Government organisations must already comply with the Baseline Information Security for Government (BIO). Its revised version, BIO2, largely fulfils the duty of care outlined in the Cyberbeveiligingswet (Cbw), which is the Dutch adaptation of the NIS2 Directive, for the public sector.
Ensuring compliance with established government information security frameworks, such as BIO2, is crucial. The BIO has been updated alongside the Cbw to produce BIO2, which aligns with the Cbw’s principles, particularly in implementing effective risk management.
Tips for non-public sector organisations
For other obligations, additional guidance to help organisations prepare for the Cbw is available on other websites:
- For instance, the FAQs on the National Cyber Security Centre’s website (Dutch)
- Resources and services on the Centre for Information Security and Privacy’s website (Dutch)
- As well as our Tools and resources page (Dutch)
Enactment of the Cyberbeveiligingswet
The Senate approved the Cyberbeveiligingswet (Cbw) and the Critical Entities Resilience Act (Wet weerbaarheid kritieke entiteiten, or Wwke) on 7 July 2026. Both acts entered into force on 15 August 2026.
