---
title: "Drempelwaarden"
description: "Drempelwaarden are the criteria that decide when an incident at a Dutch university or hogeschool is significant under the Cyberbeveiligingswet."
canonical: "https://gencompl.ai/glossary/drempelwaarden-hoger-onderwijs"
language: "en-US"
type: "Glossary term"
published: "2026-10-14T18:10:26.258Z"
modified: "2026-10-14T19:16:46.368Z"
---

# Drempelwaarden

Criteria die, binnen de parameters van artikel 25, tweede lid, van de wet, bepalen wanneer een incident significant is.

Also known as: Thresholds, Incident thresholds

**What does "drempelwaarden" mean in the Cyberbeveiligingsregeling hoger onderwijs?**

Defined in: [Cyberbeveiligingswet](https://gencompl.ai/regulations/cyberbeveiligingswet) (BWBR0052872)

[Home](https://gencompl.ai/) › [Glossary](https://gencompl.ai/glossary) › Drempelwaarden

> criteria die, binnen de parameters van artikel 25, tweede lid, van de wet, bepalen wanneer een incident significant is

Artikel 25, tweede lid, van de Cyberbeveiligingswet (BWBR0052872):

- **2.** Een incident is een significant incident als het:
    - a. een ernstige operationele verstoring van de diensten of financiële verliezen voor de betrokken entiteit veroorzaakt of kan veroorzaken; of
    - b. andere entiteiten heeft getroffen of kan treffen door aanzienlijke materiële of immateriële schade te veroorzaken.

## Defined in / by

- [Cyberbeveiligingsregeling hoger onderwijs (consultation draft)](https://gencompl.ai/regulations/cyberbeveiligingsregeling-hoger-onderwijs), Article 1.1

Last updated: 14 October 2026.

## What the thresholds do

The Cyberbeveiligingswet only sets two parameters for a [significant incident](https://gencompl.ai/glossary/significant-incident) in [Article 25(2)](https://wetten.overheid.nl/BWBR0052872/2026-08-15): a serious operational disruption or financial loss for the entity, or considerable damage to other entities. [Article 23(1) of the Cyberbeveiligingsbesluit](https://wetten.overheid.nl/BWBR0052875/2026-08-15) lets the responsible minister turn those parameters into concrete criteria for a sector by ministerial regulation. In the [draft Cyberbeveiligingsregeling hoger onderwijs](https://gencompl.ai/regulations/cyberbeveiligingsregeling-hoger-onderwijs), the Minister of Education, Culture and Science calls those criteria *drempelwaarden* and sets four of them in Article 4.1 for publicly funded universities and hogescholen.

An incident at such an institution is significant if it leads to one of these effects:

- critical business processes are largely or fully disrupted, or stopped, for at least 24 hours (point a)
- education data is affected in a way that puts careful examination, the award of certificates or the granting of titles and degrees at risk (point b)
- research is seriously disrupted by irreparable damage to or loss of research data, or by its unauthorised disclosure (point c)
- a network or information system is compromised or destroyed by unauthorised access that is presumably malicious, and that could lead to any of the above (point d)

Meeting one threshold is enough. Under Article 4.1(2), an incident that could cause one of these effects also counts, and under Article 4.1(3) planned maintenance does not. A significant incident then runs the clock of Articles 26 to 29 Cbw: an early warning within 24 hours, a notification within 72 hours and a final report within one month.

The explanatory notes say the 24-hour period in point (a) keeps short disruptions out of the reporting duty, and give hacks, theft and ransomware as examples for point (d). They also invite institutions to report incidents and near misses below the thresholds voluntarily.

> **What we could not establish: A draft, not yet law**
>
> These thresholds come from a consultation draft. As at 14 October 2026 we found no adopted text in the Staatscourant, so the wording above can still change. The draft also cites Article 24(1) of the Cyberbeveiligingsbesluit as its basis; in the Besluit as published, the power to set criteria is in Article 23(1). Point (a) assumes each institution has defined its critical business processes, which the draft's own burden study says some have done only in part.

## Questions and answers

### Does an incident have to meet all four thresholds?

No. Under Article 4.1 of the draft Cyberbeveiligingsregeling hoger onderwijs, one threshold is enough to make an incident significant, and so is an incident that could lead to one of the four effects. Planned maintenance and agreed interruptions never count.

### Do the thresholds apply to universities already?

No. They apply once the regulation is adopted and the institutions are designated as important entities. As at 14 October 2026 the regulation was a draft. The Inspectie van het Onderwijs [expects](https://www.onderwijsinspectie.nl/actueel/nieuws/2026/08/18/cyberbeveiligingswet-brengt-nieuwe-verplichtingen-met-zich-mee-voor-het-hoger-onderwijs) the registration and reporting duties to apply from 1 April 2027.

### Is a personal data breach automatically a significant incident?

No. The four thresholds do not mention personal data. A breach of personal data is reported to the [Autoriteit Persoonsgegevens](https://gencompl.ai/authorities/autoriteit-persoonsgegevens) under the GDPR, and only counts under the Cbw if it also meets one of the thresholds. The draft's burden study expects about 75% of reportable incidents to involve personal data as well.

## Sources

- [Cyberbeveiligingsregeling hoger onderwijs: consultation draft with explanatory notes (PDF)](https://www.internetconsultatie.nl/cyberbeveiliging/document/15765) (Internetconsultatie (OCW) · 12 June 2026)
- [Consultatie Cyberbeveiligingsregeling hoger onderwijs](https://www.internetconsultatie.nl/cyberbeveiliging/b1) (Internetconsultatie (OCW) · 12 June 2026)
- [Cyberbeveiligingswet, consolidated text BWBR0052872](https://wetten.overheid.nl/BWBR0052872/2026-08-15) (wetten.overheid.nl · 15 August 2026)
- [Cyberbeveiligingsbesluit, consolidated text BWBR0052875](https://wetten.overheid.nl/BWBR0052875/2026-08-15) (wetten.overheid.nl · 15 August 2026)
- [Cyberbeveiligingswet brengt nieuwe verplichtingen met zich mee voor het hoger onderwijs](https://www.onderwijsinspectie.nl/actueel/nieuws/2026/08/18/cyberbeveiligingswet-brengt-nieuwe-verplichtingen-met-zich-mee-voor-het-hoger-onderwijs) (Inspectie van het Onderwijs · 18 August 2026)

## Related content

### Regulation

- [Cyberbeveiligingsregeling hoger onderwijs](https://gencompl.ai/regulations/cyberbeveiligingsregeling-hoger-onderwijs): The Cyberbeveiligingsregeling hoger onderwijs is a draft OCW regulation that makes the 54 publicly funded Dutch universities and hogescholen important entities under the Cyberbeveiligingswet. Registration and incident reporting are expected from 1 April 2027; the duty of care follows 36 months after designation.
- [Cyberbeveiligingswet (Dutch NIS2)](https://gencompl.ai/regulations/cyberbeveiligingswet): The Cyberbeveiligingswet is the Dutch implementation of NIS2, Directive (EU) 2022/2555. It entered into force on 15 August 2026 and covers more than 8,000 organisations. Registration, the duty of care and the 24-hour and 72-hour reporting duties applied from day one. Banks are largely displaced to DORA by Articles 22 and 31, but their IT suppliers are not.