Skip to main content
Deep dive

When must you report a cyber incident under the Cyberbeveiligingswet, and to whom?

When it seriously disrupts your services, causes you financial loss, or causes others considerable damage. Send an early warning within 24 hours of becoming aware, a notification within 72 hours and a final report within one month, through the NCSC's meldpunt on mijn.ncsc.nl, which forwards mandatory reports to your supervisor.

4 min read

When must you report a cyber incident under the Cyberbeveiligingswet, and to whom?

When it is a significant incident: one that causes, or can cause, serious disruption of your services or financial loss for you, or considerable material or non-material damage to others (Article 25(2) of the Cyberbeveiligingswet). The clock starts when you become aware of it. An early warning is due within 24 hours, a notification within 72 hours and a final report within one month.

You file once.

The report goes to the NCSC's central meldpunt on mijn.ncsc.nl, and according to the NCSC a mandatory report is forwarded automatically to your sectoral CSIRT and to your supervisor. The duty has applied since 15 August 2026 to every essentiële and belangrijke entiteit, with no transitional period.

At a glance

Act

Cyberbeveiligingswet, Stb. 2026, 187, Articles 25 to 30

Decree

Cyberbeveiligingsbesluit, Stb. 2026, 189, Articles 23 to 25

EU basis

Directive (EU) 2022/2555 (NIS2), Article 23

In force

15 August 2026

Who reports

Essential and important entities; financial entities under DORA are carved out (Art. 31)

Report to

Central meldpunt on mijn.ncsc.nl (Cbb Art. 25)

Thresholds for digital infrastructure

Implementing Regulation (EU) 2024/2690

Supervisor

Depends on your sector; for digital infrastructure and managed services the RDI

When is an incident reportable?

Article 25(2) has two limbs, and either one is enough.

The first looks inward: serious operational disruption of the services, or financial loss for the entity. The second looks outward: considerable material or non-material damage to other people or organisations. The word "can" matters: an incident that you contained before it caused the damage still counts if it was capable of causing it.

The Act allows more detailed criteria by order in council (Article 25(3) and (4)), and the Cyberbeveiligingsbesluit uses that power in Article 23. The government says the thresholds differ by sector and points to sectoral ministerial regulations for them.

The thresholds for digital infrastructure and digital providers

For DNS, top-level domain registries, cloud, data centres, content delivery networks, managed and managed security services, online marketplaces, search engines, social networks and trust service providers, Implementing Regulation (EU) 2024/2690 sets the test. Any one row is enough.

CriterionThresholdArticle

Direct financial loss

More than EUR 500,000 or 5% of total annual turnover, whichever is lower

3(1)(a)

Trade secrets

Exfiltration of trade secrets

3(1)(b)

Health and life

Death of a person, or considerable damage to a person's health

3(1)(c) and (d)

Unauthorised access

Successful, suspectedly malicious and unauthorised access to network and information systems

3(1)(e)

Recurring incidents

Incidents that occurred at least twice within 6 months and together meet the criteria count as one

3(1)(f) and 4

DNS

Service completely unavailable for more than 30 minutes

5

Cloud computing

Limited availability for more than 5% of EU users or more than 1 million users, whichever is smaller, for more than one hour

7(b)

Trust services

Service completely unavailable for more than 20 minutes

14

The reporting clock

Every deadline runs from the moment the entity becomes aware of the incident, except the final report.

ReportDeadlineWhat goes in itArticle

Early warning

Without undue delay, at the latest within 24 hours

Whether an unlawful or malicious act is suspected; possible cross-border impact; contact details. Where possible: suspected start time, visible effects, measures taken, expected recovery time

26 Cbw; 24 Cbb

Incident notification

Within 72 hours; 24 hours for trust service providers

An update of the early warning, an initial assessment of severity and impact, and indicators of compromise where available

27 Cbw

Intermediate report

On request of the CSIRT or the supervisor

Relevant status updates

28 Cbw

Final report

At the latest one month after the notification

Detailed description, severity and impact, likely threat type or root cause, mitigation applied and ongoing, cross-border impact

29 Cbw

Progress report

If the incident is still ongoing at the final-report deadline; final report one month after it is handled

The state of play

29(2) Cbw

Three rules attached to the reporting duty

  • Art. 30 Cbw

    Tell your customers too

    Inform the recipients of your services without undue delay about an incident likely to affect the service. For a threat that could seriously harm the service, tell them which protective measures they can take.

  • NCSC

    One report, two readers

    A mandatory report on mijn.ncsc.nl goes to your sectoral CSIRT and your supervisor. You do not file a second time with the supervisor.

  • NCSC

    Voluntary stays voluntary

    A voluntary report, for example of a near miss, is not shared with the supervisor. Mark the report type deliberately.

Where you file

The CSIRT for all entities in scope is the Minister of Justice and Security (Cbb Article 2(1)), which in practice means the NCSC. A sectoral CSIRT may be designated by ministerial regulation (Article 2(2)). Reports go to the meldpunt the Minister has set up (Cbb Article 25), which is the central meldpunt on mijn.ncsc.nl.

Registration runs through the same portal. Every entity in scope must register through mijn.ncsc.nl (Article 44) and report changes within two weeks. Binnenlands Bestuur reported 2,942 registrations on 17 August 2026, against eight to ten thousand organisations the government expects in scope. Check it first. An entity that has not registered finds out during an incident that it has no account to report from, which is the worst moment to set one up.

One incident, several regimes

The Cyberbeveiligingswet is rarely the only reporting duty an incident triggers. Each of these runs on its own clock to its own recipient.

RegimeWhoReport toFirst deadline

Cyberbeveiligingswet, Art. 26 and 27

Essential and important entities

NCSC meldpunt on mijn.ncsc.nl

24 hours

DORA, Art. 19

Banks, insurers, investment firms and other financial entities

DNB or the AFM; for banks, trading venues, CSDs and CCPs also the CSIRT (Cbb Art. 30)

Set by DORA

Cyber Resilience Act, Art. 14

Manufacturers of products with digital elements, for actively exploited vulnerabilities and severe incidents

ENISA single reporting platform

24 hours

GDPR, Art. 33

Any controller with a personal data breach

Autoriteit Persoonsgegevens

72 hours

Financial entities report under DORA instead

Article 31 of the Cyberbeveiligingswet switches off Articles 25 to 30 for an entity whose sector-specific EU law has equivalent reporting duties, provided the CSIRT, the supervisor or the single point of contact gets direct access to the reports. DORA is that law for financial entities. The Cyberbeveiligingsbesluit then closes the loop from the other side: banks, trading venues, central securities depositories and central counterparties also send their DORA report to the CSIRT (Article 30). The carve-out works per entity, so a managed service provider that serves only banks still reports under the Cyberbeveiligingswet itself.

What can GenCompl.ai do for you?

We read the Cyberbeveiligingswet, the decree and Implementing Regulation 2024/2690 as rules, so whether you report, to whom and on which clock is derived from a description of your organisation, with the article behind each answer.

Book a working session

Questions and answers

We stopped a ransomware attack within an hour. Do we still report?

If you are a digital infrastructure or digital provider entity under Implementing Regulation (EU) 2024/2690, a successful, suspectedly malicious unauthorised access is reportable on its own. For other entities, ask whether the attack could have caused serious disruption, financial loss or considerable damage to others. Containment does not undo that.

Does a report to the NCSC also cover the Autoriteit Persoonsgegevens?

No. A personal data breach goes to the Autoriteit Persoonsgegevens within 72 hours under Article 33 GDPR, separately. Neither the decree nor the NCSC infosheet treats the meldpunt as a channel to the AP.

We are a bank. Do we report to the NCSC?

Not under the Cyberbeveiligingswet, because Article 31 switches off its reporting duty for entities covered by DORA, but the Cyberbeveiligingsbesluit does require banks to send their DORA report to the CSIRT as well.

Who is our supervisor?

It depends on your sector. The NCSC's referral tree assigns the RDI for digital infrastructure, managed services and digital providers, and DNB for credit institutions. You do not need to know this to report, because the meldpunt forwards it.

When does the 24 hours start?

When you become aware of the incident, not when it started and not when you finished classifying it. The early warning needs only three items for that reason: a suspected malicious act, possible cross-border impact and a contact person.

Regulations

  • Cyber Resilience Act (CRA)

    The Cyber Resilience Act is Regulation (EU) 2024/2847. Its reporting obligations under Article 14 have applied since 11 September 2026, to every product with digital elements on the Union market, including products placed there before the Regulation's main obligations apply on 11 December 2027. Actively exploited vulnerabilities must be reported within 24 hours.

    Next
    Eerste Kamer committees' scheduled inbreng for the report on bill 36 875

    Checked

  • Cyberbeveiligingswet (Dutch NIS2)

    The Cyberbeveiligingswet is the Dutch implementation of NIS2, Directive (EU) 2022/2555. It entered into force on 15 August 2026 and covers more than 8,000 organisations. Registration, the duty of care and the 24-hour and 72-hour reporting duties applied from day one. Banks are largely displaced to DORA by Articles 22 and 31, but their IT suppliers are not.

    Next
    Commission review of sectors, size criteria and entity types; every 36 months thereafter

    Checked