← All resources

NIS2 Netherlands: healthcare and labs under the Cbw

Published October 12, 2026 · 7 min read · CyberNovaLabs.io

In the Netherlands, the question "are we in scope?" is settled faster than in most sectors: a care provider with 50 FTE is in, and there is no transition period. Here are the exact thresholds, the regulator, the sector CSIRT, and the five actions to take this week.

The short answer

Yes, in the large majority of cases. On NIS2 Netherlands healthcare, Dutch law is blunter than in most sectors: the Cyberbeveiligingswet (Cbw) has been in force since 15 August 2026 and covers roughly 8,000 organisations in the Netherlands^[1]. A care provider (zorgaanbieder) reaching 50 full-time equivalents is in scope^[4].

Two Dutch specifics matter more than the European text. First, there is no transition period: the regulator takes the view that the sector should already be compliant, because NEN 7510 has been legally required for years for anyone processing health data^[2]. Second, healthcare is the only sector with its own ministerial regulation, the Cyberbeveiligingsregeling voor de Zorg, published in the Staatscourant on 14 August 2026^[3].

The trap: a laboratory is not in scope merely because it is a laboratory. The law names "EU reference laboratories", not ordinary diagnostic labs^[4]. A Dutch lab falls under the Cbw if it is itself a care provider in the legal sense. Otherwise it gets the obligations second-hand, as a supplier to a hospital that will push them down by contract.

Are you in scope? The Dutch criteria

The Cbw names five healthcare categories^[4]: care providers (zorgaanbieders), EU reference laboratories, entities carrying out R&D on medicinal products, manufacturers of basic pharmaceutical products and preparations, and manufacturers of medical devices.

Then comes the size threshold, which the Dutch call the size cap:

• at least 50 full-time equivalents; or
• failing that, annual turnover above 10 million euros and a balance sheet total above 10 million euros^[4].

Three Dutch exceptions are worth knowing, because they pull in organisations that thought they were out:

• a manufacturer of medical devices is always an important entity, whatever its size^[4];
• an organisation designated by the Ministry of Health (VWS) automatically becomes an essential entity, even below the threshold; the same applies if it is designated a critical entity under the Wet weerbaarheid kritieke entiteiten^[4];
• youth care providers (jeugdhulpaanbieders) are outside the Cbw: they are held to ISO 27001 or an equivalent standard through the Jeugdwet^[2].

Essential or important: what actually changes

Thresholds and supervisory regime: Ministry of Health and IGJ^[4][5]. Every provision of the Cbw applies to both categories; the difference is how the inspectorate comes knocking^[4]. A general hospital is therefore almost certainly essential. A 60-person independent clinic will be important: same duties, but supervision triggered by a signal.

What the law requires in the Netherlands

The IGJ (Inspectie Gezondheidszorg en Jeugd) is the supervisory authority for healthcare, and Z-CERT is the sector CSIRT, formally designated by an order published in the Staatscourant on 5 October 2026^[6]. The inspectorate lists five duties, plus one right^[5]:

1. Registration: register with the national NCSC portal and keep your details current^[5].
2. Duty of care (zorgplicht): a risk assessment you perform yourself, then proportionate measures, supply chain included^[4].
3. Board accountability: the board is ultimately responsible and must take appropriate training to be able to judge risks and measures^[5].
4. Incident reporting: a significant incident must be reported within 24 hours via MijnNCSC. The NCSC automatically forwards every health-sector report to the IGJ and to Z-CERT^[5].
5. Duty to inform: tell the people affected — patients, staff, chain partners — about the consequences and what they can do^[5].

The right is support from Z-CERT before and during an incident^[4]. Note that a Cbw report does not replace a personal data breach notification to the Autoriteit Persoonsgegevens. The IGJ works with the AP on privacy matters, and with nine other Dutch regulators under a joint cooperation protocol^[5].

What the inspectorate actually finds

This is not theory. In late 2025 the IGJ examined information security at 87 Dutch mental health organisations (ggz). Findings published on 27 May 2026: the inspectorate says it is concerned, and expects those not yet working to the standard to commission at least one independent, competent assessment within the year^[9]. It had already run the same exercise with hospitals, GP out-of-hours posts, independent clinics and elderly care organisations^[9].

In other words: in the Netherlands, sector supervision of NEN 7510 existed before the Cbw and continues. What the law mainly adds is registration, the 24-hour clock, and a board that is named as responsible.

The first five actions

1. Settle scope, in writing. Download the decision tree (beslisboom) published by the Ministry of Health and keep the dated outcome^[4]. Every organisation must assess applicability itself^[8]; under inspection, that record is what speaks.
2. Register with the NCSC portal if you are in scope, and name the person who keeps the entry current^[5].
3. Write the 24-hour procedure. Who decides an incident is "significant", who files on MijnNCSC at night and at weekends, who calls Z-CERT, who notifies the AP if personal data is involved. Run it once as a dry run.
4. Bridge NEN 7510 to the Cbw. Take Annex E of NEN 7510-2:2024+A1:2026 and mark, line by line, what is in place and what is missing^[7].
5. Train the board and date the session. Management training is an obligation in the law, not a recommendation^[5].

For a cross-border comparison, the Belgian version of this exercise is covered in our guide on NIS2 in Belgium for healthcare, hospitals and laboratories, where the authority and the timetable differ. For another sector under the same Dutch law, see NIS2 in the Netherlands for transport and logistics. The Dutch healthcare scope is summarised on our NIS2 Netherlands healthcare page.

At CyberNovaLabs.io

We start with scope and evidence, not with a tool. The two-minute NIS2 check is free and places you. After that, two things are usefully delegated: training for the board and management, which the Cbw requires, and preparing the evidence the IGJ will ask for. Our work is quoted per engagement, with no minimum term. We promise no compliance outcome: the applicability decision stays yours, and this guide is not legal advice.

Discuss your Dutch NIS2 file

Sources

1. Digitale Overheid — Cyberbeveiligingswet (NIS2-richtlijn)
2. IGJ — Vragen over cyberbeveiliging
3. Data voor gezondheid (VWS) — Cyberbeveiligingsregeling voor de Zorg gepubliceerd in de Staatscourant
4. Data voor gezondheid (VWS) — De zorgsector onder de Cyberbeveiligingswet
5. IGJ — Toezicht op cyberbeveiliging
6. Staatscourant 2026, 28763 — aanwijzing Z-CERT als CSIRT voor de zorg
7. NEN — NEN 7510-2 geactualiseerd met amendement (31/03/2026)
8. NEN — Cyberbeveiligingswet van kracht: bouw voort op uw NEN 7510-aanpak
9. IGJ — Inspectie maakt zich zorgen over informatiebeveiliging in de ggz (27/05/2026)
10. NEN — NEN 7510: informatiebeveiliging in de zorg

Read next