---
title: "When must you report a cyber incident under the Cyberbeveiligingswet, and to whom?"
description: "When an incident is reportable under the Dutch Cyberbeveiligingswet, the 24-hour, 72-hour and one-month clock, where to file, and how DORA and GDPR fit."
canonical: "https://gencompl.ai/deep-dives/cyberbeveiligingswet-incident-reporting"
language: "en-US"
type: "Deep dive"
published: "2026-10-14T18:40:33.345Z"
modified: "2026-10-14T18:54:03.633Z"
---

# When must you report a cyber incident under the Cyberbeveiligingswet, and to whom?

When it seriously disrupts your services, causes you financial loss, or causes others considerable damage. Send an early warning within 24 hours of becoming aware, a notification within 72 hours and a final report within one month, through the NCSC's meldpunt on mijn.ncsc.nl, which forwards mandatory reports to your supervisor.

**What makes an incident reportable under the Dutch Cyberbeveiligingswet, how fast must it be reported, and where?**

Defined in: [CRA](https://gencompl.ai/regulations/cyber-resilience-act) (32024R2847), [Cyberbeveiligingswet](https://gencompl.ai/regulations/cyberbeveiligingswet) (BWBR0052872)

[Home](https://gencompl.ai/) › [Deep dives](https://gencompl.ai/deep-dives) › When must you report a cyber incident under the Cyberbeveiligingswet, and to whom?

## When must you report a cyber incident under the Cyberbeveiligingswet, and to whom?

When it is a [significant incident](https://gencompl.ai/glossary/significant-incident): one that causes, or can cause, serious disruption of your services or financial loss for you, or considerable material or non-material damage to others (Article 25(2) of the [Cyberbeveiligingswet](https://gencompl.ai/regulations/cyberbeveiligingswet)). The clock starts when you become aware of it. An early warning is due within 24 hours, a notification within 72 hours and a final report within one month.

You file once.

The report goes to the NCSC's central meldpunt on mijn.ncsc.nl, and according to the NCSC a mandatory report is forwarded automatically to your sectoral CSIRT and to your supervisor. The duty has applied since 15 August 2026 to every [essentiële](https://gencompl.ai/glossary/essentiele-entiteit) and [belangrijke entiteit](https://gencompl.ai/glossary/belangrijke-entiteit), with no transitional period.

## At a glance

- **Act**: [Cyberbeveiligingswet](https://zoek.officielebekendmakingen.nl/stb-2026-187.odt), Stb. 2026, 187, Articles 25 to 30
- **Decree**: [Cyberbeveiligingsbesluit](https://zoek.officielebekendmakingen.nl/stb-2026-189.odt), Stb. 2026, 189, Articles 23 to 25
- **EU basis**: [Directive (EU) 2022/2555](https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng) (NIS2), Article 23
- **In force**: 15 August 2026
- **Who reports**: Essential and important entities; financial entities under DORA are carved out (Art. 31)
- **Report to**: Central meldpunt on mijn.ncsc.nl (Cbb Art. 25)
- **Thresholds for digital infrastructure**: [Implementing Regulation (EU) 2024/2690](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2690)
- **Supervisor**: Depends on your sector; for digital infrastructure and managed services the [RDI](https://gencompl.ai/authorities/rdi)

## When is an incident reportable?

Article 25(2) has two limbs, and either one is enough.

The first looks inward: serious operational disruption of the services, or financial loss for the entity. The second looks outward: considerable material or non-material damage to other people or organisations. The word "can" matters: an incident that you contained before it caused the damage still counts if it was capable of causing it.

The Act allows more detailed criteria by order in council (Article 25(3) and (4)), and the Cyberbeveiligingsbesluit uses that power in Article 23. The government says the thresholds differ by sector and points to sectoral ministerial regulations for them.

## The thresholds for digital infrastructure and digital providers

For DNS, top-level domain registries, cloud, data centres, content delivery networks, managed and managed security services, online marketplaces, search engines, social networks and trust service providers, [Implementing Regulation (EU) 2024/2690](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2690) sets the test. Any one row is enough.

| Criterion | Threshold | Article |
| --- | --- | --- |
| Direct financial loss | More than EUR 500,000 or 5% of total annual turnover, whichever is lower | 3(1)(a) |
| Trade secrets | Exfiltration of trade secrets | 3(1)(b) |
| Health and life | Death of a person, or considerable damage to a person's health | 3(1)(c) and (d) |
| Unauthorised access | Successful, suspectedly malicious and unauthorised access to network and information systems | 3(1)(e) |
| Recurring incidents | Incidents that occurred at least twice within 6 months and together meet the criteria count as one | 3(1)(f) and 4 |
| DNS | Service completely unavailable for more than 30 minutes | 5 |
| Cloud computing | Limited availability for more than 5% of EU users or more than 1 million users, whichever is smaller, for more than one hour | 7(b) |
| Trust services | Service completely unavailable for more than 20 minutes | 14 |

> **Our analysis: A break-in is enough**
>
> For the entities under Implementing Regulation (EU) 2024/2690, the access criterion in Article 3(1)(e) means a successful, suspectedly malicious intrusion is reportable on its own. No outage, no loss and no stolen data are needed. A managed service provider whose admin account was taken over for an hour has a reportable incident, even if every customer system stayed up.

## The reporting clock

Every deadline runs from the moment the entity becomes aware of the incident, except the final report.

| Report | Deadline | What goes in it | Article |
| --- | --- | --- | --- |
| Early warning | Without undue delay, at the latest within 24 hours | Whether an unlawful or malicious act is suspected; possible cross-border impact; contact details. Where possible: suspected start time, visible effects, measures taken, expected recovery time | 26 Cbw; 24 Cbb |
| Incident notification | Within 72 hours; 24 hours for trust service providers | An update of the early warning, an initial assessment of severity and impact, and indicators of compromise where available | 27 Cbw |
| Intermediate report | On request of the CSIRT or the supervisor | Relevant status updates | 28 Cbw |
| Final report | At the latest one month after the notification | Detailed description, severity and impact, likely threat type or root cause, mitigation applied and ongoing, cross-border impact | 29 Cbw |
| Progress report | If the incident is still ongoing at the final-report deadline; final report one month after it is handled | The state of play | 29(2) Cbw |

## Three rules attached to the reporting duty

*Art. 30 Cbw*

### Tell your customers too

Inform the recipients of your services without undue delay about an incident likely to affect the service. For a threat that could seriously harm the service, tell them which protective measures they can take.

*NCSC*

### One report, two readers

A mandatory report on mijn.ncsc.nl goes to your sectoral CSIRT and your supervisor. You do not file a second time with the supervisor.

*NCSC*

### Voluntary stays voluntary

A voluntary report, for example of a near miss, is not shared with the supervisor. Mark the report type deliberately.

## Where you file

The [CSIRT](https://gencompl.ai/glossary/csirt) for all entities in scope is the Minister of Justice and Security (Cbb Article 2(1)), which in practice means the NCSC. A sectoral CSIRT may be designated by ministerial regulation (Article 2(2)). Reports go to the meldpunt the Minister has set up (Cbb Article 25), which is the central meldpunt on mijn.ncsc.nl.

Registration runs through the same portal. Every entity in scope must register through mijn.ncsc.nl (Article 44) and report changes within two weeks. Binnenlands Bestuur reported 2,942 registrations on 17 August 2026, against eight to ten thousand organisations the government expects in scope. Check it first. An entity that has not registered finds out during an incident that it has no account to report from, which is the worst moment to set one up.

## One incident, several regimes

The Cyberbeveiligingswet is rarely the only reporting duty an incident triggers. Each of these runs on its own clock to its own recipient.

| Regime | Who | Report to | First deadline |
| --- | --- | --- | --- |
| Cyberbeveiligingswet, Art. 26 and 27 | Essential and important entities | NCSC meldpunt on mijn.ncsc.nl | 24 hours |
| DORA, Art. 19 | Banks, insurers, investment firms and other financial entities | DNB or the AFM; for banks, trading venues, CSDs and CCPs also the CSIRT (Cbb Art. 30) | Set by DORA |
| [Cyber Resilience Act](https://gencompl.ai/regulations/cyber-resilience-act), Art. 14 | Manufacturers of products with digital elements, for actively exploited vulnerabilities and severe incidents | ENISA single reporting platform | 24 hours |
| GDPR, Art. 33 | Any controller with a personal data breach | [Autoriteit Persoonsgegevens](https://gencompl.ai/authorities/autoriteit-persoonsgegevens) | 72 hours |

## Financial entities report under DORA instead

Article 31 of the Cyberbeveiligingswet switches off Articles 25 to 30 for an entity whose sector-specific EU law has equivalent reporting duties, provided the CSIRT, the supervisor or the single point of contact gets direct access to the reports. DORA is that law for financial entities. The Cyberbeveiligingsbesluit then closes the loop from the other side: banks, trading venues, central securities depositories and central counterparties also send their DORA report to the CSIRT (Article 30). The carve-out works per entity, so a managed service provider that serves only banks still reports under the Cyberbeveiligingswet itself.

> **What we could not establish**
>
> We could not confirm the article numbers for fines in the Dutch Act, or the Dutch maximum amounts. Article 34 of NIS2 sets minimum maxima of EUR 10 million or 2% of worldwide turnover for essential entities and EUR 7 million or 1.4% for important ones. We have not read the sectoral ministerial regulations that set thresholds outside digital infrastructure. The NCSC infosheet on forwarding is dated September 2025, before the Act took effect, and the forwarding itself is not written into the decree.

## What can GenCompl.ai do for you?

We read the Cyberbeveiligingswet, the decree and Implementing Regulation 2024/2690 as rules, so whether you report, to whom and on which clock is derived from a description of your organisation, with the article behind each answer.

- [Book a working session](https://gencompl.ai/contact)

## Questions and answers

### We stopped a ransomware attack within an hour. Do we still report?

If you are a digital infrastructure or digital provider entity under Implementing Regulation (EU) 2024/2690, a successful, suspectedly malicious unauthorised access is reportable on its own. For other entities, ask whether the attack could have caused serious disruption, financial loss or considerable damage to others. Containment does not undo that.

### Does a report to the NCSC also cover the Autoriteit Persoonsgegevens?

No. A personal data breach goes to the Autoriteit Persoonsgegevens within 72 hours under Article 33 GDPR, separately. Neither the decree nor the NCSC infosheet treats the meldpunt as a channel to the AP.

### We are a bank. Do we report to the NCSC?

Not under the Cyberbeveiligingswet, because Article 31 switches off its reporting duty for entities covered by DORA, but the Cyberbeveiligingsbesluit does require banks to send their DORA report to the CSIRT as well.

### Who is our supervisor?

It depends on your sector. The NCSC's referral tree assigns the RDI for digital infrastructure, managed services and digital providers, and DNB for credit institutions. You do not need to know this to report, because the meldpunt forwards it.

### When does the 24 hours start?

When you become aware of the incident, not when it started and not when you finished classifying it. The early warning needs only three items for that reason: a suspected malicious act, possible cross-border impact and a contact person.

## Sources

- [Cyberbeveiligingswet, Stb. 2026, 187](https://zoek.officielebekendmakingen.nl/stb-2026-187.odt) (Staatsblad · 8 July 2026)
- [Cyberbeveiligingsbesluit, Stb. 2026, 189](https://zoek.officielebekendmakingen.nl/stb-2026-189.odt) (Staatsblad · 8 July 2026)
- [Directive (EU) 2022/2555 (NIS2), Articles 23 and 34](https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng) (EUR-Lex · 14 December 2022)
- [Commission Implementing Regulation (EU) 2024/2690: technical and methodological requirements and significant incidents](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2690) (EUR-Lex · 17 October 2024)
- [Memorie van toelichting Cyberbeveiligingswet, Kamerstuk 36764, nr. 3](https://zoek.officielebekendmakingen.nl/kst-36764-3.pdf) (Tweede Kamer)
- [Infosheet meldplicht](https://www.ncsc.nl/api/media/sites/default/files/Infosheet%2Bmeldplicht.pdf) (NCSC · 1 September 2025)
- [Infosheet registratieplicht](https://www.ncsc.nl/api/media/sites/default/files/Infosheet%2Bregistratieplicht.pdf) (NCSC · 1 September 2025)
- [Doorverwijsboom Cyberbeveiligingswet](https://www.ncsc.nl/api/media/sites/default/files/25-1104%2BDoorverwijsboom%2BCyberbeveiligingswet%2BDEF%2B12.pdf) (NCSC)
- [De Cyberbeveiligingswet treedt in werking](https://www.rdi.nl/actueel/nieuws/2026/08/15/de-cyberbeveiligingswet-treedt-in-werking) (RDI · 15 August 2026)
- [Cyberbeveiligingswet en Wet weerbaarheid kritieke entiteiten vanaf vandaag van kracht](https://www.rijksoverheid.nl/actueel/nieuws/2026/08/15/cyberbeveiligingswet-en-wet-weerbaarheid-kritieke-entiteiten-vanaf-vandaag-van-kracht) (Rijksoverheid · 15 August 2026)
- [Meer dan helft organisaties niet geregistreerd voor cyberwet](https://www.binnenlandsbestuur.nl/digitaal/meer-dan-helft-organisaties-niet-geregistreerd-voor-cyberwet) (Binnenlands Bestuur · 17 August 2026)

## Related content

### Regulation

- [Cyber Resilience Act (CRA)](https://gencompl.ai/regulations/cyber-resilience-act): The Cyber Resilience Act is Regulation (EU) 2024/2847. Its reporting obligations under Article 14 have applied since 11 September 2026, to every product with digital elements on the Union market, including products placed there before the Regulation's main obligations apply on 11 December 2027. Actively exploited vulnerabilities must be reported within 24 hours.
- [Cyberbeveiligingswet (Dutch NIS2)](https://gencompl.ai/regulations/cyberbeveiligingswet): The Cyberbeveiligingswet is the Dutch implementation of NIS2, Directive (EU) 2022/2555. It entered into force on 15 August 2026 and covers more than 8,000 organisations. Registration, the duty of care and the 24-hour and 72-hour reporting duties applied from day one. Banks are largely displaced to DORA by Articles 22 and 31, but their IT suppliers are not.