RDI.
Often it does, if you supply organisations that are covered. They must include the security of their suppliers in their measures. You notice this in questionnaires, audits and security requirements in contracts. You then have no registration or reporting obligation yourself, but your client does expect you to have your IT demonstrably in order.
To a large extent. ISO 27001 and the duty of care overlap on risk analysis, incident management, continuity, suppliers, access management and cryptography. But the Cbw has its own requirements: registration with the NCSC, fixed reporting deadlines to your CSIRT and supervisory authority, and knowledge and training for board members. An ISO 27001 certificate is therefore not proof that you comply with the Cbw. And your IT supplier's certificate covers that supplier, not your organisation. A gap analysis shows what is still missing.
If an essential entity breaches the duty of care or the reporting obligation, the fine can reach 10 million euro or 2% of total global annual turnover, whichever is higher. For an important entity that is 7 million euro or 1.4%. For other breaches the maximum is 1 million euro. A board member who does not meet the knowledge and training requirement can be fined personally up to 25,000 euro. If an essential entity does not carry out an imposed measure in time, the supervisory authority can ask the court to suspend board members.
You report a significant incident in stages to your CSIRT and your supervisory authority. First an early warning, as soon as possible and no later than 24 hours after you become aware of it. Within 72 hours a notification follows with an initial assessment of the severity and impact. No later than one month after that you submit a final report, or a progress report if the incident is still ongoing. We supply the technical information from the IT we manage. You submit the notification yourself as an organisation.
If the Cbw applies to you, you must have been registered in the national register since 15 August 2026. You do this at mijn.ncsc.nl, logged in with eHerkenning at level EH2+. You report changes to your details within two weeks.
We take over a lot of the work: the gap analysis, the technical measures in the IT we manage, monitoring and help with policies and documentation. You cannot outsource the responsibility. Registering, reporting and approving the measures remain tasks for your organisation and your board. How long it takes depends on where you stand now. You will see that after the gap analysis.
That depends on your size, your current IT and what still needs to be done after the gap analysis. The quickscan on this page is free. After that you receive a quote based on what is actually needed. Call 085 013 4500 or book a call.
Ready to get started?
Book a free consultation about the best ICT solution for your organisation.
Gerelateerde inzichten
