Netherlands

(a) What is the NIS2 implementation status?

The Dutch legislator has published the draft Cybersecurity Act (Cyberbeveiligingswet – Cbw), which will transpose the NIS2 Directive into Dutch law. The public internet consultation on the draft Act closed on 2 July 2024. The draft introduces broader and stricter obligations for essential and important entities, such as implementing appropriate cybersecurity risk management, reporting ICT incidents, and assessing supply chain risks. It is currently being revised based on consultation feedback and the mandatory advice from the Advisory Division of the Council of State. After these steps, the bill may be submitted to the House of Representatives for parliamentary debate.

(b) What is the envisaged NIS2 implementation timeline?

The Dutch Ministry of Justice and Security has stated that the Netherlands will not meet the NIS2 implementation deadline of 17 October 2024. The delay is due to the involvement of multiple ministries, the technical complexity of the directive, and parallel work on the CER directive. As a result, the Cybersecurity Act is now expected to enter into force in the third quarter of 2025.

In the meantime, some NIS2 provisions may apply directly. For example, essential and important entities may be eligible for support from a Computer Security Incident Response Team (CSIRT). Entities already covered under the current Wbni will remain under that regime until the new Act takes effect. However, entities that fall within the expanded scope of NIS2 but are not currently covered by the Wbni will not be subject to NIS2 obligations during the interim period, nor can supervisory authorities enforce the directive until the new law is in place.

(c) What does the NIS2 mean for other national cybersecurity legislation?

The NIS2 Directive will replace the original NIS Directive, which was implemented in the Netherlands through the Network and Information Systems Security Act (Wbni) in 2018. Once the Cybersecurity Act (Cbw) enters into force, the Wbni will be repealed. Additionally, it is expected that supporting legislation – such as the Decree (Bbni) and the Ministerial Regulation (Regeling IenW) – will be amended to align with the updated obligations and expanded scope introduced by the NIS2 Directive.

(d) Who will be the supervisory authority and how are they preparing the market?

The Dutch Digital Infrastructure Authority (Rijksinspectie Digitale Infrastructuur; ‘RDI’) ensures the availability, continuity, and reliability of Dutch digital infrastructure. The RDI advises the Dutch legislator on laws and regulations, whilst ensuring independent and impartial enforcement and supervision. On 18 October 2023, the RDI launched its NIS2 self-assessment tool, which it developed in close coordination with relevant ministries and regulators for entrepreneurial Netherlands. Those who complete the self-assessment will know whether their organization falls under the scope of NIS2. It also helps to determine whether the organization is considered "essential" or "important" to the functioning of society and/or the economy according to NIS2. At the start of the consultation period (see above), the Dutch government will also announce action perspectives that can help organizations prepare for the upcoming Dutch legislation. Member states are required to support critical, essential and important entities in improving their resilience to digital threats. NIS2 also requires that essential and important entities are supported with advice and assistance by a CSIRT, the Dutch National Cyber Security Centre (NCSC). Further support from the government can further include information sharing, guidance and resilience enhancement tools, such as for conducting a risk assessment.

(e) What should you be doing/on the lookout for?

Despite the lack of legislation, the Dutch ministry advises companies to prepare for the law in the meantime by explaining the current Wbni in a NIS2-compliant manner. For example, companies can already carry out risk analyzes, make staff aware and tighten incident procedures.

Essential entities, important entities and entities providing domain name registration services can register with the NCSC on a voluntary basis from 17 October 2024. This registration will only be mandatory after the Cyber Security Service comes into effect. In order to ensure that entities can easily provide and manage the information for registration, the government has opted to set up a central registration functionality at the NCSC. It is also possible to voluntarily report incidents in this registration portal.

Furthermore, organizations potentially in scope of NIS2, should already seek consultation with their legal advisors in order to:

• identify the scope of application of NIS2 to their business;
• start compiling action- and checklists tailored to the business;
• get the management and relevant staff trained and educated about NIS2 requirements;
• perform risk analysis to identify any gaps in compliance.