Protect your business against physical and digital risks

Does your business provide services that have an essential role in the functioning of society or the economy? If so, you must protect your business against digital and physical threats, such as cybercrime, terrorist offences, or natural disasters.

Essential services

If your business comes to a standstill, for example because you have been hacked by cybercriminals, this can have serious consequences for society.

For example, if you have:

• a transport company that supplies supermarkets,
• a waste management company, or
• a metalworking company that supplies parts to larger machine manufacturers.

If your business belongs to an essential sector, you must comply with the requirements for physical and digital security. These requirements are set out in the Cybersecurity Act (Cyberbeveiligingswet, Cbw, in Dutch), the Network and Information Security directive (NIS2), the Critical Entities Resilience Act ( (Wet weerbaarheid kritieke entiteiten, Wwke, in Dutch), and the Critical Entities Resilience directive (CER directive).

When must you secure your business digitally?

Your business must comply with the digital security obligations if it:

• is active in 1 of the critical sectors listed in Annex I or Annex II of the NIS2 directive, and
• is a medium-sized organisation with 50–249 employees, has an annual turnover of between €10 million and €50 million, and a balance sheet total of between €10 million and €43 million, or
• is a large organisation with more than 250 employees, has a net turnover of more than €50 million and a balance sheet total of more than €43 million, or
• is a micro or small business that provides public electronic communications networks or services, provides trust services, provides domain name registration services, or operates a top-level domain name registry within the European Union.

Digital security is mainly about improving cyber security and protecting information. If your business has obligations under the Cybersecurity Act, it is classified as providing essential or important services. How strictly your business will be supervised depends on which of these 2 categories it belongs to. Whether your business is seen as essential or important depends on the sector to which it belongs.

Please note: Even if your micro or small business is not in a sector that is automatically covered by the Cybersecurity Act, the minister responsible can still decide that the rules apply to your business. In that case, you must meet the obligations. This can happen if a risk assessment finds that your services are vital to society or the economy. You will be notified if this is the case.

What should you do to ensure digital security?

If your business must comply with digital security obligations under the Cybersecurity Act, these include the following:

Find a full overview of the digital security obligations at the National Coordinator for Counterterrorism and Security (Nationaal Coördinator Terrorismebestrijding en Veiligheid, NCTV, in Dutch).

Digital security monitoring

If your company is an important entity, you will only be inspected after an incident, or if there are indications that you have failed to comply with your obligations. Are you classified as an essential entity? In that case, the supervising authority will carry out proactive monitoring, even if there has been no incident or if there are no indications of misconduct.

The supervising authorities can differ by sector. Find out who is your supervising authority and in which situations this happens via the NCTV’s decision tree (in Dutch).

When should you physically secure your business?

Does your organisation provide services that are essential to the proper functioning of society or the economy? If your organisation operates within a critical sector (in Dutch), the responsible ministry may classify it as an critical entity. This means that your organisation has specific obligations to ensure that society or the economy is not put at risk in the event of a physical threat. If your business is classified as a critical entity, the relevant ministry will contact you.

Your company may be required to comply with physical security obligations if:

Please note: If the Ministry designates your company as a critical entity under the Critical Entities Resilience Act, your company is automatically also an essential entity under the Cybersecurity Act.

What do you need to ensure physical security?

If your organisation is classified as a critical entity under the Critical Entities Resilience Act, you have obligations to ensure physical security. Among others, you must:

View all physical security obligations on the NCTV website (in Dutch).

Monitoring physical security

The responsible ministries appoint supervisors to monitor the compliance of critical entities with their physical security obligations (in Dutch).