For a long time, it was "soon". Now the time has come. On July 7, 2026, the Dutch Senate approved the Cybersecurity Act (Cbw), and since August 15, 2026, the law is in effect. This means that the European NIS2 rules now officially apply in the Netherlands.

Over 8,000 Dutch organizations now have new obligations. Many of them are medium-sized and have had little to do with cyber legislation until now. In this article, you will read whether you are affected and what you need to do concretely.

What is the Cybersecurity Act?

The Cybersecurity Act is the Dutch implementation of the European NIS2 directive. It replaces the older Network and Information Systems Security Act (Wbni). The goal: organizations that are important to society must have their digital resilience in order and report incidents quickly.

Along with the Cbw, the Critical Entities Resilience Act (Wwke) came into effect. It addresses physical resilience, such as power outages or sabotage. In this article, we focus on the Cbw. Want to read the background of NIS2 first? Check out NIS2 and Microsoft 365.

Does your organization fall under it?

The law distinguishes between essential and important entities. Whether you fall under it depends on two things:

  • Your sector. Think of energy, transport, healthcare, drinking water, digital infrastructure, government, waste management, food, chemicals, manufacturing, post, and digital service providers like cloud and managed service providers.
  • Your size. Generally, you fall under it from 50 employees or more than 10 million euros in annual revenue. For some organizations, like certain digital service providers, the law applies regardless of size.

Unsure? The NCSC has a self-evaluation tool on its website. Take it seriously: the responsibility to determine if you are affected lies with you.

The four obligations in brief

1. Register

Organizations that fall under the law must register. This way, the regulator knows who falls under the law and the NCSC can reach you if there is a threat.

2. Duty of care

You must take appropriate measures to secure your network and information systems. This involves risk analysis, access management, MFA, encryption, backups, business continuity, supplier security, and employee awareness.

3. Notification obligation

You must quickly report a significant incident. An initial warning follows within 24 hours, a more detailed report within 72 hours, and a final report within a month. This is only possible if you actually detect incidents.

4. Director responsibility

The board must approve the measures, monitor compliance, and undergo training themselves. Cybersecurity is no longer solely an IT issue. Directors can be held personally accountable.

What should you do concretely now?

  1. Determine if you are affected and as what type of entity. Document this consideration.
  2. Register if you have not already done so.
  3. Appoint an owner on the board and a responsible person in the organization.
  4. Conduct a risk analysis. What are your crown jewels, and what happens if those systems fail?
  5. Ensure the basics. MFA for everyone, managed devices, backups you can actually restore.
  6. Establish a reporting process. Who decides if an incident is significant? Who reports, and where?
  7. Consider your suppliers. Your IT partner and cloud services are part of your chain.
  8. Train your board and employees.

How Microsoft 365 helps you

Microsoft 365 does not automatically make you compliant. But it contains many of the building blocks that the duty of care requires:

  • Microsoft Entra: MFA, conditional access, and management of admin rights. Also, read MFA and conditional access.
  • Intune: devices that are encrypted, updated, and managed.
  • Microsoft Defender: detecting attacks on email, devices, and identities. Essential for the notification obligation.
  • Microsoft Purview: labeling and protecting sensitive information.
  • Backup: a separate backup of your Microsoft 365 data. Why that's necessary, read Is your Microsoft 365 data backed up?.

Many of these tools are already included in licenses like Microsoft 365 Business Premium or E5. It's likely that you are already paying for them but not fully utilizing them.

And in Belgium?

Belgium already implemented NIS2 earlier. The NIS2 law has been in effect since October 18, 2024, with the Cybersecurity Belgium Center (CCB) as the regulator. Are you operating in both countries? Then you have to deal with both regimes. The measures largely overlap.

Start with a baseline assessment

The law doesn't demand perfection on day one, but it does require demonstrable steps. A baseline assessment of your Microsoft 365 environment quickly shows where you stand and what the first priorities are. Want to know where you stand? Contact 365 Angels. We'd be happy to assist you.

Note: this article is a practical summary, not legal advice. For your specific situation, consult the regulator in your sector or the NCSC.