De Cyber-beveiligingswet loopt. Loop jij mee?

The Dutch Cybersecurity Act (Cyberbeveiligingswet, Cbw) has applied since 15 August, with no transition period. Four obligations, and one question that stands out: can you show that you're working on it?

650+ organizations helped

Free one-hour consultation

Always a dedicated consultant (coach)

Route A: Je valt direct onder de wet: registratie-, zorg- en meldplicht

Lever je alleen áán zulke organisaties? Bekijk route B.

Waar sta je nu?

Three positions, with no definitive finish line. Pick yours and see your next step.

You're falling behind

You haven't started yet, and the temptation is to sprint: everything at once, in two weeks. That's exactly how you collapse. What does work is one step today: registering with the NCSC.

Your next step

Arrange your eHerkenning today
Register with the NCSC as soon as that's done
Appoint one owner, or it won't get done

You're catching up

You're registered and you've started implementing the requirements. There are just a few loose ends left, and loose ends have a habit of staying loose.

Your next step

List which parts are finished and which aren't
First tackle the loose ends that keep you from proving compliance
Record what you've arranged, or it won't count

You're ahead

By your own account, you've implemented everything. That's exactly where a second pair of eyes is worth it: someone who checks whether you've missed anything.

Your next step

Have an expert take a look
Check whether your evidence holds up when a regulator asks for it
Draw up an operational annual plan to keep monitoring everything continuously (because compliance has no finish line).

The route

Every organization runs the same course.

But not everyone has the same obligations. Open a part to see what the law asks and where it goes wrong in practice.

The form takes ten minutes. The eHerkenning you log in with takes weeks; that's the real hurdle.

Where it goes wrong: changes must be reported within two weeks. Almost everyone overlooks that deadline.

Assess risks

What could bring your organization to a standstill?

Not the risks from a template, but your own. This is the basis on which all the measures that follow are assessed.

Where it goes wrong: organizations start with measures. That's step three, and without step two you can never explain why your measure is appropriate.

Measures

Suited to those risks, not to a template

The law says 'appropriate measures' and deliberately leaves the details to you. What's appropriate for a hospital is nonsense for a twelve-person software company.

Where it goes wrong: not in the measures themselves, but in the reasoning for choosing exactly those.

Incident process

Who does what in the first hour

A process that works on paper isn't the same as a process you've actually tested.

Where it goes wrong: the first hours are spent reaching the right person. That's exactly the time you don't have.

Board

Training and responsibility that can't be delegated

The training obligation has applied since 15 August and can't be transferred. Liability extends to everyone who actually makes the decisions.

‍

Where it goes wrong: the board only hears about it once everything else is already under way. By then you're months down the line.

Suppliers

You're only as strong as your chain

You're responsible for security in your supply chain. That means asking your suppliers questions.

‍

Where it goes wrong: sending forty questions that nobody fills in. Six good questions get you further.

Evidence

Record what you've arranged

If it isn't written down, you haven't run it. This isn't a final step but something you keep up from part 01 onwards.
‍

Where it goes wrong: organizations rarely stumble over the measures. They stumble over recording them.

Split times

The times you need to hit

The clock doesn't start at the incident. It starts with you.

Iemand in je organisatie merkt iets. Vanaf nu loopt de klok.

+24 uur

Je meldt bij het NCSC dat er iets speelt. Ook als je nog niet weet wat.

+72 uur

De volledige melding: wat er is gebeurd, wat de impact is, wat je hebt gedaan.

+1 mnd

Het eindrapport.

What this asks of you is preparation. In practice, most of that first 24 hours is spent reaching the right people.

"The 24 hours aren't a problem if you know in advance what to do. Don't know? Then you're making it unnecessarily hard for yourself."

Kilian Houthuijzen
Commercial Manager & Partner

Becoming fully NIS2-compliant is the goal. Getting started is the first step.

The law has required you to comply since 15 August. If you can show something, you're in a different position from someone who has nothing.

You don't run a marathon at a sprint. Take the first step today!

From you to management

You see it.
‍Your management has to decide.

In almost every organization, IT spots this first and the decision is made somewhere else. Next to this is the summary in boardroom language. Copy it and pass it on.

Summary for management:

The Cbw has applied since 15 August 2026. There is no transition period.
Proposal: a free hour with a Fendix specialist.
The board is personally liable.
Regulators can impose fines of up to €10 million or 2% of worldwide turnover.
It's important that we can show we're taking action.

Tools & downloads

If it isn't written down, you haven't run it

Use these downloads to read up and prepare properly over the coming weeks. Don't worry, there's no obligation.

Available now

The NIS2 checklist

All the legal obligations in one place. So you know exactly where you comply, and where there's still work to do.

Download

NIS2 onepager for directors

One-pager with key information for directors who fall under the Cbw.

Download

Incident reporting procedure

In line with the Cbw: who has to do what, and when?

The most valuable tool is a one-hour conversation

You now know what needs to happen. What's still missing is where you stand, and one conversation makes that clear.

The role of Fendix

We're your coach for the race

Twee mannen spelen tafeltennis in een moderne kantoorruimte met anderen op de achtergrond.

From complex to crystal clear

We translate the requirements into a training plan that your organization understands and can carry out straight away.

A colleague, not an auditor

A dedicated coach who adapts to your culture and tools. Remote or in the office, via Teams or Slack.

Guaranteed results

You know where you stand, what the deadline is and what it costs. We don't stop running until it's demonstrably in order.

"This surely doesn't apply to us" and other misconceptions

"We already have ISO 27001, so we're done."

Not automatically, but it does give you a big head start. Large parts of your management system count towards it, which speeds up the route to demonstrable NIS2 compliance. Book a virtual coffee below to hear what's still missing.

"This doesn't apply to us."

If you don't fall directly under the law, you may still have to deal with it through the supply chain. NIS2-regulated organizations have to ask their suppliers to show that they work securely. If you can't, that will affect your contracts.

"There probably won't be much oversight."

There are ten competent regulators that monitor and enforce both proactively and reactively, depending on the type of entity you are (essential vs. important). Essential entities will be inspected, and then you have to be able to show that you've taken appropriate measures.

"Yes, but that law surely won't go ahead."

Outdated. The law has been in force since 15 August 2026. Its content hasn't been watered down and there's no transition period. As an organization that falls directly under it, you have to comply. You won't get a letter through the door.

"And what if we don't comply (yet)?"

Then you're taking a risk. Regulators can impose fines of up to €10 million or 2% of worldwide annual turnover, and directors are personally liable. But there's no need to panic straight away, because what matters now is that you can show you know where you stand and have made a start. That puts you in a fundamentally different position from someone who has nothing to show. That's exactly why it's high time to get moving and book a virtual coffee with us.