Due to the European NIS2 directive, many more transport and haulage companies will have to take cybersecurity measures. Even companies that have not had to deal with cyber legislation before. Dutch legislation is in the pipeline that requires additional cyber resilience from companies that are important to our society and economy; the Cyber Security Act (Cbw). The Digital Trust Center (DTC), part of the Ministry of Economic Affairs and Climate, helps companies get started.
The law aims to strengthen cybersecurity at companies that operate in a critical sector where we cannot suffer downtime, such as in the transport, payment, internet or healthcare sectors. Besides requiring many more companies to take additional cybersecurity measures, there will also be an obligation to report cyber incidents. The Cbw will initially apply to medium- and large-sized companies and organisations operating in (very) critical sectors.
Size or scope
For a company operating in any of the above sectors, the new legislation usually only applies if the company is 'large' or 'medium' in size. Company size is defined by number of employees, annual turnover and balance sheet total.
For some industries, these size criteria do not apply. Providers of public electronic communication networks and services, trust service providers, top-level domain name registries, DNS service providers, domain registration service providers and government organisations are always subject to the Cbw, regardless of size.
For micro and small companies, the law will only apply if a trade minister designates them to do so based on a risk assessment. This may occur if it turns out that their services are crucial to the Dutch economy or society.
Suppliers and subcontractors also need to get started
Companies that do not meet the above criteria themselves may still be - indirectly - affected by this new cyber law. This is because the law requires Cbw companies to ensure that their supply chain is secure. If a chain inventory shows that a supplier has an impact on a Cbw company's network and information system, the Cbw company can demand additional security measures. Proportionality is important in these cross-chain arrangements.
Start at the NIS2 starting point
Companies covered by the Cbw will have to take various cybersecurity measures to protect their network and information systems. Taking these measures has several months lead time. Therefore, the Digital Trust Centre (DTC) advises to start doing so now.
To help all business owners prepare as effectively as possible for the introduction of this legislation, the DTC has compiled all currently available information on the NIS2 portal. Here you will find background information on the forthcoming legislation, as well as tools and checklists to help you get started as a business owner. You will also find guidance on the 10 due diligence measures set out in the European Directive. Until the details of the duty of care measures for the Netherlands have been set out in a general administrative order, the European NIS2 Directive provides sufficient guidance for preparatory actions to ensure Cbw compliance.
Questions?
Do you have any questions about the Cbw? Then join the DTC Community and subscribe to the NIS2 discussion forum. There, IT professionals, cybersecurity experts and business owners share knowledge and information on everything to do with the Cbw. Your question may also be answered in these 15 questions and answers about NIS2.
