← All resources

NIS2 Netherlands: is your manufacturing plant in scope?

Published October 26, 2026 · 8 min read · CyberNovaLabs.io

In the Netherlands NIS2 is called the Cyberbeveiligingswet, in force since 15 August 2026. For a factory the test is not "we make things": six precise Annex II categories decide, then company size. This guide gives the grid, the regulator, the registration desk and the reporting clock.

The short answer

NIS2 Netherlands, seen from a factory floor: part of Dutch manufacturing is in scope, not all of it. The Dutch transposition is called the Cyberbeveiligingswet (Cbw) and it entered into force on 15 August 2026^[1][2]. The Dutch government estimates that around 8,000 organisations fall under the Cbw, and around 500 under the separate Wet weerbaarheid kritieke entiteiten^[1].

For a manufacturer the test is not "we make things". It is first a specific activity category from Annex II of the directive, and then company size. If you produce machinery, electronics, electrical equipment, vehicles or medical devices, you are very likely in scope. If you do contract machining, sheet metal, plastics, packaging or furniture, you are probably not directly covered — and the supply chain will reach you anyway, through the security questionnaires of customers who are.

The six Annex II categories that decide

Annex II of Directive (EU) 2022/2555 does not take "manufacturing" as a block. It lists precise activity divisions^[7]:

Watch the medical device trap: the Annex II entry points to the legal definition of a medical device, not to a single NACE division^[7]. A machining subcontractor producing a critical implant part can therefore be in scope even though its KvK SBI code gives no hint of it.

Are you in scope? Four questions

• Does my actual activity fall into one of the six categories above? Your KvK SBI code is a clue, not the answer: the activity description in Annex II decides^[7].
• How big am I? The RDI summarises the threshold as more than 50 employees or turnover above 10 million euros^[6]. The official NCTV brochure gives the exact matrix: large from 250 employees, or above 50 million euros turnover and 43 million balance sheet; medium between 50 and 249 employees, or above 10 million turnover and 10 million balance sheet^[11]. The RDI's NIS2-Zelfevaluatie is the official tool for taking the test^[6].
• Does small size exempt me? Some categories fall under the Cbw whatever their size: public electronic communications networks and services, trust service providers, top-level domain name registries, DNS service providers, domain name registration services and public bodies^[11]. Manufacturing is not on that list: below the threshold, a plant drops out of direct scope.
• Am I an "important" or an "essential" entity? Manufacturing sub-sectors sit in Annex II, so in principle in the important entity category; you only move to essential through a specific designation^[7]. The difference drives the supervisory regime — proactive for essential entities^[11] — and the fine ceiling.

And a fifth question that is not in the Act: do I supply an in-scope entity? If so the Cbw does not apply to you, but your customer's supply-chain obligations will reach you by contract.

NIS2 Netherlands: who supervises you, and where to register

Two authorities share Dutch manufacturing:

• The RDI (Rijksinspectie Digitale Infrastructuur) is the supervisory authority for the "vervaardiging" sector^[6].
• Exception: manufacturers of medical devices and in-vitro diagnostic devices are supervised by the Inspectie Gezondheidszorg en Jeugd (IGJ)^[8].

Registration is centralised: it runs through the Nationaal Cyber Security Centrum at mijn.ncsc.nl^[1][4]. It was voluntary before entry into force; it is mandatory now^[4]. This is the step manufacturers forget, because it does not look like an engineering project.

The Act is live: what order to catch up in

1. Settle scope in writing. One page: activity, Annex II category, headcount, turnover, balance sheet, conclusion, date, signature of a director. It is the first thing an inspector asks for.
2. Register at mijn.ncsc.nl if you are in scope^[4].
3. Inventory the OT. PLCs, HMIs, gateways, remote maintenance access held by machine builders. A plant inventory that stops at office PCs is worthless.
4. Write the reporting procedure before you need it: who decides an incident is "significant", who calls, which mijn.ncsc.nl account, which number at night.
5. Lock the chain. Security requirements in maintenance contracts, and removal of dormant remote access.

Reporting an incident: 24 hours, 72 hours, one month

The deadlines sit in articles 26 to 29 of the Cyberbeveiligingswet, and they are tight^[5]:

Note the start of that last clock: one month after the notification, not after the incident. In a factory those 24 hours fall at night or at the weekend, when the line stops and the production team calls the machine supplier first. If your procedure is not posted where the line stops, it does not exist.

Fines and management accountability

The amounts are written into the Act itself, in articles 80 (essential entities) and 87 (important entities)^[5]:

The Cbw also imposes management accountability, including an obligation of appropriate training^[1], and the regulator supervises that duty at the level of individual board members, not only the company^[11]. So the cheapest measure in the whole file is a documented half-day of board training.

What 356 self-assessments say about Dutch manufacturing

The RDI publishes its NIS2 Quickscan results by sector. For "vervaardiging", the questionnaire was fully completed 356 times between February 2024 and September 2025^[3]. Respondents rate themselves reasonably well on authentication and incident handling, and clearly weaker on supply chain, reporting procedures and training^[3]. The RDI states that this is a self-assessment and does not guarantee compliance^[3].

That is useful for sequencing: where most Dutch manufacturers rate themselves weak is where the gap will show in the first inspections. The supply chain is also what your customers will ask about first — see our guide on answering a supplier security questionnaire.

The Dutch scheme few manufacturers use

The Cyberweerbaarheidscentrum Maakindustrie (CWM) was set up in Zuid-Holland by FME and the Koninklijke Metaalunie together with Hi Delta, Security Delta (HSD) and InnovationQuarter^[10]. It offers a cyber-resilience measurement, practical advice, workshops, threat intelligence and access to experts, covering IT and OT^[10]. It is not a national programme, and membership makes nobody compliant — but for a plant in Rotterdam or Delft it is the cheapest way in.

The first 5 actions

1. Take the free NIS2 check, then the RDI NIS2-Zelfevaluatie, and file the result with a date on it.
2. Register at mijn.ncsc.nl if you are in scope.
3. List every machine supplier's remote access and cut the dormant ones this week.
4. Write the 24h / 72h / 1 month procedure and post it where the line stops.
5. Book the board training and keep the evidence.

Read next: our guide to NIS2 in Belgium for manufacturing and production, which uses the same grid with the CCB and the CyberFundamentals framework, and NIS2 Netherlands for software vendors and IT providers, useful if your MES or ERP is hosted by a third party. On OT risk itself, see industrial controllers exposed on the internet.

At CyberNovaLabs.io

Start with the free NIS2 check: in a few minutes it tells you whether the six Annex II categories catch you, and at which level. The NIS2 Netherlands — manufacturing page sets out the thresholds and the competent authorities. For the board training the Cbw requires, see our in-company training. And if you want a second pair of eyes on your own case, tell us in two lines what you manufacture: we answer on scope, not with a quote.

Sources

1. Rijksoverheid — Cyberbeveiligingswet en Wet weerbaarheid kritieke entiteiten vanaf 15 augustus 2026 van kracht
2. RDI — De Cyberbeveiligingswet treedt in werking (15/08/2026)
3. RDI — Resultaten NIS2-Quickscan, sector vervaardiging
4. NCSC — Veelgestelde vragen Cyberbeveiligingswet (NIS2)
5. Cyberbeveiligingswet, Staatsblad 2026, 187 — art. 26 à 29 (meldplicht), art. 80 et 87 (bestuurlijke boete)
6. RDI — Cyberbeveiligingswet (toezicht et NIS2-Zelfevaluatie)
7. EUR-Lex — Directive (UE) 2022/2555 (NIS2), annexe II
8. CMS — Cyberbeveiligingswet voor fabrikanten van medische hulpmiddelen (toezicht IGJ)
9. NCSC — DTC en NCSC vanaf 2026 verder als versterkt NCSC
10. Cyberweerbaarheidscentrum Maakindustrie (FME, Koninklijke Metaalunie, HSD)
11. NCTV — Informatiebrochure Cyberbeveiligingswet 2026 (omvangscriteria)

Read next