Cybersecurity incident reporting: what must you report and when?

Under the Dutch Cybersecurity Act (Cyberbeveiligingswet, Cbw), an organisation that falls under the Act must report a significant incident to the National Cyber Security Centre (NCSC) within 24 hours, follow up within 72 hours and file a final report within one month. The main exception is the financial sector: banks and insurers report major ICT incidents under DORA to De Nederlandsche Bank or the AFM instead.

The Cbw entered into force on 15 August 2026. It implements the EU NIS2 Directive and replaced the Network and Information Systems Security Act (Wet beveiliging netwerk- en informatiesystemen, Wbni). Our wider guide to NIS2 and the Dutch Cybersecurity Act covers the duty of care; this article deals with the reporting duty.

Which organisations must report incidents?

The reporting duty applies to essential and important entities in eighteen sectors. Size usually decides whether you are in or out: large and medium-sized organisations in a listed sector are covered, smaller ones usually are not.

Essential sectors include energy, transport, banking, health, drinking water, digital infrastructure, ICT service management and public administration. Important sectors include postal services, waste management, chemicals, food, the manufacture of medical devices, computers and vehicles, and digital providers such as online marketplaces and search engines.

Some providers fall under the Act regardless of size, such as DNS service providers, top-level domain registries, trust service providers and providers of public electronic communications networks. Whether you are essential or important does not change the reporting deadlines. It changes the intensity of supervision and the maximum fine.

Do you need to register before you can report?

Yes. Every organisation under the Cbw must register in the national entity register kept by the NCSC, with its sector, contact details for incidents and its internet domain names.

The register is how the NCSC, the sector CSIRT and the supervisor know who you are, and reporting through the NCSC portal assumes you are in it. Changes to the registered details must be passed on. The Act also puts responsibility at board level: the management body approves the risk-management measures, is accountable for compliance and must follow cybersecurity training. For the criminal-law side of cybersecurity, see our note on the Cybercrime III Act and our overview of the compliance frameworks a Dutch business has to reckon with.

When is an incident significant enough to report?

An incident is significant when it causes, or can cause, serious disruption of your services or financial loss, or considerable material or non-material damage to others. The clock starts when you become aware of it, not when your investigation is finished.

The Cbw itself uses an open standard; sector-specific ministerial regulations set more detailed thresholds. Relevant factors are how long a service was unavailable and for how many users, whether data was accessed or altered, whether effects reach other EU member states, and whether services to other essential or important entities are disrupted. A cloud provider whose outage disrupts a hospital reports on the basis of that disruption, not only its own loss.

Write down your own threshold before anything happens. A short internal classification standard, applied consistently, helps your team decide within hours and shows the supervisor afterwards why an incident was or was not reported.

Which reports are due, and when?

The duty has three stages: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month of the notification. Each stage asks for more detail than the last.

• Early warning (24 hours): whether the incident is suspected to be caused by unlawful or malicious acts and whether it may have cross-border effects.
• Incident notification (72 hours): an update with an initial assessment of severity and impact and, where available, indicators of compromise.
• Final report (one month): a detailed description, the root cause, the measures taken and any cross-border impact. If the incident is still ongoing, you file a progress report first and the final report within one month after handling the incident.

Trust service providers must file the incident notification within 24 hours instead of 72. Where a significant incident affects the recipients of your service, you must also inform them without undue delay and, where relevant, tell them which measures they can take themselves.

Who receives your report?

You report through the NCSC portal. From there the report goes automatically to the CSIRT for your sector and to your sector supervisor.

Supervision remains sectoral. The Dutch Authority for Digital Infrastructure (Rijksinspectie Digitale Infrastructuur, RDI) supervises digital infrastructure and digital providers, the Health and Youth Care Inspectorate (IGJ) covers health care, and De Nederlandsche Bank and the AFM cover the financial sector. Record your supervisor’s contact details in your incident plan in advance.

How does the Cbw relate to the GDPR and DORA?

One incident can trigger several reporting duties, each with its own authority and threshold. Map them before an incident happens.

If personal data is involved, Article 33 of the GDPR requires you to notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours, unless the breach is unlikely to result in a risk to individuals. Under Article 34 GDPR you must also inform the people concerned if the risk to them is high. Where the incident occurred at a processor, the data processing agreement decides who notifies whom; our guide to the General Data Protection Regulation explains the details.

Financial entities report major ICT incidents under the Digital Operational Resilience Act (DORA) to De Nederlandsche Bank or the AFM, and do not report the same incident again under the Cbw. Organisations designated as critical entities under the Critical Entities Resilience Act (Wet weerbaarheid kritieke entiteiten, Wwke), which also entered into force on 15 August 2026, must report incidents causing significant disruption within 24 hours under that Act.

What happens if you report late or not at all?

Supervisors can demand information, order an audit, give binding instructions, impose an order subject to a penalty (last onder dwangsom) and impose an administrative fine. NIS2 requires maximum fines of at least €10 million or 2% of worldwide annual turnover for essential entities, and at least €7 million or 1.4% for important entities.

The exact Dutch maxima are laid down in the Cbw. For essential entities a supervisor can, as a last resort, also suspend an authorisation or temporarily bar a person from management functions. A late report can also weaken your position in disputes with customers; our note on the legal responsibilities of directors and companies explains where that exposure lies.

How do you build a procedure that works in a real incident?

Deadlines of 24 and 72 hours are only met if you decided in advance who does what. Name the person who assesses the incident, the person who approves the report, the person who files it and the person who keeps contact with the NCSC, each with a deputy.

Prepare templates for all three reports and keep them available offline. The early warning template needs the time of detection, the type of incident, the systems affected, suspected malicious activity, possible cross-border effects and a contact person. Run a tabletop exercise at least once a year to test the workflow from detection to final report.

Many reportable incidents start at a supplier. Your cloud or supplier contract should oblige the supplier to inform you promptly and to give you the technical information you need for your own 24-hour report. That fits within the wider due diligence obligations that run through the supply chain.

What should you check as an organisation under the Cbw?

• Whether you are an essential or important entity, and whether you are registered with the NCSC.
• Whether you have a written threshold for a significant incident that matches the ministerial regulation for your sector.
• Whether a named person and deputy can file an early warning within 24 hours, also at night and at weekends.
• Which other duties apply: GDPR (72 hours to the Autoriteit Persoonsgegevens), DORA or the Wwke.
• Whether your board has approved the risk-management measures and followed the required training.

What should you check as an ICT supplier?

• Whether you fall under the Cbw yourself, for example as a cloud, data centre or managed service provider.
• Which notification deadlines you have agreed with customers that are essential or important entities.
• Whether you can deliver the technical information your customers need within their 24- and 72-hour deadlines.
• Whether your contracts set out who informs end users when an incident affects them.

What can we do for you with cybersecurity incident reporting?

Our IT lawyers and our regulatory compliance practice help you before, during and after an incident.

• We assess whether your organisation falls under the Cbw and as which type of entity.
• We draft your incident classification standard and the templates for the three reports.
• We review your early warning or incident notification before you file it with the NCSC.
• We align the Cbw report with your GDPR notification to the Autoriteit Persoonsgegevens.
• We draft or review notification clauses in your cloud and supplier contracts.
• We handle the correspondence with the supervisor after a report.

Summary

• The Cbw has applied since 15 August 2026 and replaces the Wbni.
• Significant incidents are reported through the NCSC: early warning within 24 hours, notification within 72 hours, final report within one month.
• Registration in the NCSC entity register comes first.
• GDPR, DORA and the Wwke can impose parallel duties with their own deadlines.
• A written threshold, named roles and ready templates are what make the deadlines achievable.

Frequently asked questions