Skip to main content
Glossary termPublished inCyberbeveiligingswet

Bekostigde instelling voor hoger onderwijs

Also known as Publicly funded higher education institution

What does "bekostigde instelling voor hoger onderwijs" mean in the Cyberbeveiligingsregeling hoger onderwijs?

bekostigde instelling, genoemd in de bijlage van de Wet op het hoger onderwijs en wetenschappelijk onderzoek, onder a tot en met i

Defined in / by

Last updated: 14 October 2026.

Which institutions this covers

The definition points at a list, not a description. Parts a to i of the annex to the Wet op het hoger onderwijs en wetenschappelijk onderzoek (WHW) name the publicly funded institutions, as Article 1.8(1) WHW confirms. As at the WHW text of 1 August 2026, those parts hold 54 institutions, the same number the draft regulation's burden study works with. Article 2.1 of the draft Cyberbeveiligingsregeling hoger onderwijs designates every one of them as a belangrijke entiteit under the Cyberbeveiligingswet.

Part j of the same annex lists the academic hospitals. Because the definition stops at part i, they fall outside it.

Narrower than the Cbw allows

Article 13 Cbw lets the Minister of Education, Culture and Science designate an instelling voor hoger onderwijs as defined in Article 1.1, point g, WHW. That WHW definition covers both a funded institution in parts a to i of the annex and a rechtspersoon voor hoger onderwijs, which is not in the annex and receives no public funding. The draft regulation uses only the first half. Its explanatory notes say designating non-funded institutions would not be proportionate, given the weight NIS2 puts on critical research. Mbo institutions are out for a different reason: the notes say the Cbw gives no basis to designate them at all.

Parts a to i of the WHW annex

As listed in the WHW text valid from 1 August 2026.

PartInstitutionsNumber

a

Public universities (Leiden, Groningen, Amsterdam, Utrecht, Delft, Wageningen, Eindhoven, Enschede, Rotterdam, Maastricht)

10

b

Bijzondere universities, privately founded and publicly funded (Amsterdam, Nijmegen, Tilburg)

3

c to f

Vacant

0

g

Bijzondere hogescholen

36

h

Open Universiteit, Heerlen

1

i

Levensbeschouwelijke universiteiten

4

Total

All funded institutions in parts a to i

54

Questions and answers

Is a university medical centre a bekostigde instelling voor hoger onderwijs?

No. The academic hospitals are listed in part j of the WHW annex, and the definition in the draft Cyberbeveiligingsregeling hoger onderwijs covers parts a to i only. Whether a hospital falls under the Cyberbeveiligingswet in its own right is a question for the health sector of the Act, not for this regulation.

Are private hogescholen covered?

No. Only the funded institutions in parts a to i of the WHW annex fall within the definition. A private institution that is not in the annex is not designated by the draft Cyberbeveiligingsregeling hoger onderwijs, and its explanatory notes say designating non-funded institutions would not be proportionate.

Is the Open Universiteit covered?

Yes. The Open Universiteit in Heerlen is listed in part h of the WHW annex, which falls within parts a to i. The four levensbeschouwelijke universiteiten in part i are covered on the same basis.

Regulations

  • Cyberbeveiligingsregeling hoger onderwijs

    The Cyberbeveiligingsregeling hoger onderwijs is a draft OCW regulation that makes the 54 publicly funded Dutch universities and hogescholen important entities under the Cyberbeveiligingswet. Registration and incident reporting are expected from 1 April 2027; the duty of care follows 36 months after designation.

    Next
    Designation takes effect; registration duty (Art. 44 Cbw) and reporting duty (Arts. 26 to 29 Cbw) apply

  • Cyberbeveiligingswet (Dutch NIS2)

    The Cyberbeveiligingswet is the Dutch implementation of NIS2, Directive (EU) 2022/2555. It entered into force on 15 August 2026 and covers more than 8,000 organisations. Registration, the duty of care and the 24-hour and 72-hour reporting duties applied from day one. Banks are largely displaced to DORA by Articles 22 and 31, but their IT suppliers are not.

    Next
    Commission review of sectors, size criteria and entity types; every 36 months thereafter

    Checked