Cybersecurity Act affects more organisations than expected
The initial results from the RDI self-assessment tool show that 58% of the organisations surveyed fall under the upcoming Cybersecurity Act (Cbw/NIS2). Within this group, 22% are classified as essential and 28% as important, which determines the level of supervision.
The law entails three core obligations for both categories:
🔹 Duty of care – implementing appropriate technical, organisational, and operational security measures, including risk management, audits, crisis plans, and supply chain security.
🔹 Registration requirement – registration in the national entity register via Mijn.NCSC.nl.
🔹 Reporting obligation – reporting significant cyber incidents to the competent CSIRT within 24 hours and informing affected customers.
The RDI supervises nine sectors, including energy, digital infrastructure, ICT services, government, digital providers, and the manufacturing industry.
The key message: do not wait for the formal implementation of the law, but start a risk analysis now and discuss the results at the board level. Early preparation increases digital resilience and prevents surprises once the law comes into force.
Read the DutchItLeaders article for more information.