The Dutch Cybersecurity Act (Cyberbeveiligingswet, Cbw) has been in force since 15 August this year, and the first figures show that half of the target group was missing from the entity register on day one: 2,942 direct registrations out of an estimated 8,000 to 10,000 organisations. The Dutch Authority for Digital Infrastructure (Rijksinspectie Digitale Infrastructuur, RDI), the supervisory authority for the ICT service management sector, has now explained how it will approach the first year. Essential entities will face proactive supervision with questionnaires and visits; important entities will mainly be examined after the fact, following an incident. For MSPs, that split is the most important news of the past two months, because it determines whether the inspectorate turns up of its own accord or only after a reported outage at a client. The sector’s own self-assessments reveal where things are likely to pinch: the reporting procedure, board training and supply chain risks. This article sets out what the first registrations and the RDI’s supervision teach an MSP, and what to put in place over the coming months to get through the first information request or incident report without panic.
In this article:
Less than half are on the register
How the RDI is approaching the first year
Essential or important: for an MSP, that makes all the difference
Where the sector gives itself the lowest scores
The reporting obligation is the first real test
What to sort out as an MSP in the coming months
On 13 August, the evening before the Act came into force, the Dutch NCSC’s Cbw entity register held 2,942 registrations. Including affiliated organisations – subsidiaries and sister companies that are formally independent but fall under the same control – the count reached 4,144. Against that stands a target group that the government itself estimates at 8,000 to 10,000 organisations across eighteen sectors. Dutch financial daily Het Financieele Dagblad (FD) reported around 3,200 direct registrations shortly after 15 August. The NCSC has not published more recent figures since.
Less than half are on the register
Figure 1. Registrations in the Cbw entity register on 13 August 2026 compared with the estimated size of the target group. Source: NCSC via Computable and Telecompaper, Dutch central government (Rijksoverheid).
The backlog did shrink in August: in the first thirteen working days of that month, 653 registrations were added, more than in the whole of July. Organisations that had already prepared for NIS2 in 2025 had long been on the register. The group now coming in consists largely of companies that only started working out whether the Act applies to them after its adoption by the Dutch Senate on 7 July, in the middle of the summer holidays. NCSC spokesperson Roger Kaemingk told Dutch IT publication Computable that the customer contact centre regularly receives questions about complex business models and foreign companies without a Dutch Chamber of Commerce (KvK) number. These are not exceptions in the MSP market, where group structures with dozens of operating companies and foreign branches have become the norm.
For MSPs, there is one reassurance and one pitfall. The reassurance: providers of managed ICT services and managed security services in principle only register in the member state where their main establishment is located, even if they operate in several countries. Other types of organisation must register separately in each country. The pitfall: affiliated companies count towards size. A 30-person MSP that is part of a platform with 1,500 employees falls under the Act, and if the platform has not arranged registration for its subsidiaries, that MSP is missing from the register. If you are part of a group, the first question is therefore who carried out the registration and whether your operating company is listed in it as an affiliated organisation.
How the RDI is approaching the first year
The RDI supervises nine sectors, including ICT service management, digital infrastructure and digital providers. The inspectorate has explained what its supervision looks like on its website and in a presentation to the sector in early September. At its core is a funnel that starts with information and introductions and only arrives at inspection and enforcement at the very end. That first stage is under way now: the RDI is getting to know the sectors through questionnaires and conversations, formal or informal, and building a picture of who is under supervision and how they are faring.
Three types of inspection follow. Regular inspections are scheduled on the basis of risk and impact, for example what a network outage at a company means for citizens and other organisations. The RDI then looks at how cybersecurity and IT operations are organised, at risk management and at the measures taken, and gathers that information through questionnaires, documents, interviews or on-site inspection. Thematic inspections focus on a single topic within a sector, such as data handling, and may be prompted by current events. Post-incident inspections follow a significant incident reported to the CSIRT: the RDI can then investigate how it happened and whether recurrence has been prevented. If the inspectorate requests information, you are obliged to cooperate; inspectors may request documents, enter premises and examine processes.
The RDI is deliberately reticent about the substantive standards it applies. Organisations may choose the measures that suit their risks, and the inspectorate looks mainly at how risk management and board-level governance are organised. NOREA, the Dutch professional association of IT auditors, warned in September that organisations therefore run the risk of setting up a separate Cbw compliance stream alongside their existing reporting, and recommends a single coherent board-level view of digital risks as the basis for accountability. For an MSP that already has ISO 27001 or a comparable management system, that is good news: the existing risk assessment, statement of applicability and management review are the documents an inspector wants to see, provided they are up to date and the board has demonstrably approved them.
Essential or important: for an MSP, that makes all the difference
The Act imposes the same basic obligations on essential and important entities, but supervision differs fundamentally. With essential entities, the RDI works proactively: it requests information and visits without anything having happened. With important entities, supervision mainly takes place after the fact, usually following an incident. The fines also differ: up to €10 million or 2 per cent of worldwide annual turnover for essential entities, and up to €7 million or 1.4 per cent for important ones.
Figure 2. Outcome of 22,800 fully completed self-assessments in the RDI tool, January 2023 to September 2025. Source: RDI via Dutch IT Channel.
Which of the two you are depends on your size. ICT service management is a sector of high criticality, and in those sectors large enterprises (from 250 employees, or with turnover above €50 million and a balance sheet total above €43 million) are essential and medium-sized enterprises are important. For the MSP market, that means a sharp dividing line. The consolidation platforms with hundreds to thousands of employees are essential entities and will receive inspection visits unprompted. The independent MSP with 50 to 250 staff is an important entity and will in principle only see the RDI after a reported incident. Of the 22,800 self-assessments the RDI processed up to the end of September 2025, 22 per cent came out as essential and 28 per cent as important. The self-assessment is not a legal decision, incidentally: you determine yourself whether the Act applies to you, and the inspectorate may take a different view later.
As an important entity, it is tempting to conclude that little will happen for now. That is true for direct supervision. For the supply chain, it is a different story. The essential entities that do face proactive supervision must show the RDI how they manage the risks in their supply chain, and for a hospital, an energy company or a municipality, the MSP is one of the biggest risks in that chain. Those clients will be asking questions over the coming months about MFA, logging, backups, patch policy and reporting deadlines, because the inspectorate is asking them. Cindy Wubben of Visma predicted in Computable an effect similar to that of the GDPR: through supply chain responsibility, companies that do not themselves fall under the Act will still end up meeting its requirements. In practice, an MSP with a municipality as a client thus gets proactive supervision by the back door.
Where the sector gives itself the lowest scores
In the spring, the RDI published the results of the NIS2 quickscan for the ICT service management sector, an anonymous self-assessment completed in full 1,480 times between February 2024 and September 2025. The sector gives itself the highest scores for incident handling, authentication and secure communication, and for rapidly sharing measures against threats. That is an MSP’s day-to-day work, and it is not surprising that the sector feels confident about it.
The lowest scores are in three areas: setting up a reporting procedure for significant incidents, training all board members, and mitigating supply chain risks. All three concern the role of the director rather than that of the engineer. The Act makes all board members ultimately responsible for governance and risk management, including cybersecurity, and requires them to undergo training. They have until August 2028 to do so, but the Cyberbeveiligingsbesluit, the decree implementing the Act, requires a certificate per director covering at least thirteen topics, and an awareness session with a certificate of attendance does not count. Christian Boertje of Boem Cybersecurity pointed out the mechanism behind this in Computable: a director can delegate execution but not responsibility, and the regulator can hold them personally accountable. His advice is to record decisions about risks with a date, a rationale and a name. An inspector who visits after an incident asks four questions: did you know the risks, was management aware of them, was a deliberate choice made about which risks to address, and were earlier warnings heeded? You want to be able to show a dated document for all four.
The supply chain score deserves separate attention, because an MSP is part of the chain in two directions. Upstream, you rely on Microsoft, an RMM supplier, a backup vendor and a distributor, and the Act expects you to have assessed the cybersecurity risks of those parties before choosing them and to keep monitoring them. Downstream, you are yourself the supplier being assessed by clients. An MSP that has its own supplier assessment in order can show those clients how it should be done, and that makes for a better sales conversation than sending back a completed questionnaire.
The reporting obligation is the first real test
The reporting obligation is tiered. Within 24 hours of discovering a significant incident, an early warning goes to the CSIRT and the regulator; within 72 hours, an incident notification follows setting out severity and impact; and within a month, a final report with the full analysis and the improvement actions taken. Affected clients must also be informed immediately. That final report is the document on which the RDI decides whether to launch a post-incident inspection.
Figure 3. The three reporting deadlines and the point at which the RDI can decide on a post-incident inspection. Source: RDI, Cyberbeveiligingswet.
For an MSP, those 24 hours are more complicated than for an ordinary company, because an incident at the MSP is almost always also an incident at one or more clients. A ransomware attack on the RMM, a compromised admin account or an outage in the MSP’s own data centre affects clients that themselves fall under the Act and must therefore report within 24 hours themselves. If the contract does not specify who reports, within what timeframe the MSP informs the client and how escalation works outside office hours, the clocks start at different moments for everyone involved and nobody reports on time. The quickscan shows that this very procedure is the least well organised in the sector.
The PHP vulnerabilities of 21 October are a good test case against which to check that procedure. Two vulnerabilities allow remote code execution in virtually all PHP versions, a public proof of concept exists, and pending the patch, the NCSC, the Dutch House of Representatives and parts of SURF, the Dutch education and research IT cooperative, took their websites offline as a precaution. For an MSP with dozens of client websites and portals running on PHP, this is the moment when you need to be able to demonstrate that you knew which systems were vulnerable, that you informed the client and that you rolled out the patch within a reasonable time. If a web server is taken over in two weeks’ time after all, that is the file the inspector will ask for.
What to sort out as an MSP in the coming months
Five things to sort out as an MSP before the end of the year
1. Check the registration, including within a group. Is your operating company listed in the register as an affiliated organisation, are the IP ranges and the contact person correct, and has someone been appointed to report changes within two weeks?
2. Determine for each client whether they are essential or important, and set out the reporting arrangements in the contract: who reports, when the MSP informs the client and how escalation works outside office hours. Rehearse this with a tabletop exercise.
3. Schedule the board training now, with a certificate per director, and record when the board approved the risk assessment and the residual risks.
4. Turn your ISO 27001 file into your Cbw file. The risk assessment, statement of applicability, supplier assessment and management review are the documents the RDI wants to see. Date them and keep them up to date.
5. Write the client questionnaire you are going to receive anyway yourself, as a standard document covering MFA, logging, backup and recovery testing, patch policy and reporting deadlines. It saves work and shows that you understand the supply chain.
Sources (links open in a new tab): Computable, Half of organisations miss Cyberbeveiligingswet registration deadline (14 August 2026); Accountant.nl, Cyberbeveiligingswet in force, but thousands of organisations still missing from register (August 2026); Telecompaper, Less than half of organisations registered for Cyberbeveiligingswet (17 August 2026); RDI, The Cyberbeveiligingswet enters into force (15 August 2026); RDI, RDI supervision of the Cyberbeveiligingswet; RDI, Cyberbeveiligingswet registration obligation; RDI, NIS2 quickscan results for the ICT service management sector; Dutch IT Channel, RDI shares impact of Cyberbeveiligingswet (self-assessment tool results); NOREA, Cyberbeveiligingswet under supervision: avoid a new layer of accountability (September 2026); Techzine, Government to proactively supervise cloud providers from 2026; IB&P, What directors need to know about cyber risks (1 October 2026); Rijksoverheid, NCSC: serious vulnerabilities in PHP (21 October 2026); Dutch IT Leaders, Several websites offline due to critical vulnerabilities in PHP (21 October 2026).
This article was originally published in Dutch on MSP Business. Read the original →
