Dutch Cyber Security Act: being secure is not enough, you must be able to prove it

Since 15 August 2026, the Dutch Cyber Security Act (Cyberbeveiligingswet, Cbw) has applied in the Netherlands. It is the Dutch implementation of the European NIS2 Directive. According to the NCSC (the Dutch National Cyber Security Centre), more than 8,000 organisations fall under it. For them, cyber security is no longer a good intention. It is a legal obligation for which the board itself is responsible.

One thing is often underestimated: being secure is not enough. You must also be able to prove that you were. And not only today, but also on the day something went wrong.

As of 25 August 2026. This article is not legal advice.

Does the Cbw apply to your organisation?

The act applies to organisations in 18 sectors, including energy, transport, healthcare, drinking water, digital infrastructure, government, manufacturing and food. As a rule, it concerns medium-sized and large organisations: those with 50 or more employees, or with an annual turnover and a balance sheet total both above 10 million euros. Some organisations fall under it regardless of their size. The NCSC offers a self-check to find out whether and how the act applies to you.

If it does not apply to you, you will probably still have to deal with it. Organisations that do fall under the act must also secure their supply chain. So they will ask their suppliers about the state of their security.

What the act requires

The Cbw has three main obligations:

• Registration obligation: you register with the NCSC.
• Notification obligation: you report a significant incident within 24 hours (early warning), then within 72 hours (incident notification), and no later than one month after that with a final report.
• Duty of care: you take appropriate and proportionate measures to manage the risks to your network and information systems.

Article 21 of the act lists the topics that these measures must cover as a minimum. Several of them relate directly to your Microsoft 365 environment:

• access control policies and asset management
• where appropriate: multi-factor authentication and secured communication
• incident handling and business continuity, including backups
• supply chain security
• cyber hygiene and training
• policies and procedures to assess the effectiveness of the measures

That last point is important. The act does not only require you to take measures. It also requires you to keep assessing whether they work.

The board must act

The Cbw explicitly places responsibility with the board (article 24). The board approves the measures and oversees their implementation. Board members must have sufficient knowledge themselves to assess risks and measures. Within two years, they must have completed a training course with a certificate for this, and they must keep that knowledge up to date.

This has consequences. A board member who does not meet this knowledge and training obligation can receive an order subject to a penalty or a personal fine of up to €25,000. For breaching the duty of care or the notification obligation, the organisation itself risks a fine of up to €10 million or 2% of worldwide annual turnover for essential entities, and up to €7 million or 1.4% for important entities. For essential entities, the supervisory authority can even ask the court to suspend a board member for as long as a decision is not complied with.

Why proof matters so much

The supervisory authority has strong powers. It can have a security scan carried out, require you to have an independent expert investigate whether you comply with the act, and issue a binding instruction to take measures. For essential entities, the supervisory authority supervises in advance. For important entities, supervision usually takes place afterwards, following a signal or an incident.

And that is exactly when the question arises: what was the situation? If you report an incident, your final report must explain what happened, what the cause was and which measures were taken. An approved policy document does not answer that question. What counts is how the environment was actually configured at that moment.

A snapshot is not enough

Many organisations have an audit or scan carried out once a year. That gives a good picture of a single moment. But a Microsoft 365 environment changes every day: new admins are added, an MFA exception is made for a project, a guest gets access to a sensitive site, a policy is temporarily switched off and never switched back on.

An audit in March therefore says little about the situation in June. Suppose an account is taken over in June. The supervisory authority will then want to know whether MFA was enabled for that account on that day, since when there was an exception and who decided on it. You can only answer that if you have recorded it continuously.

With historical measurements, you can show:

• on 3 June the configuration was correct, measured against a recognised standard
• on 4 June something changed, and you received an alert about it
• on 5 June it was fixed, or the risk was consciously accepted with an owner, a reason and an end date

That is exactly what the act means by assessing the effectiveness of measures. It also shows that the board exercises oversight and makes conscious choices, instead of relying on a report from months ago.

Where Microsoft 365 comes in

For most organisations, Microsoft 365 is the heart of the digital workplace: identities, email, documents and devices all come together there. That also makes it one of the most important places to demonstrate your duty of care. Think of:

• Conditional Access and multi-factor authentication for all users
• the number and use of admin accounts
• guest access and sharing data outside the organisation
• email protection against phishing and spoofing
• devices that meet the security requirements before they can access data

There are recognised standards to measure this against, such as the CIS Microsoft 365 Foundations Benchmark, the CISA security baselines and Microsoft’s Zero Trust model.

First steps

1. Complete the NCSC self-check and register your organisation if the act applies to you.
2. Carry out a risk analysis and record which measures you take.
3. Involve the board: have it approve the measures and schedule the mandatory training.
4. Carry out a baseline measurement of your Microsoft 365 environment against a recognised standard.
5. After that, measure continuously and record the results, so that you can show at any moment what the situation was.

How we can help

With the Security Health Check, we measure the security of your Microsoft 365, Entra and Intune environment against the CIS benchmark, the CISA baselines and Zero Trust. With the continuous options, this happens every day, with a history you can always look back on, an alert whenever something gets worse, a risk register and audit evidence in plain language. This gives you audit evidence for your Microsoft environment that supports your duty of care under the Cbw.

The Health Check is not a full Cbw assessment of your organisation and is not legal advice. It covers the part of your duty of care that lies in your Microsoft environment, and for most organisations that is a large part.

Arrange an intro call or view the Security Health Check.

Sources

• Cyber Security Act (NIS2), NCSC
• Cyber Security Act and Critical Entities Resilience Act in force from today, Dutch government (Rijksoverheid) (15 August 2026)
• Cyber Security Act, wetten.overheid.nl: articles 21 (duty of care), 24 (board), 26 to 29 (notification deadlines), 70 to 78 (supervision), 80 and 87 (fines), 92 and 93 (board members)