On 15 August 2026, the Dutch Cyber Security Act (Cyberbeveiligingswet, Cbw) entered into force. Today, 22 October, that is a little over two months ago. The first organisations have registered, regulators are organising their work and the first questions from customers and supply chain partners are coming in. A good moment for an interim review: not what the law says, which we have described before, but where your organisation stands right now.
Below you will find a self-check of ten yes/no questions, divided across the registration obligation, the duty of care, the reporting obligation and governance. After that, we look at what is still coming your way.
Two months on: three obligations, one question
The Cbw, the Dutch implementation of the European NIS2 Directive, affects an estimated 8,000 Dutch organisations in the essential and important sectors. For all of them, it comes down to the same three obligations: register, take care and report. Above those sits the board, which approves the measures and oversees them. Two months in, the question is not whether you are "done". The question is whether you have addressed each of these obligations and can show it.
Self-check part 1: registration obligation
The registration obligation is the most tangible of the three. Organisations covered by the law register in the entity register via Mijn.NCSC.nl, the portal of the NCSC (the Dutch National Cyber Security Centre), providing among other things their name, sector, contact details and, where applicable, IP ranges. This obligation has applied since 15 August 2026 and is enforceable: according to the RDI (the Dutch Authority for Digital Infrastructure), failing to register or registering incorrectly can result in a fine or an order subject to a penalty payment. Whether you fall under the law is your own assessment, for example using the government's NIS2 self-evaluation tool.
Self-check part 2: duty of care
The duty of care requires a risk analysis and, based on that, appropriate and proportionate measures. Think of policy, incident handling, business continuity, supply chain security, cryptography, multi-factor authentication and training. The board approves these measures. Two months in, the question is not whether you already comply with everything, but whether you know where you stand and whether that is substantiated.
Self-check part 3: reporting obligation
In the event of a significant incident, you submit an early warning to the CSIRT and the supervisory authority within 24 hours, an incident notification within 72 hours and a final report no later than one month after the first notification. Those deadlines are only achievable if it is clear in advance who does what. A procedure drawn up in August but never walked through is of little value when it matters.
Self-check part 4: governance
The Cbw places responsibility with the board. That is not a formality: the board approves the measures, oversees their implementation and must itself have sufficient knowledge.
Your score
Ten times yes does not mean you are finished, but it does mean you are in control. With seven to nine, you know exactly where attention needs to go in the coming months. With fewer than seven, it is wise to assign the open items now as concrete tasks with an owner and a deadline. The items where the answer is "actually yes, but not recorded" deserve priority: they do not count when a regulator asks.
What is still to come
How uComply helps
The CBW/NIS2 control framework developed by the NCSC, including the Cyber Security Decree, is available in uComply as a working set of standards. You convert the self-check above one-to-one into tasks: every question answered "no" or "not recorded" becomes an action with an owner and a deadline. For each measure you record the evidence, so you do not have to search when a regulator or customer asks. Measures you have already set up for ISO 27001 or NEN 7510 can be linked directly to the requirements of the Cbw, without duplicate work.
In the Flightdeck dashboard, the board sees the compliance score, open risks, findings and progress per standard, exactly the insight the law expects from board members. And with Reminders and scheduled tasks you monitor the reporting deadlines of 24 hours, 72 hours and one month, and schedule board training towards 15 August 2028 as a series, so nobody has to remember that deadline.
Summary
Two months after the Cyber Security Act entered into force, the question is no longer whether you need to do something, but what you can already show. Registration, duty of care, reporting obligation and governance: ten questions give you an honest picture. Turn the open items into tasks with an owner and a deadline, and you are ready for the request that will come sooner or later.
Would you like to see how to turn the self-check into demonstrable control in uComply? Book a no-obligation demo or view our pricing.
