Skip to main content
Glossary termPublished inCyberbeveiligingswet

Drempelwaarden

Also known as Thresholds, Incident thresholds

What does "drempelwaarden" mean in the Cyberbeveiligingsregeling hoger onderwijs?

criteria die, binnen de parameters van artikel 25, tweede lid, van de wet, bepalen wanneer een incident significant is

Artikel 25, tweede lid, van de Cyberbeveiligingswet (BWBR0052872):

  • 2. Een incident is een significant incident als het:
    • a. een ernstige operationele verstoring van de diensten of financiële verliezen voor de betrokken entiteit veroorzaakt of kan veroorzaken; of
    • b. andere entiteiten heeft getroffen of kan treffen door aanzienlijke materiële of immateriële schade te veroorzaken.

Defined in / by

Last updated: 14 October 2026.

What the thresholds do

The Cyberbeveiligingswet only sets two parameters for a significant incident in Article 25(2): a serious operational disruption or financial loss for the entity, or considerable damage to other entities. Article 23(1) of the Cyberbeveiligingsbesluit lets the responsible minister turn those parameters into concrete criteria for a sector by ministerial regulation. In the draft Cyberbeveiligingsregeling hoger onderwijs, the Minister of Education, Culture and Science calls those criteria drempelwaarden and sets four of them in Article 4.1 for publicly funded universities and hogescholen.

An incident at such an institution is significant if it leads to one of these effects:

  • critical business processes are largely or fully disrupted, or stopped, for at least 24 hours (point a)
  • education data is affected in a way that puts careful examination, the award of certificates or the granting of titles and degrees at risk (point b)
  • research is seriously disrupted by irreparable damage to or loss of research data, or by its unauthorised disclosure (point c)
  • a network or information system is compromised or destroyed by unauthorised access that is presumably malicious, and that could lead to any of the above (point d)

Meeting one threshold is enough. Under Article 4.1(2), an incident that could cause one of these effects also counts, and under Article 4.1(3) planned maintenance does not. A significant incident then runs the clock of Articles 26 to 29 Cbw: an early warning within 24 hours, a notification within 72 hours and a final report within one month.

The explanatory notes say the 24-hour period in point (a) keeps short disruptions out of the reporting duty, and give hacks, theft and ransomware as examples for point (d). They also invite institutions to report incidents and near misses below the thresholds voluntarily.

Questions and answers

Does an incident have to meet all four thresholds?

No. Under Article 4.1 of the draft Cyberbeveiligingsregeling hoger onderwijs, one threshold is enough to make an incident significant, and so is an incident that could lead to one of the four effects. Planned maintenance and agreed interruptions never count.

Do the thresholds apply to universities already?

No. They apply once the regulation is adopted and the institutions are designated as important entities. As at 14 October 2026 the regulation was a draft. The Inspectie van het Onderwijs expects the registration and reporting duties to apply from 1 April 2027.

Is a personal data breach automatically a significant incident?

No. The four thresholds do not mention personal data. A breach of personal data is reported to the Autoriteit Persoonsgegevens under the GDPR, and only counts under the Cbw if it also meets one of the thresholds. The draft's burden study expects about 75% of reportable incidents to involve personal data as well.

Regulations

  • Cyberbeveiligingsregeling hoger onderwijs

    The Cyberbeveiligingsregeling hoger onderwijs is a draft OCW regulation that makes the 54 publicly funded Dutch universities and hogescholen important entities under the Cyberbeveiligingswet. Registration and incident reporting are expected from 1 April 2027; the duty of care follows 36 months after designation.

    Next
    Designation takes effect; registration duty (Art. 44 Cbw) and reporting duty (Arts. 26 to 29 Cbw) apply

  • Cyberbeveiligingswet (Dutch NIS2)

    The Cyberbeveiligingswet is the Dutch implementation of NIS2, Directive (EU) 2022/2555. It entered into force on 15 August 2026 and covers more than 8,000 organisations. Registration, the duty of care and the 24-hour and 72-hour reporting duties applied from day one. Banks are largely displaced to DORA by Articles 22 and 31, but their IT suppliers are not.

    Next
    Commission review of sectors, size criteria and entity types; every 36 months thereafter

    Checked