---
title: "Cyberbeveiligingsregeling hoger onderwijs"
description: "A draft Dutch rule makes 54 universities and hogescholen important entities under the Cbw, with incident reporting expected from 1 April 2027."
canonical: "https://gencompl.ai/regulations/cyberbeveiligingsregeling-hoger-onderwijs"
language: "en-US"
type: "Regulation"
published: "2026-10-13T22:10:43.171Z"
modified: "2026-10-13T22:12:13.510Z"
---

# Cyberbeveiligingsregeling hoger onderwijs

The Cyberbeveiligingsregeling hoger onderwijs is a draft OCW regulation that makes the 54 publicly funded Dutch universities and hogescholen important entities under the Cyberbeveiligingswet. Registration and incident reporting are expected from 1 April 2027; the duty of care follows 36 months after designation.

Also known as: Dutch NIS2 regulation for higher education, Cbw designation of universities and hogescholen

**When do Dutch universities and hogescholen fall under the Cyberbeveiligingswet, and what must they report?**

Defined in: [Cyberbeveiligingswet](https://gencompl.ai/regulations/cyberbeveiligingswet) (BWBR0052872)

[Home](https://gencompl.ai/) › [Regulations](https://gencompl.ai/regulations) › Cyberbeveiligingsregeling hoger onderwijs

## When do universities and hogescholen fall under the Cyberbeveiligingswet?

**Not yet.** As at 14 October 2026 the Cyberbeveiligingsregeling hoger onderwijs is a [draft ministerial regulation](https://www.internetconsultatie.nl/cyberbeveiliging/b1) of the Ministry of Education, Culture and Science (OCW). Once adopted, it designates all 54 publicly funded universities and hogescholen as [important entities](https://gencompl.ai/glossary/belangrijke-entiteit) under [Article 13 of the Cyberbeveiligingswet](https://wetten.overheid.nl/BWBR0052872/2026-08-15), the Dutch NIS2 law. The Inspectie van het Onderwijs [expects](https://www.onderwijsinspectie.nl/actueel/nieuws/2026/08/18/cyberbeveiligingswet-brengt-nieuwe-verplichtingen-met-zich-mee-voor-het-hoger-onderwijs) the registration and reporting duties to apply from 1 April 2027. The duty of care follows 36 months after designation.

The Cbw itself entered into force on 15 August 2026, but higher education was left out of that date. Institutions can already register through the NCSC portal. They do not have to.

The consultation ran from 12 June to 10 July 2026. This page covers what the draft says, what it still leaves blank and which dates are fixed. For the Act itself, see our page on the [Cyberbeveiligingswet](https://gencompl.ai/regulations/cyberbeveiligingswet).

Checked against the consultation draft, the consolidated Cbw and Cyberbeveiligingsbesluit, and the minister's letter of 24 June 2026, as at 14 October 2026.

## At a glance

- **Official title (draft)**: *Regeling van de Minister van Onderwijs, Cultuur en Wetenschap houdende regels ter uitvoering van de Cyberbeveiligingswet en het Cyberbeveiligingsbesluit voor de sector onderwijs (Cyberbeveiligingsregeling hoger onderwijs)*
- **Type**: Ministerial regulation of OCW, made after consulting the Minister of Justice and Security
- **Status**: Draft. [Consultation](https://www.internetconsultatie.nl/cyberbeveiliging/b1) closed 10 July 2026 with 11 public responses. As at 14 October 2026 we found no adopted text in the Staatscourant
- **Legal basis**: Articles 13(1) and 68(1) [Cbw](https://wetten.overheid.nl/BWBR0052872/2026-08-15), as cited in the [draft](https://www.internetconsultatie.nl/cyberbeveiliging/document/15765)
- **Parent law**: Cyberbeveiligingswet, [Stb. 2026, 187](https://zoek.officielebekendmakingen.nl/stb-2026-187.html), implementing [Directive (EU) 2022/2555](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022L2555) (NIS2)
- **Who**: 54 publicly funded universities and hogescholen listed under a to i of the annex to the WHW
- **Classification**: Important entity (*belangrijke entiteit*). Supervision after the fact only
- **Supervisor**: Officials of the Inspectie van het Onderwijs (Article 6.1 of the draft). The competent authority is the Minister of OCW (Article 15(3) Cbw)
- **CSIRT**: Left blank in the draft. SURFcert is the intended CSIRT, per the [minister's letter of 24 June 2026](https://zoek.officielebekendmakingen.nl/kst-26643-1535.html)
- **Registration and reporting**: From designation. **1 April 2027** is indicative
- **Duty of care and board duties**: 36 months after designation (Article 97 Cbw)
- **Maximum fines**: €7 million or 1.4% of worldwide turnover for the entity (Article 87 Cbw). €25,000 for a board member (Article 93 Cbw)

## What does the draft still leave open?

Four parts of the [consultation draft](https://www.internetconsultatie.nl/cyberbeveiliging/document/15765) are placeholders marked "PM": the CSIRT chapter, the date of entry into force, and two sections of the explanatory notes (on the CSIRT, and on advice and consultation). Chapter 5 on the duty of care has a heading and no text. The explanatory notes say a sector-specific duty of care will be added by amendment, if needed, once Articles 21 and 24 Cbw start to apply.

What is settled in the draft is short. Article 2.1 makes every publicly funded institution an important entity, Article 4.1 sets four thresholds for a reportable incident, and Article 6.1 names the Inspectie as supervisor.

> **Our analysis: Two references in the draft will need to change**
>
> The draft cites Article 24(1) of the Cyberbeveiligingsbesluit as its basis for the incident thresholds. In the [Besluit as published](https://zoek.officielebekendmakingen.nl/stb-2026-189.html) in Stb. 2026, 189, that power sits in [Article 23(1)](https://wetten.overheid.nl/BWBR0052875/2026-08-15); Article 24 sets out what an early warning must contain. We read this as a draft written against an earlier numbering. Second, Article 2(1) of the Besluit makes the Minister of Justice and Security the CSIRT for every entity unless a regulation names another. Until the CSIRT chapter is filled in, the CSIRT for higher education is that minister, through the NCSC, not SURFcert.

## Who is in scope?

Every publicly funded university and hogeschool, and nothing else in education. The draft makes no distinction between institutions or between faculties. The explanatory notes say a narrower cut would be hard to carry out, given how much the institutions share and depend on each other.

| Institution | In scope? | Why |
| --- | --- | --- |
| Publicly funded universities and hogescholen (WHW annex, a to i) | **Yes**, important entity | Article 2.1 of the draft, on the basis of Article 13 Cbw |
| Mbo institutions | No | The Cbw gives no basis to designate them (explanatory notes). Mbo works on cyber resilience under administrative agreements instead |
| Primary and secondary schools | No | Not covered by the Cbw, per the [Inspectie](https://www.onderwijsinspectie.nl/actueel/nieuws/2026/08/18/cyberbeveiligingswet-brengt-nieuwe-verplichtingen-met-zich-mee-voor-het-hoger-onderwijs) |
| Private, non-funded higher education | No | Designation was judged not proportionate (explanatory notes) |
| An institution's activities in a sector listed in Bijlage 1 or 2 to the Cbw | Possibly, in their own right | [SURF points out](https://sec.surf.nl/cyberbeveiligingswet-faq/) that the annex sectors can apply to other activities of an institution |

## Why the lighter of the two regimes?

The Cbw would also allow the minister to designate institutions as essential entities under [Article 11](https://wetten.overheid.nl/BWBR0052872/2026-08-15). The draft does not use that option. The reason given is proportionality: since 2021 the institutions have worked under administrative agreements with OCW to raise their cyber resilience. An important entity is supervised only after the fact. Under Article 81 Cbw, the Inspectie can use its scan, audit, instruction and fine powers only once it has evidence or an indication of a possible breach.

## What does it require?

Three duties, which arrive at two different moments.

### Registration

[Article 44 Cbw](https://wetten.overheid.nl/BWBR0052872/2026-08-15): name, address, contact details including e-mail addresses and IP ranges, and the sector. Changes within two weeks. The explanatory notes estimate 20 hours per institution to register once.

### Reporting incidents

Articles 26, 27 and 29 Cbw set the clock: an early warning without delay and within 24 hours of becoming aware, a notification with an initial assessment within 72 hours, and a final report within one month of that notification. Reports go to the CSIRT and to the competent authority. The draft explanatory notes say both can be reached in one go through the central reporting point at mijn.ncsc.nl.

### Duty of care and board accountability, later

[Article 97 Cbw](https://wetten.overheid.nl/BWBR0052872/2026-08-15) delays Articles 21 and 24 for designated higher education institutions until 36 months after designation. Article 21 is the duty to take risk management measures in ten areas, from incident handling to multi-factor authentication. Article 24 makes the board approve those measures and hold a training certificate. Until then, the [minister's letter of 24 June 2026](https://zoek.officielebekendmakingen.nl/kst-26643-1535.html) says, there is no external supervision of the duty of care.

## Which incidents must a university report?

Article 4.1 of the [draft](https://www.internetconsultatie.nl/cyberbeveiliging/document/15765) sets four thresholds for a [significant incident](https://gencompl.ai/glossary/significant-incident). Meeting any one is enough, and so is an incident that could lead to one of these effects. Planned maintenance does not count.

*Art. 4.1(1)(a)*

### Critical processes down for 24 hours

Critical business processes are largely or fully disrupted, or stopped, for at least 24 hours. The draft assumes institutions have defined those processes, for example with the HORA reference architecture.

*Art. 4.1(1)(b)*

### Exams, diplomas and degrees

Education data is affected in a way that puts careful examination, the award of certificates or the granting of titles and degrees at risk.

*Art. 4.1(1)(c)*

### Research data

Research is seriously disrupted by irreparable damage to or loss of research data, or by its unauthorised disclosure.

*Art. 4.1(1)(d)*

### Compromised systems

A network or information system is compromised or destroyed by unauthorised access that is presumably malicious, and that could lead to any of the above. The notes give hacks, theft and ransomware as examples.

> **Our analysis: What the 24-hour clock costs**
>
> The [draft's](https://www.internetconsultatie.nl/cyberbeveiliging/document/15765) regulatory burden study, by Sira Consulting, assumes about 2 reportable incidents per institution a year, 108 across the sector. It puts the structural burden at €1,077,948 a year. Of that, €837,216 is on-call cover outside office hours, so that an early warning can go out within 24 hours. By our arithmetic that is 78% of the total; the reports themselves cost €191,160. Institutions and the sector CSIRT estimate that 75% of these incidents will also be a personal data breach, reported separately to the [Autoriteit Persoonsgegevens](https://gencompl.ai/authorities/autoriteit-persoonsgegevens) under the GDPR.

> **What we could not establish: The first threshold depends on work many institutions have not finished**
>
> The burden study notes that some institutions have mapped their critical business processes only in part, or not at all. Threshold (a) cannot be applied without that list. How many institutions are in that position, the draft does not say.

## The dates

All dates for higher education under the Cyberbeveiligingswet, past and future, with how certain each one is.

### 2025

- **24 April 2025 · Set by OCW**: Minister informs the Tweede Kamer that publicly funded higher education will be brought under the Cbw

### 2026

- **12 June 2026 · Set by OCW**: Draft regulation published for consultation
- **24 June 2026 · Set by OCW**: Letter to the Tweede Kamer (26643, nr. 1535): all funded institutions to be important entities, Inspectie as supervisor, SURFcert as intended CSIRT
- **10 July 2026 · Set by OCW**: Consultation closes with 11 public responses
- **15 August 2026 · Set by law (Art. 35 Cyberbeveiligingsbesluit)**: Cbw and Cyberbeveiligingsbesluit enter into force; higher education not yet designated

### 2027

- **1 April 2027 · Indicative: Inspectie van het Onderwijs, 18 August 2026**: Designation takes effect; registration duty (Art. 44 Cbw) and reporting duty (Arts. 26 to 29 Cbw) apply

### 2030

- **36 months after designation · Calculated (Art. 97 Cbw); 1 April 2030 if designation is on 1 April 2027**: Duty of care (Art. 21 Cbw) and board duties (Art. 24 Cbw) apply

### Without an official date

- **Within three years of entry into force · Proposed (draft explanatory notes)**: Evaluation of the whole regulation

## Who supervises, and how?

The [minister's letter](https://zoek.officielebekendmakingen.nl/kst-26643-1535.html) calls this a new and separate task for the Inspectie. The same letter, of 24 June 2026, says SURF would set up a new private legal entity to act as the CSIRT, and that the procedure for it was expected to start after the summer. As at 14 October 2026 we found no announcement that it had.

| Role | Who | Basis |
| --- | --- | --- |
| Competent authority | Minister of OCW | Article 15(3) [Cbw](https://wetten.overheid.nl/BWBR0052872/2026-08-15) |
| Supervisor | Officials of the Inspectie van het Onderwijs | Article 68(1) Cbw, Article 6.1 of the draft |
| CSIRT | Blank in the draft. SURFcert intended; until then the Minister of Justice and Security (NCSC) | Article 16 Cbw, Article 2 [Cyberbeveiligingsbesluit](https://wetten.overheid.nl/BWBR0052875/2026-08-15) |
| Reporting entry point | NCSC central reporting point (mijn.ncsc.nl) | Draft explanatory notes |
| Personal data breaches | [Autoriteit Persoonsgegevens](https://gencompl.ai/authorities/autoriteit-persoonsgegevens), separately | GDPR |

## What has changed?

**18 August 2026.** The [Inspectie van het Onderwijs](https://www.onderwijsinspectie.nl/actueel/nieuws/2026/08/18/cyberbeveiligingswet-brengt-nieuwe-verplichtingen-met-zich-mee-voor-het-hoger-onderwijs) wrote that it expects universities and hogescholen to have to comply from 1 April 2027 with the registration and reporting duties, and that the duty of care starts 36 months later.

**15 August 2026.** The Cyberbeveiligingswet and the Cyberbeveiligingsbesluit entered into force. Higher education was not designated on that date.

**10 July 2026.** The [consultation](https://www.internetconsultatie.nl/cyberbeveiliging/b1) closed with 11 public responses, among them one from the Vereniging Hogescholen.

**24 June 2026.** Minister Letschert [confirmed to the Tweede Kamer](https://zoek.officielebekendmakingen.nl/kst-26643-1535.html) that all publicly funded institutions will be important entities, with the Inspectie as supervisor and SURFcert as intended CSIRT. She also announced that mbo stays outside the Cbw.

**12 June 2026.** OCW published the draft regulation for consultation.

> **What we could not establish: What we did not read**
>
> We did not read the 11 consultation responses, so this page does not say what the sector asked to change. We also did not read the policy form (*Beleidskompasformulier*) published with the draft. Some figures in the draft burden study are garbled in the consultation PDF; we use only those that appear intact in its tables.

## What can GenCompl.ai do for you?

Our pipeline tracks the Cyberbeveiligingswet, the Besluit and each sector regulation made under them, including this one from draft to Staatscourant. When the CSIRT chapter is filled in or the entry into force is fixed, the dates on this page and in your own obligations view are recalculated, with the article and the source that changed them.

- [Book a working session](https://gencompl.ai/contact)

## Questions and answers

### Are universities already covered by the Cyberbeveiligingswet?

No. The Cbw entered into force on 15 August 2026, but publicly funded universities and hogescholen only fall under it once the Minister of OCW designates them. That designation is in the draft Cyberbeveiligingsregeling hoger onderwijs. As at 14 October 2026 it had not been adopted. The Inspectie van het Onderwijs expects the registration and reporting duties to apply from 1 April 2027.

### Is a hogeschool an essential or an important entity?

An important entity. Article 2.1 of the draft designates all publicly funded universities and hogescholen as important entities under Article 13 Cbw. The minister chose not to use Article 11, which would have made them essential entities. As important entities they are supervised only after the fact, and Article 87 Cbw caps their fine at €7 million or 1.4% of worldwide turnover.

### What counts as a significant incident for a university?

Under Article 4.1 of the draft, an incident is significant if it disrupts critical business processes for at least 24 hours, puts exams, diplomas or degrees at risk, seriously disrupts research through loss or disclosure of research data, or compromises a system through presumably malicious unauthorised access. An incident that could cause one of these effects also counts. Planned maintenance does not.

### When does the duty of care apply to higher education?

36 months after designation. Article 97 Cbw delays the duty of care (Article 21) and the board duties (Article 24) for designated higher education institutions by that period. If designation takes effect on 1 April 2027, as the Inspectie expects, that is 1 April 2030. The draft regulation leaves its own duty-of-care chapter empty for now.

### Who supervises universities under the Cyberbeveiligingswet?

The officials of the Inspectie van het Onderwijs, under Article 6.1 of the draft and Article 68(1) Cbw. The Minister of OCW is the competent authority under Article 15(3) Cbw. SURFcert is the intended CSIRT, but the draft's CSIRT chapter was still blank in the consultation version.

### Does the regulation cover mbo institutions or private colleges?

No. The explanatory notes say the Cbw gives no basis to designate mbo institutions, and that designating non-funded institutions would not be proportionate. Primary and secondary schools are not covered either. Mbo works on cyber resilience under administrative agreements with OCW.

### Do we still report data breaches to the Autoriteit Persoonsgegevens?

Yes. A Cbw report does not replace a GDPR data breach notification. The draft's burden study expects about 75% of reportable incidents at institutions to involve personal data, which means two reports for the same incident: one through the NCSC reporting point, one to the Autoriteit Persoonsgegevens.

## Sources

- [Consultatie Cyberbeveiligingsregeling hoger onderwijs](https://www.internetconsultatie.nl/cyberbeveiliging/b1) (Internetconsultatie (OCW) · 12 June 2026)
- [Cyberbeveiligingsregeling hoger onderwijs: consultation draft with explanatory notes (PDF)](https://www.internetconsultatie.nl/cyberbeveiliging/document/15765) (Internetconsultatie (OCW) · 12 June 2026)
- [Cyberbeveiligingswet, consolidated text BWBR0052872](https://wetten.overheid.nl/BWBR0052872/2026-08-15) (wetten.overheid.nl · 15 August 2026)
- [Staatsblad 2026, 187: Cyberbeveiligingswet](https://zoek.officielebekendmakingen.nl/stb-2026-187.html) (Staatsblad)
- [Cyberbeveiligingsbesluit, consolidated text BWBR0052875](https://wetten.overheid.nl/BWBR0052875/2026-08-15) (wetten.overheid.nl · 15 August 2026)
- [Staatsblad 2026, 189: Cyberbeveiligingsbesluit](https://zoek.officielebekendmakingen.nl/stb-2026-189.html) (Staatsblad)
- [Kamerstuk 26643, nr. 1535: Voortgang aanpak cyberweerbaarheid in het vervolgonderwijs](https://zoek.officielebekendmakingen.nl/kst-26643-1535.html) (Tweede Kamer · 24 June 2026)
- [Cyberbeveiligingswet brengt nieuwe verplichtingen met zich mee voor het hoger onderwijs](https://www.onderwijsinspectie.nl/actueel/nieuws/2026/08/18/cyberbeveiligingswet-brengt-nieuwe-verplichtingen-met-zich-mee-voor-het-hoger-onderwijs) (Inspectie van het Onderwijs · 18 August 2026)
- [Directive (EU) 2022/2555 (NIS2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022L2555) (EUR-Lex)
- [Cyberbeveiligingswet FAQ](https://sec.surf.nl/cyberbeveiligingswet-faq/) (SURF Security Expertise Centrum)
- [Cyberbeveiligingswet: stand van zaken, planning en gevolgen voor hoger onderwijs](https://sec.surf.nl/cyberbeveiligingswet-stand-van-zaken/) (SURF Security Expertise Centrum)

## Related content

### Regulation

- [Cyberbeveiligingswet (Dutch NIS2)](https://gencompl.ai/regulations/cyberbeveiligingswet): The Cyberbeveiligingswet is the Dutch implementation of NIS2, Directive (EU) 2022/2555. It entered into force on 15 August 2026 and covers more than 8,000 organisations. Registration, the duty of care and the 24-hour and 72-hour reporting duties applied from day one. Banks are largely displaced to DORA by Articles 22 and 31, but their IT suppliers are not.