NIS2 & the Dutch Cybersecurity Act | Duty of care and reporting | Newblend
Newblend Book an introduction
Legislation

NIS2 & the Cybersecurity Act

NIS2 is a European directive that each country has transposed into national law. In the Netherlands that is the Cybersecurity Act, which takes effect on 15 August 2026. The core: you assess your own risks, take appropriate measures, report incidents and can demonstrate all of it.

In short
  • The Dutch Cybersecurity Act takes effect on 15 August 2026; in Belgium the transposition came earlier, with mandatory registration at the CCB.
  • Duty of care: assess your own risks and take appropriate measures.
  • Reporting duty: early warning within 24 hours, incident report within 72 hours, final report within a month.
  • Responsibility sits with the board, not with the IT supplier.
  • If you are not in scope yourself, customers will pass the requirements on to you contractually.
Last updated: 5 August 2026
The three core obligations

What the law asks of you

Duty of care

You assess your own risks and take appropriate measures: access management, multi-factor authentication, backup and recovery, patch management, monitoring, supplier management, awareness and a tested incident process.

Reporting duty

A significant incident requires an early warning within 24 hours, a fuller report within 72 hours and a final report within a month. You only make that with a process that is in place beforehand.

Board accountability

Directors must understand the risks and be able to show that oversight exists. Outsourcing to an IT provider does not shift that responsibility.

Scope

Are you in scope?

It depends on sector and size. These are the broad lines; the check on this site walks you through the criteria.

Table. Broad classification.
SituationDoes the law applyWhat you do
Designated sector, from roughly 50 staff or 10 million euro turnoverYes, directlyBaseline assessment, action plan and incident process
Designated sector, smallerSometimes, depending on your role in the chainTest your position; record your measures anyway
Outside the designated sectorsNo, not directlyExpect questionnaires and contract clauses from customers who are in scope
Supplier to an organisation that is in scopeIndirectlyBe able to demonstrate what you have arranged, preferably with a certificate
Belgium

The Belgian transposition took effect earlier and requires registration with the Centre for Cybersecurity Belgium. If you operate in both countries, we apply the strictest requirement in the action plan.

Process

From baseline assessment to demonstrably in control

  1. STEP 01
    Baseline assessment

    Define the scope, inventory current measures and test them against the requirements. You get insight into your risks and the gap to the requirements.

  2. STEP 02
    Action plan

    Technical and organisational measures with an owner, costs and planning, plus the rationale for each measure.

  3. STEP 03
    Implementation

    Set up the technology, record the policy, start awareness training. Working measures plus the matching documentation.

  4. STEP 04
    Incident process

    Record roles, contacts and reporting deadlines, and test the procedure. So that 24 and 72 hours are achievable.

  5. STEP 05
    Keeping it current

    Periodic reporting and reassessment of risks. Staying in control, including during audits and customer reviews.

Frequently asked questions

What counts as a significant incident?

In short: an incident with substantial consequences for your service, for example prolonged downtime or a high-impact data breach. In the incident process we record in advance who makes that judgement, so it is not up for debate during a crisis.

Does ISO 27001 make us automatically NIS2 compliant?

No, but it saves a lot of work. ISO 27001 covers a large part of the measures and provides the management process the law expects. The additional points are in the reporting duty, the supply chain and board accountability.

What does a NIS2 project cost?

That depends on where you start. We do the baseline assessment for a fixed price; after that you know which measures are needed and what they cost. Many measures are already part of the blends.

Can you file the reports for us?

We help determine whether to report and what it should say, and supply the technical evidence. Filing itself remains the organisation's responsibility.

Read on

Do you know where you stand?

The NIS2 check takes two minutes and shows which obligations apply to you and where the biggest gaps are.