Is your organisation ready for NIS2 and ISO 27001?

Manufacturing: on top of the decree, the Regeling cyberbeveiliging EZK applies to the sectors listed in its article 2. Among other things it requires recovery times and recovery points for backups, patches within a reasonable time or a recorded reason, vulnerability scans, protection against malicious software and network segmentation. An incident is in any case significant when the continuity of the production process has been or can be put at risk.

Healthcare and medical devices: under the Cyberbeveiligingsregeling voor de zorg, your measures must demonstrably meet NEN 7510, or ISO 27001 and 27002, or an equivalent level. For you the ISO references below are therefore more than an aid. An incident is in any case significant when a critical business process is wholly or partly down for more than four hours.

Cloud, data centre and managed IT services: articles 6 to 18 of the Cyberbeveiligingsbesluit do not apply to you; the requirements in the annex of Implementing Regulation (EU) 2024/2690 do. The topics are the same as in this check, the requirements go further. Read the references to the decree below as a signpost, not as your legal basis.

• Scope and registration

  Every other duty hangs on this: the duty of care, the reporting duty and supervision apply to essential and important entities. An entity the Act applies to has to register itself; that has been mandatory since 15 August 2026.

  Yes means: the outcome (essential, important or out of scope) is on paper with the reasoning, and if the Act applies, the organisation is in the national register and someone keeps the details current.

  First step: Take the Cbw scope check, record the outcome with the reasoning and, if the Act applies, register the organisation through Mijn.NCSC.nl.

  How to find out: Ask your legal counsel or the company secretary: has it been assessed whether the Cybersecurity Act applies to us, where is that recorded, and are we in the register?

  Basis: Cbw art. 44(1) · Cbb art. 27 · NIS2 art. 3(4) · ISO 27001: 4.2, A.5.31

• Approval by the board

  The Act requires the board to approve the measures. Without a recorded decision you cannot show that the board is steering, and in practice the IT department ends up deciding on risks that affect the whole company.

  Yes means: there is a board decision approving the measures, and the board discusses the risks and the progress at fixed moments.

  First step: Put the risk picture and the plan of measures on the agenda of the next board meeting and record the decision in the minutes.

  How to find out: Ask the company secretary: in which meeting were the security measures approved, and where is that recorded?

  Basis: Cbw art. 24(1) · NIS2 art. 20(1) · ISO 27001: 5.1, 9.3

• Training and certificate for board members

  Every board member must personally be able to identify risks and assess measures, and show it with a certificate. The term is two years: until 15 August 2028 for anyone who was a board member on 15 August 2026, and two years after appointment for new board members.

  Yes means: every board member holds a certificate of a training on risks, risk management and the ten areas of measures in the Act, and demonstrably keeps that knowledge up to date.

  First step: Choose a training that covers the subjects in article 21 of the Cyberbeveiligingsbesluit, schedule it for the whole board and keep the certificates.

  How to find out: Ask HR or the company secretary: which board members have followed a training, and is there a certificate for each?

  Basis: Cbw art. 24(2) · Cbw art. 24(3) · Cbw art. 24(5) · Cbb art. 21 · Cbb art. 22 · NIS2 art. 20(2) · ISO 27001: 7.2

• Roles and responsibilities

  Without an owner, security stays something IT does on the side. The decree requires recorded roles, responsibilities and authorities, with conflicting roles separated as far as possible.

  Yes means: roles and authorities are on paper, one person is accountable (in-house or hired), has the time and the mandate and reports to the board, and whoever carries out the work does not check their own work.

  First step: Appoint one responsible person, record the mandate and the available time, and have that person report directly to the board.

  How to find out: Ask in the management team: who is responsible for information security here, how much time does that person have for it, and where is that recorded?

  Basis: Cbb art. 6(2) · Cbb art. 14(1) · NIS2 art. 21(2)(i) · ISO 27001: 5.3, A.5.2

• Testing and improving

  Measures on paper prove nothing. The decree requires a periodic evaluation of effectiveness, recorded in writing, and adjustment where needed. For ISO 27001 the internal audit and the management review must have taken place before you can be certified.

  Yes means: in the past year there was an internal audit or independent review, management assessed the results, and every improvement action has an owner and a date.

  First step: Plan an internal audit of the processes your services depend on, then put a management review on the agenda.

  How to find out: Ask your security officer or quality manager: when was the last internal audit, and what happened with the findings?

  Basis: Cbw art. 21(3)(f) · Cbb art. 18 · Regeling EZK art. 3 · NIS2 art. 21(2)(f) · ISO 27001: 9.2, 9.3, 10.1

• Risk analysis

  The Act asks for measures that are appropriate and proportionate. What is appropriate can only be justified with a risk analysis, and that is what a supervisor asks for during an inspection. In ISO 27001 audits it is also the part where something is most often missing.

  Yes means: the analysis is at most a year old, follows a fixed method with acceptance criteria, every risk has an owner and a treatment decision, and the board has accepted the risks that remain.

  First step: Map the biggest risks to your services in one working session, name an owner per risk and put the choices to the board.

  How to find out: Ask your IT manager or security officer for the risk overview: how old is it, who owns the biggest risks and what was decided about them?

  Basis: Cbw art. 21(3)(a) · Cbb art. 7 · NIS2 art. 21(2)(a) · ISO 27001: 6.1.2, 6.1.3, 8.2

• Security policy

  The decree requires an adopted policy that is laid down in writing and demonstrably applied, plus a management system that lets you show it. A policy nobody knows does not count.

  Yes means: the policy has been adopted by management, is on paper, says which parts of the organisation it covers, was reviewed in the past year, and staff know it and receive it when they start.

  First step: Write a policy of a few pages with goals, responsibilities and ground rules, have management adopt it and share it with everyone.

  How to find out: Ask HR: which security policy does a new employee receive, and when was it last reviewed?

  Basis: Cbw art. 21(3)(a) · Cbb art. 6(1) · Cbb art. 6(4) · NIS2 art. 21(2)(a) · ISO 27001: 5.2, A.5.1

• Overview of systems and data

  You cannot protect what you do not know: a forgotten system gets no updates and no monitoring. The decree requires a complete and current inventory, with a classification and rules for acceptable use.

  Yes means: there is one inventory, every system has an owner and a classification, cloud services and production systems (OT) are in it too, systems the vendor no longer supports are flagged, and the list is updated with every change.

  First step: Start with the systems your services depend on and everything that can be reached from the internet; add the rest per department afterwards.

  How to find out: Ask your IT administrator: is there one list of all systems and cloud services, who maintains it and is the production environment in it?

  Basis: Cbw art. 21(3)(i) · Cbb art. 16(4) · NIS2 art. 21(2)(i) · ISO 27001: A.5.9, A.5.12

• Suppliers and supply chain

  Your IT service provider often has more rights in your systems than your own people, and according to the Verizon Data Breach Investigations Report 2026 a third party is involved in about half of the data breaches investigated. The decree requires a supply chain policy and a periodic check that direct suppliers meet your security requirements.

  Yes means: you know which suppliers are critical, the requirements are in the contract (including reporting incidents to you), and in the past year it was checked that they meet them.

  First step: List the suppliers your services depend on and ask each for their certificate or audit report and their arrangements for reporting incidents.

  How to find out: Ask procurement or your IT manager: which security requirements are in the contract with our IT service provider, and when was it last checked that they meet them?

  Basis: Cbw art. 21(3)(d) · Cbb art. 10(2) · NIS2 art. 21(2)(d) · ISO 27001: A.5.19, A.5.20, A.5.22

• Multi-factor authentication (MFA)

  Stolen or weak passwords are, together with unpatched systems, among the most used ways in. MFA only helps when it is on everywhere: attackers look for the one account where it is missing. The Act names MFA explicitly.

  Yes means: MFA is enforced for every account that can sign in from outside (email, cloud, remote access) and for every administrator account, with no exceptions for directors, suppliers or legacy systems.

  First step: Ask for a list of all accounts without MFA and switch it on, starting with administrators, email and remote access.

  How to find out: Ask your IT administrator for a list of accounts without MFA, including administrators, suppliers and service accounts.

  Basis: Cbw art. 21(3)(j) · Cbb art. 15(1) · Regeling EZK art. 6(2) · NIS2 art. 21(2)(j) · ISO 27001: A.8.5, A.5.17

• Access rights

  Accounts of people who have left and rights that are too wide turn one hijacked account into a major incident. The decree requires a policy for issuing and withdrawing access and a periodic check that identities and authorisations are still necessary, correct and current.

  Yes means: access is requested and approved, ends on the last working day, administrators work with a separate account, and in the past year all rights were reviewed.

  First step: Put the list of active accounts next to the staff list, close what does not match and agree with HR that leaving always leads to withdrawal.

  How to find out: Ask your IT administrator: how many active accounts belong to people who no longer work here, and when were the rights last reviewed?

  Basis: Cbw art. 21(3)(i) · Cbb art. 15(2) · Cbb art. 15(3) · Regeling EZK art. 6(2) · NIS2 art. 21(2)(i) · ISO 27001: A.5.15, A.5.18, A.8.2

• Updates and vulnerabilities

  According to the Dutch national Cybersecurity Assessment 2026, most cyber attacks exploit vulnerabilities for which an update already existed, often in systems at the edge of the network such as VPNs and firewalls. The decree requires procedures for maintenance and management and a recorded assessment of targeted warnings. For manufacturers, the Regeling cyberbeveiliging EZK requires patches to be applied within a reasonable time, or the reason why not to be recorded.

  Yes means: there are deadlines per severity level, with priority for everything that can be reached from the internet, a report shows whether they are met, and warnings (for example from the NCSC) are assessed and recorded.

  First step: Agree a deadline for critical updates on everything that can be reached from the internet and ask for a monthly report of what is outstanding.

  How to find out: Ask your IT administrator or service provider: within how many days are critical updates installed, and may I see the latest report?

  Basis: Cbw art. 21(3)(e) · Cbb art. 11(3) · Cbb art. 17(1) · Regeling EZK art. 5(2) · Regeling EZK art. 5(3) · NIS2 art. 21(2)(e) · ISO 27001: A.8.8, A.8.9

• Network segmentation and access from outside

  In a flat network one infected workstation reaches everything: production, backups and management systems. Segmentation decides whether an incident stays within one department. The decree requires security requirements based on your risk analysis; for manufacturers, the Regeling cyberbeveiliging EZK explicitly prescribes segmentation into networks or zones.

  Yes means: office, production (OT), backups and administration are separated from each other, only what was opened on purpose can be reached from outside, and suppliers only get in through controlled access with MFA.

  First step: Have someone map what can be reached from the internet and which suppliers can get in remotely, close what is not needed and separate production and backups from the office network first.

  How to find out: Ask your IT administrator: can an infected office laptop reach the production systems and the backups, and what can be reached from the internet?

  Basis: Cbw art. 21(3)(g) · Cbb art. 7(5) · Cbb art. 11(3) · Regeling EZK art. 5(4) · NIS2 art. 21(2)(g) · ISO 27001: A.8.20, A.8.22, A.8.9

• Encryption

  A lost laptop without encryption gives access to everything on it. The decree requires a policy on cryptography: when you use it, which types of encryption, who implements it and who manages the keys.

  Yes means: encryption is on for all laptops and phones, there is a policy that says what else you encrypt and how, and it is clear who manages the keys.

  First step: Have someone check that disk encryption is on for all laptops and phones, and record on one page what you encrypt and who manages the keys.

  How to find out: Ask your IT administrator: on how many laptops is disk encryption off, and where are the recovery keys kept?

  Basis: Cbw art. 21(3)(h) · Cbb art. 13 · NIS2 art. 21(2)(h) · ISO 27001: A.8.24

• Awareness and training

  Phishing and deception target people. One training a year changes little; what counts is that people report something suspicious quickly and without embarrassment. The decree requires that staff know the risks and apply cyber hygiene, and that people in security roles are trained regularly.

  Yes means: everyone, including directors and contractors, gets a training when they start and at least yearly after that, people know how to report something suspicious, and whoever has a security role gets training that fits it.

  First step: Add a short training to the onboarding programme, repeat it for everyone and make reporting easy: one button or one address.

  How to find out: Ask HR: who followed a training in the past year, is it part of onboarding, and does everyone know where to report something suspicious?

  Basis: Cbw art. 21(3)(g) · Cbb art. 12 · NIS2 art. 21(2)(g) · ISO 27001: 7.3, A.6.3

• Logging and detection

  Without logging you only notice a break-in once the damage shows, and afterwards you cannot establish what was affected or what you have to report. The Dutch national Cybersecurity Assessment 2026 names deficient or absent logging and monitoring among the basic measures missing in successful attacks. The decree requires monitoring, logging with a retention period and protection of the logs.

  Yes means: sign-ins and administrator actions are logged, the logs are kept for a set period and protected against changes, detection runs on workstations and servers, and someone responds to alerts, also outside office hours.

  First step: Switch on logging for email, cloud, firewall and administrator access, set a retention period and agree who responds to alerts.

  How to find out: Ask your IT administrator: if someone breaks in tonight, who gets an alert, and how far back can we look?

  Basis: Cbw art. 21(3)(b) · Cbb art. 8(3) · Cbb art. 8(6) · Regeling EZK art. 5(3) · NIS2 art. 21(2)(b) · ISO 27001: A.8.15, A.8.16, A.8.7

• Incident handling

  During an incident there is no time to work out who is allowed to decide. The decree requires recorded roles and procedures for detecting, assessing, handling, documenting and reporting incidents, and for learning from them.

  Yes means: the procedure is on paper, can be reached when the systems are down, lists names and phone numbers, and was exercised or used in the past year and updated afterwards.

  First step: Put on one page who decides, who calls whom and which service provider you bring in, and keep a paper copy.

  How to find out: Ask your IT manager: where is the incident plan, and who takes the lead if things go wrong at the weekend?

  Basis: Cbw art. 21(3)(b) · Cbb art. 8(2) · Cbb art. 8(4) · NIS2 art. 21(2)(b) · ISO 27001: A.5.24, A.5.26, A.5.27

• Reporting duty: 24 hours, 72 hours, one month

  The clock runs from the moment you become aware of the incident: an early warning within 24 hours, a notification within 72 hours and a final report within one month. You only make that if it is settled beforehand who assesses and who reports.

  Yes means: it is laid down when an incident is significant for your sector, who assesses that, who makes the report and where, and who informs customers; this also works at night and at the weekend. The follow-up steps (notification within 72 hours, final report within one month) are in the procedure.

  First step: Record who assesses whether an incident is significant and who reports, put the reporting point in the incident plan and practise a report once.

  How to find out: Ask your security officer or IT manager: who makes the report within 24 hours here, and does that person know where and how?

  Basis: Cbw art. 26(1) · Cbw art. 27(1) · Cbw art. 29(1) · Cbw art. 30(1) · Cbb art. 24 · NIS2 art. 23(4) · ISO 27001: A.5.5, A.5.26

• Backups and restore test

  In a ransomware attack, backups that can be reached from the network are encrypted or wiped along with the rest. A copy the attacker cannot reach and a tested restore procedure decide whether you are down for days or for weeks. The decree requires you to verify the reliability of backups periodically.

  Yes means: there is a backup of all critical systems and data, at least one copy is offline or cannot be changed, and in the past year a full restore test succeeded, with a measured recovery time.

  First step: Have one critical system fully restored from the backup and measure how long it takes. Check that there is a copy that cannot be wiped from the network.

  How to find out: Ask your IT administrator or service provider: when was the last full restore test, and can ransomware reach our backups?

  Basis: Cbw art. 21(3)(c) · Cbb art. 9(2) · Regeling EZK art. 4(1) · NIS2 art. 21(2)(c) · ISO 27001: A.8.13

• Continuity and crisis management

  A backup is not a plan: who decides, in which order do you restart and how do you reach customers without email? The decree requires a continuity plan, a recovery plan and a crisis plan, each tested periodically; the crisis plan must also be practised.

  Yes means: there are a continuity plan, a recovery plan and a crisis plan on paper, they say which processes must come back first and how you communicate when email and telephony are down, and they were exercised in the past year.

  First step: Decide with the management team which three processes must come back first and within how much time, and spend one afternoon playing through a ransomware scenario.

  How to find out: Ask in the management team: if all systems are down tomorrow, which plan do we pick up, and when did we last exercise it?

  Basis: Cbw art. 21(3)(c) · Cbb art. 9(3) · Cbb art. 9(5) · Regeling EZK art. 4(2) · NIS2 art. 21(2)(c) · ISO 27001: A.5.29, A.5.30

This is an indication based on your own answers. It is not an audit, not a statement that you comply with the Cybersecurity Act or ISO 27001, and not legal advice. Providers of digital services, such as cloud, data centre and managed services, fall under the stricter requirements of Implementing Regulation (EU) 2024/2690. The text of the law on wetten.overheid.nl prevails.