NIS2 Netherlands: are construction firms in scope of the Cbw?
The Dutch Cyberbeveiligingswet has applied since 15 August 2026. Construction appears in neither annex. Three business lines still pull a building company into scope, and a fourth, contractual route reaches almost every contractor working for the waterschappen.
The short answer
No. In the Netherlands, a construction, civil engineering or building services company is not in scope of NIS2 simply because it builds. The Cyberbeveiligingswet (Cbw), the Dutch law implementing the NIS2 directive, has applied since 15 August 2026 and replaces the Wbni. It covers organisations delivering essential or important services in 18 sectors: energy, drinking water, digital infrastructure, healthcare, public administration, transport and a handful of others[1]. Construction appears in neither Annex 1 nor Annex 2 of the law.
That does not make the subject irrelevant to you. Three configurations do pull a building company into scope. And a fourth, far more common one reaches you through contracts: your Dutch clients are in scope, and the law requires them to secure their supply chain[4]. It lands on your desk as a security questionnaire before award and cyber clauses in the contract.
Are you in scope? The criteria to check
The NCTV publishes a three-step method, and every organisation is responsible for its own assessment: no authority sends out a letter telling you that you are in scope[2].
- Step 1 — the sector. Does your activity match a type of entity listed in Annex 1 or 2 of the Cbw? For a general contractor, the answer is no.
- Step 2 — the size. Only if step 1 is positive: headcount, turnover and balance sheet total. Some categories are in scope regardless of size — providers of public electronic communications networks and services, trust service providers, top-level domain name registries, DNS service providers and public bodies[2].
- Step 3 — essential or important. The distinction decides how you are supervised: essential entities face proactive supervision, checked even with no incident; important entities face reactive supervision, after a signal or an incident[2].
The official Dutch tool. The NCTV points to the NIS2 Zelfevaluatie on Regelhulpen voor bedrijven: it tells you whether the Cbw applies and, if so, whether you qualify as essential or important[3]. For a group with several establishments or subsidiaries in more than one member state, the NCTV also publishes a handreiking complexe bedrijfsmodellen dated 18 March 2026, which helps decide whether Dutch law or another country's law applies[9]. To find out who supervises you, the doorverwijsboom Cyberbeveiligingswet of the same date lists ministries, CSIRTs and regulators per sector[8].
NIS2 Netherlands: the three cases where a construction firm really is in scope
What counts is the activity performed, not the company's industry code. Three business lines that are common in Dutch construction are themselves listed.
| Configuration | Why it falls in scope | What to check |
|---|---|---|
| You manufacture, not only install | Annex 2 of the Cbw covers the manufacture of machinery and equipment, electrical equipment and electronic products — not concrete or bricks[2] | A plant making cranes, lifts, switchboards or prefabricated modules with embedded electronics must be assessed separately from the rest of the group |
| You remotely manage what you installed | Business-to-business ICT service management sits in Annex 1: an installer continuously running a client's building management, access control or climate supervision looks like a managed service provider | Read the contract: occasional maintenance, or permanent operation with remote access and on-call duty? |
| You are designated a critical entity | An organisation designated by the responsible minister under the Wet weerbaarheid kritieke entiteiten (around 500 organisations, including water retention and management) qualifies by operation of law as an essential entity under the Cbw[2] | If your firm operates or manages a hydraulic structure, check whether a designation is under way |
The real issue: your clients' supply chain
Measure 4 of the duty of care, article 21(2)(d) of the Cbw, requires in-scope entities to secure their supply chain, including security aspects of the relationship with their direct suppliers and service providers[4]. In the Netherlands this hits construction for a structural reason: waterschappen, municipalities, provinces and ministries are public bodies in scope regardless of size[2]. Earthworks, road and hydraulic engineering contractors work for them every day.
Do not over-read it: article 21 does not make the construction firm itself in scope. It obliges the client to manage the risk the firm represents. In Dutch practice this travels through the tender file, not through the statute: security requirements in the specification, contractual notification duties, audit rights, continuity plans. A framework such as the BIO governs the public buyer; it does not automatically bind every subcontractor. The contract decides what is enforceable against you. Read the specification and its annexes before you price the job.
What the Cbw demands of those in scope
If one of the three cases above applies to you, four obligations open up[1].
- Registration in the national entity register, kept by the NCSC. Registration gives access to the services of the NCSC or your sector's CSIRT: threat information and assistance during incidents[7].
- Duty of care: appropriate and proportionate measures. The NCSC sets them out measure by measure with the article reference: risk analysis, incident response, continuity and backups, supply chain, cyber hygiene and training, security in acquiring and maintaining systems plus patch management, personnel and access, multi-factor authentication or passkeys, cryptography policy, and periodic review of effectiveness[4].
- Reporting duty, in three stages counted from the moment you learn of the incident: early warning within 24 hours, notification within 72 hours, final report within one month. An incident lasting beyond a month triggers a progress report. A single filing on MijnNCSC reaches both your sectoral CSIRT and your regulator. Significance thresholds are set by ministerial regulation and differ between sectors: check the one covering yours[5].
- Management accountability: the board approves the measures, oversees their implementation, and its members must follow suitable training so they can judge the risks[1].
Penalties. The Cbw caps the administrative fine at EUR 10 million or 2 % of total worldwide annual turnover for an essential entity (art. 80(3)) and at EUR 7 million or 1.4 % for an important entity (art. 87(3)), whichever is higher[6].
The Dutch numbers for the sector
Statistics Netherlands (CBS), in the Cybersecuritymonitor 2025, records a general decline: 4 % of Dutch companies suffered at least one cyber incident from an external attack in 2024, against 11 % in 2016. Construction lags on one specific point: 12 % of firms in the bouwnijverheid carry cyber incident insurance, one of the lowest shares in the economy alongside transport and storage and hospitality, against a national average of 19 %[10]. On the trade side, Bouwend Nederland relays ABN AMRO research finding that one construction company in three is hit by hackers, while many players do not see themselves as an attractive target[11]. That is a private sector survey, not an official statistic: treat it as an order of magnitude.
Read the two together and the conclusion is practical: the risk is not zero, it is poorly covered, and exposure increasingly runs through project data shared between client, design office and subcontractors.
The first five actions
- Run the official zelfevaluatie[3] and keep the dated result. If it comes out negative, that is exactly the document to attach when a client asks for your NIS2 status.
- Assess your business lines separately: manufacturing, remote operation of installations, foreign subsidiaries. For a multi-establishment group, use the handreiking complexe bedrijfsmodellen[9].
- Go through your three largest live public contracts and extract the cyber requirements you have already signed: notification, remote access, backups, audit rights. Many firms discover obligations they are not meeting.
- Lock the basics: multi-factor authentication or passkeys on email and remote access, offline backup proven by an actual restore, patching on VPN gateways and site laptops. Those are measures 6, 8 and 3 of the duty of care[4] — and also the first three lines of any client questionnaire.
- Prepare a standard answer sheet for security questionnaires and name an owner. Without it, every tender starts from scratch.
At CyberNovaLabs.io
CyberNovaLabs.io works in the Netherlands, Belgium, France and Luxembourg. For a first read, use the free NIS2 check, then the email security check: SPF, DKIM and DMARC are the first thing a client verifies without asking you. If the pain is client questionnaires, start from the supplier security questionnaire.
For the Dutch context, read our guide on NIS2 in the Netherlands for transport and logistics — that sector is listed — and NIS2 in the Netherlands for law firms, which covers the same out-of-scope-but-subcontracting angle. The country overview sits on NIS2 Netherlands, with pages on manufacturing and managed IT services for the two lines that pull a builder into scope.
Need a view on a specific tender file, or a clean-up before a Dutch bid? Tell us about your situation — we quote after reading the documents.
Sources
- Rijksoverheid — Cyberbeveiligingswet en Wet weerbaarheid kritieke entiteiten vanaf vandaag van kracht (15-08-2026)
- NCTV — Welke organisaties vallen onder de Cyberbeveiligingswet?
- Regelhulpen voor bedrijven — NIS2 Zelfevaluatie NL
- NCSC — Zorgplicht Cyberbeveiligingswet (art. 21 Cbw)
- NCSC — Meld incidenten onder de Cyberbeveiligingswet (meldplicht)
- Staatsblad 2026, 187 — Cyberbeveiligingswet (art. 80 lid 3 en art. 87 lid 3)
- NCSC — Registreren in het nationaal entiteitenregister
- NCTV — Doorverwijsboom Cyberbeveiligingswet (18-03-2026)
- NCTV — Handreiking complexe bedrijfsmodellen (18-03-2026)
- CBS — Minder bedrijven met cyberincident, vooral grote bedrijven weerbaarder (Cybersecuritymonitor 2025)
- Bouwend Nederland — ABN AMRO peilt cyberveiligheid in de bouw
Qualified meetings, no lock-in.
Criteria in writing before launch, pay per meeting or monthly, stop with a simple email.
Read next
Critical PHP flaws: your website is affected (21/10/2026)
Two critical vulnerabilities in PHP, the engine under most small-business websites, allow unauthenticated remote code execution. Patches shipped on 21 October 2026. What to check this week, and what will never be fixed.
Read the article →October 22, 2026 · 9 min readNIS2 Netherlands: are software vendors and IT providers in scope?
Publishing software is not a listed category in Dutch law. Running a client's infrastructure, hosting it, monitoring it, is. Here is how to settle your own case in ten minutes, with the Dutch dates, the right regulator and the main-establishment rule that decides who inspects you.
Read the article →October 9, 2026 · 7 min readCNIL closes France Travail injunction, no penalty (08/10/2026)
On 8 October 2026 the CNIL closed its injunction against France Travail without applying the 5,000 EUR daily penalty. For an SME, the useful part is not the 5 million fine but the four security measures the regulator treated as mandatory.
Read the article →October 9, 2026 · 7 min readHow many B2B meetings does it take to sign one client?
If one qualified meeting in four closes, you need four meetings per client. That number means nothing in your business. Here is the six-stage model, the reverse formula, and public cost benchmarks to size outbound without guessing.
Read the article →October 8, 2026 · 7 min readAtlassian 9.3 flaw: self-hosted Jira and Confluence (05/10/2026)
Scored 9.3 out of 10, no credentials needed, eight products running on your own servers: the Atlassian advisory of 5 October, repeated by CERT-EU on 7 October, calls for an immediate upgrade of internet-facing instances.
Read the article →October 8, 2026 · 8 min readB2B appointment setting in healthcare, clinics and labs
Healthcare is not prospected like other sectors. Your contacts are protected by anti-gift regimes that also bind your agency, public hospitals buy through tenders, and laboratories run on a mandatory accreditation calendar. Here is what actually changes, country by country.
Read the article →