NIS2 Compliance in Netherlands

NIS2 covers 18 sectors: Annex I (highly critical — energy, transport, banking, financial markets, health, water, digital infrastructure, ICT service management, public administration, space) and Annex II (other critical — postal services, waste management, chemicals, food, manufacturing, digital providers, research). Transposed via Cybersecurity Wet (Wbni amendment, 2024); NCSC-NL is the national CSIRT and sector-specific bodies act as competent authorities.

In Netherlands, the primary competent authority is NCSC-NL (Nationaal Cyber Security Centrum). The national CSIRT is NCSC-NL, which handles significant incident notifications and cybersecurity coordination.

Organisations must submit an early warning to NCSC-NL within 24 hours of a significant incident, a formal notification within 72 hours, and a final report within one month — per NIS2 Article 23.

Essential entities face fines up to €10 million or 2% of global annual turnover. Important entities face up to €7 million or 1.4% of global annual turnover. Exact enforcement varies by national transposition.