Do you offer digital services or do you supply essential services? You need to take measures to protect your business from cybercrime. In case of a cyber security incident you must report this. This is regulated in the Act on the security of networks and information systems (Wet beveiliging netwerk- en informatiesystemen, Wbni), the Dutch implementation of the EU's NIS-directive.
When are you a digital services provider?
A Digital Service Provider (DSP), is a legal entity that supplies 1 or more of these services:
- electronic (online) marketplace
- cloud service
- search engine
As a DSP you are subject to the Wbni act if you meet these criteria:
- Your company has its headquarters or a representation in the Netherlands.
- You have at least 50 employees.
- Your total assets or your yearly turnover amounts to over €10 million.
When are you a supplier of essential services?
You are considered a CSIRTs Network operator if this service is essential to Dutch society, such as:
- gas production and distribution
- drinking water supply
- transport
- financial transactions
If you are considered part of the critical infrastructure the Ministry of Economic Affairs and Climate Policy will let you know.
Duty of care: protection from cybercrime
You must ensure you have the right security measures and products to protect your company from cybercrime. For instance, protection against viruses, malware, and ransomware. You must prevent damage to networking and information systems.
Duty to report cybercrime
Has your company encountered a cybersecurity incident? And does this incident have major consequences? Or are your ICT systems damaged to such an extent that you can no longer provide your services? You always must report this to:
- the National Cyber Security Centre (NCSC)
and
- CSIRT-DSP, an agency of the Ministry of Economic Affairs and Climate Policy for digital service providers
- the Dutch Authority for Digital Infrastructure (Rijksinspectie Digitale Infrastructuur) for suppliers of essential services (in Dutch, scroll down for notification forms in English)
Self-assessment for digital service providers
The Dutch Authority for Digital Infrastructure's Wbni Self-assessment for digital service providers (in Dutch) helps you determine if your company is subject to the Wbni act. You complete the assessment anonymously. You can download the results and use them to improve your company’s digital resilience.