Cyberbeveiligingsregeling hoger onderwijs
The Cyberbeveiligingsregeling hoger onderwijs is a draft OCW regulation that makes the 54 publicly funded Dutch universities and hogescholen important entities under the Cyberbeveiligingswet. Registration and incident reporting are expected from 1 April 2027; the duty of care follows 36 months after designation.
When do universities and hogescholen fall under the Cyberbeveiligingswet?
Not yet. As at 14 October 2026 the Cyberbeveiligingsregeling hoger onderwijs is a draft ministerial regulation of the Ministry of Education, Culture and Science (OCW). Once adopted, it designates all 54 publicly funded universities and hogescholen as important entities under Article 13 of the Cyberbeveiligingswet, the Dutch NIS2 law. The Inspectie van het Onderwijs expects the registration and reporting duties to apply from 1 April 2027. The duty of care follows 36 months after designation.
The Cbw itself entered into force on 15 August 2026, but higher education was left out of that date. Institutions can already register through the NCSC portal. They do not have to.
The consultation ran from 12 June to 10 July 2026. This page covers what the draft says, what it still leaves blank and which dates are fixed. For the Act itself, see our page on the Cyberbeveiligingswet.
Checked against the consultation draft, the consolidated Cbw and Cyberbeveiligingsbesluit, and the minister's letter of 24 June 2026, as at 14 October 2026.
At a glance
Official title (draft)
Regeling van de Minister van Onderwijs, Cultuur en Wetenschap houdende regels ter uitvoering van de Cyberbeveiligingswet en het Cyberbeveiligingsbesluit voor de sector onderwijs (Cyberbeveiligingsregeling hoger onderwijs)
Type
Ministerial regulation of OCW, made after consulting the Minister of Justice and Security
Status
Draft. Consultation closed 10 July 2026 with 11 public responses. As at 14 October 2026 we found no adopted text in the Staatscourant
Parent law
Cyberbeveiligingswet, Stb. 2026, 187, implementing Directive (EU) 2022/2555 (NIS2)
Who
54 publicly funded universities and hogescholen listed under a to i of the annex to the WHW
Classification
Important entity (belangrijke entiteit). Supervision after the fact only
Supervisor
Officials of the Inspectie van het Onderwijs (Article 6.1 of the draft). The competent authority is the Minister of OCW (Article 15(3) Cbw)
CSIRT
Left blank in the draft. SURFcert is the intended CSIRT, per the minister's letter of 24 June 2026
Registration and reporting
From designation. 1 April 2027 is indicative
Duty of care and board duties
36 months after designation (Article 97 Cbw)
Maximum fines
€7 million or 1.4% of worldwide turnover for the entity (Article 87 Cbw). €25,000 for a board member (Article 93 Cbw)
What does the draft still leave open?
Four parts of the consultation draft are placeholders marked "PM": the CSIRT chapter, the date of entry into force, and two sections of the explanatory notes (on the CSIRT, and on advice and consultation). Chapter 5 on the duty of care has a heading and no text. The explanatory notes say a sector-specific duty of care will be added by amendment, if needed, once Articles 21 and 24 Cbw start to apply.
What is settled in the draft is short. Article 2.1 makes every publicly funded institution an important entity, Article 4.1 sets four thresholds for a reportable incident, and Article 6.1 names the Inspectie as supervisor.
Who is in scope?
Every publicly funded university and hogeschool, and nothing else in education. The draft makes no distinction between institutions or between faculties. The explanatory notes say a narrower cut would be hard to carry out, given how much the institutions share and depend on each other.
| Institution | In scope? | Why |
|---|---|---|
Publicly funded universities and hogescholen (WHW annex, a to i) | Yes, important entity | Article 2.1 of the draft, on the basis of Article 13 Cbw |
Mbo institutions | No | The Cbw gives no basis to designate them (explanatory notes). Mbo works on cyber resilience under administrative agreements instead |
Primary and secondary schools | No | Not covered by the Cbw, per the Inspectie |
Private, non-funded higher education | No | Designation was judged not proportionate (explanatory notes) |
An institution's activities in a sector listed in Bijlage 1 or 2 to the Cbw | Possibly, in their own right | SURF points out that the annex sectors can apply to other activities of an institution |
Why the lighter of the two regimes?
The Cbw would also allow the minister to designate institutions as essential entities under Article 11. The draft does not use that option. The reason given is proportionality: since 2021 the institutions have worked under administrative agreements with OCW to raise their cyber resilience. An important entity is supervised only after the fact. Under Article 81 Cbw, the Inspectie can use its scan, audit, instruction and fine powers only once it has evidence or an indication of a possible breach.
What does it require?
Three duties, which arrive at two different moments.
Registration
Article 44 Cbw: name, address, contact details including e-mail addresses and IP ranges, and the sector. Changes within two weeks. The explanatory notes estimate 20 hours per institution to register once.
Reporting incidents
Articles 26, 27 and 29 Cbw set the clock: an early warning without delay and within 24 hours of becoming aware, a notification with an initial assessment within 72 hours, and a final report within one month of that notification. Reports go to the CSIRT and to the competent authority. The draft explanatory notes say both can be reached in one go through the central reporting point at mijn.ncsc.nl.
Duty of care and board accountability, later
Article 97 Cbw delays Articles 21 and 24 for designated higher education institutions until 36 months after designation. Article 21 is the duty to take risk management measures in ten areas, from incident handling to multi-factor authentication. Article 24 makes the board approve those measures and hold a training certificate. Until then, the minister's letter of 24 June 2026 says, there is no external supervision of the duty of care.
Which incidents must a university report?
Article 4.1 of the draft sets four thresholds for a significant incident. Meeting any one is enough, and so is an incident that could lead to one of these effects. Planned maintenance does not count.
Art. 4.1(1)(a)
Critical processes down for 24 hours
Critical business processes are largely or fully disrupted, or stopped, for at least 24 hours. The draft assumes institutions have defined those processes, for example with the HORA reference architecture.
Art. 4.1(1)(b)
Exams, diplomas and degrees
Education data is affected in a way that puts careful examination, the award of certificates or the granting of titles and degrees at risk.
Art. 4.1(1)(c)
Research data
Research is seriously disrupted by irreparable damage to or loss of research data, or by its unauthorised disclosure.
Art. 4.1(1)(d)
Compromised systems
A network or information system is compromised or destroyed by unauthorised access that is presumably malicious, and that could lead to any of the above. The notes give hacks, theft and ransomware as examples.
The dates
All dates for higher education under the Cyberbeveiligingswet, past and future, with how certain each one is.
2025
- 24 April 2025 · Set by OCW
Minister informs the Tweede Kamer that publicly funded higher education will be brought under the Cbw
2026
- 12 June 2026 · Set by OCW
Draft regulation published for consultation
- 24 June 2026 · Set by OCW
Letter to the Tweede Kamer (26643, nr. 1535): all funded institutions to be important entities, Inspectie as supervisor, SURFcert as intended CSIRT
- 10 July 2026 · Set by OCW
Consultation closes with 11 public responses
- 15 August 2026 · Set by law (Art. 35 Cyberbeveiligingsbesluit)
Cbw and Cyberbeveiligingsbesluit enter into force; higher education not yet designated
2027
- 1 April 2027 · Indicative: Inspectie van het Onderwijs, 18 August 2026
Designation takes effect; registration duty (Art. 44 Cbw) and reporting duty (Arts. 26 to 29 Cbw) apply
2030
- 36 months after designation · Calculated (Art. 97 Cbw); 1 April 2030 if designation is on 1 April 2027
Duty of care (Art. 21 Cbw) and board duties (Art. 24 Cbw) apply
Without an official date
- Within three years of entry into force · Proposed (draft explanatory notes)
Evaluation of the whole regulation
Who supervises, and how?
The minister's letter calls this a new and separate task for the Inspectie. The same letter, of 24 June 2026, says SURF would set up a new private legal entity to act as the CSIRT, and that the procedure for it was expected to start after the summer. As at 14 October 2026 we found no announcement that it had.
| Role | Who | Basis |
|---|---|---|
Competent authority | Minister of OCW | Article 15(3) Cbw |
Supervisor | Officials of the Inspectie van het Onderwijs | Article 68(1) Cbw, Article 6.1 of the draft |
CSIRT | Blank in the draft. SURFcert intended; until then the Minister of Justice and Security (NCSC) | Article 16 Cbw, Article 2 Cyberbeveiligingsbesluit |
Reporting entry point | NCSC central reporting point (mijn.ncsc.nl) | Draft explanatory notes |
Personal data breaches | Autoriteit Persoonsgegevens, separately | GDPR |
What has changed?
18 August 2026. The Inspectie van het Onderwijs wrote that it expects universities and hogescholen to have to comply from 1 April 2027 with the registration and reporting duties, and that the duty of care starts 36 months later.
15 August 2026. The Cyberbeveiligingswet and the Cyberbeveiligingsbesluit entered into force. Higher education was not designated on that date.
10 July 2026. The consultation closed with 11 public responses, among them one from the Vereniging Hogescholen.
24 June 2026. Minister Letschert confirmed to the Tweede Kamer that all publicly funded institutions will be important entities, with the Inspectie as supervisor and SURFcert as intended CSIRT. She also announced that mbo stays outside the Cbw.
12 June 2026. OCW published the draft regulation for consultation.
What can GenCompl.ai do for you?
Our pipeline tracks the Cyberbeveiligingswet, the Besluit and each sector regulation made under them, including this one from draft to Staatscourant. When the CSIRT chapter is filled in or the entry into force is fixed, the dates on this page and in your own obligations view are recalculated, with the article and the source that changed them.
Questions and answers
Are universities already covered by the Cyberbeveiligingswet?
No. The Cbw entered into force on 15 August 2026, but publicly funded universities and hogescholen only fall under it once the Minister of OCW designates them. That designation is in the draft Cyberbeveiligingsregeling hoger onderwijs. As at 14 October 2026 it had not been adopted. The Inspectie van het Onderwijs expects the registration and reporting duties to apply from 1 April 2027.
Is a hogeschool an essential or an important entity?
An important entity. Article 2.1 of the draft designates all publicly funded universities and hogescholen as important entities under Article 13 Cbw. The minister chose not to use Article 11, which would have made them essential entities. As important entities they are supervised only after the fact, and Article 87 Cbw caps their fine at €7 million or 1.4% of worldwide turnover.
What counts as a significant incident for a university?
Under Article 4.1 of the draft, an incident is significant if it disrupts critical business processes for at least 24 hours, puts exams, diplomas or degrees at risk, seriously disrupts research through loss or disclosure of research data, or compromises a system through presumably malicious unauthorised access. An incident that could cause one of these effects also counts. Planned maintenance does not.
When does the duty of care apply to higher education?
36 months after designation. Article 97 Cbw delays the duty of care (Article 21) and the board duties (Article 24) for designated higher education institutions by that period. If designation takes effect on 1 April 2027, as the Inspectie expects, that is 1 April 2030. The draft regulation leaves its own duty-of-care chapter empty for now.
Who supervises universities under the Cyberbeveiligingswet?
The officials of the Inspectie van het Onderwijs, under Article 6.1 of the draft and Article 68(1) Cbw. The Minister of OCW is the competent authority under Article 15(3) Cbw. SURFcert is the intended CSIRT, but the draft's CSIRT chapter was still blank in the consultation version.
Does the regulation cover mbo institutions or private colleges?
No. The explanatory notes say the Cbw gives no basis to designate mbo institutions, and that designating non-funded institutions would not be proportionate. Primary and secondary schools are not covered either. Mbo works on cyber resilience under administrative agreements with OCW.
Do we still report data breaches to the Autoriteit Persoonsgegevens?
Yes. A Cbw report does not replace a GDPR data breach notification. The draft's burden study expects about 75% of reportable incidents at institutions to involve personal data, which means two reports for the same incident: one through the NCSC reporting point, one to the Autoriteit Persoonsgegevens.
Sources
- Consultatie Cyberbeveiligingsregeling hoger onderwijsInternetconsultatie (OCW) · 12 June 2026
- Cyberbeveiligingsregeling hoger onderwijs: consultation draft with explanatory notes (PDF)Internetconsultatie (OCW) · 12 June 2026
- Cyberbeveiligingswet, consolidated text BWBR0052872wetten.overheid.nl · 15 August 2026
- Staatsblad 2026, 187: CyberbeveiligingswetStaatsblad
- Cyberbeveiligingsbesluit, consolidated text BWBR0052875wetten.overheid.nl · 15 August 2026
- Staatsblad 2026, 189: CyberbeveiligingsbesluitStaatsblad
- Kamerstuk 26643, nr. 1535: Voortgang aanpak cyberweerbaarheid in het vervolgonderwijsTweede Kamer · 24 June 2026
- Cyberbeveiligingswet brengt nieuwe verplichtingen met zich mee voor het hoger onderwijsInspectie van het Onderwijs · 18 August 2026
- Directive (EU) 2022/2555 (NIS2)EUR-Lex
- Cyberbeveiligingswet FAQSURF Security Expertise Centrum
- Cyberbeveiligingswet: stand van zaken, planning en gevolgen voor hoger onderwijsSURF Security Expertise Centrum
Regulations
Cyberbeveiligingswet (Dutch NIS2)
The Cyberbeveiligingswet is the Dutch implementation of NIS2, Directive (EU) 2022/2555. It entered into force on 15 August 2026 and covers more than 8,000 organisations. Registration, the duty of care and the 24-hour and 72-hour reporting duties applied from day one. Banks are largely displaced to DORA by Articles 22 and 31, but their IT suppliers are not.
NextCommission review of sectors, size criteria and entity types; every 36 months thereafterChecked