NIS2 Netherlands: are estate agents and letting firms in scope?
The Dutch Cybersecurity Act has applied since 15 August 2026 to some 8,000 organisations. Real estate is not among them. What does bind you: the Wet goed verhuurderschap, client questionnaires, and the ICT provider you share.
The short answer
No, in almost every case. In the Netherlands, NIS2 is implemented by the Cyberbeveiligingswet (Cbw), in force since 15 August 2026[4]. It covers roughly 8,000 organisations across eighteen (highly) critical sectors[1][2]. Estate agency (makelaardij), letting management and owners' association management (VvE-beheer) appear in neither Annex 1 nor Annex 2. A 40-person Dutch property firm therefore has no registration duty and no incident-reporting duty under the Cbw.
What does reach you sits elsewhere, and this is where deals stall: the security questionnaires your institutional clients send, the Wet goed verhuurderschap and its written-evidence duties, and the IT provider you share with twenty peers. Eight Dutch housing associations learned that last part through a single ICT supplier in March 2022[7].
NIS2 Netherlands and real estate: are you in scope?
The Dutch NCSC reduces scope to two questions, in this order[1].
Question one: is your sector in an annex? Here are both lists as the Act sets them out.
| Annex 1 — highly critical sectors | Annex 2 — other critical sectors |
|---|---|
| Energy · Transport · Banking · Financial market infrastructure · Health · Drinking water · Waste water · Digital infrastructure · ICT service management · Public administration · Space | Digital providers · Post and courier · Waste management · Food · Chemicals · Research · Manufacturing |
Real estate, letting and property management are absent. That is not an oversight: NIS2 protects services whose failure hits the public, not intermediation trades.
Question two: your size. The size cap (omvangscriteria) is met if you have 50 FTE or more, or fewer than 50 FTE but an annual turnover and a balance sheet total that both exceed 10 million euros[1]. Note that partner and linked undertakings — a parent company, subsidiaries — count towards headcount, turnover and balance sheet. A 300-person property group still sits outside the Act if it fails question one: sector decides, size only filters afterwards.
Unsure? The RDI Zelfevaluatie settles it in minutes and also tells you whether you would be an "essential" or an "important" entity[1][4]. The assessment is yours to make: the RDI stresses that every organisation determines its own applicability[4].
The three doors through which the Cbw still reaches you
1. You supply an in-scope entity. The NCSC states plainly that some suppliers can fall under the Act[1], and the duty of care owed by in-scope entities extends to their supply chain. In practice: a hospital, a grid operator or a public body that hands you its rental portfolio will pass its requirements to you by contract, not by statute. The mechanism is identical for Dutch construction firms, also out of scope and questioned anyway.
2. One entity in your group is in an annex. A housing association running a heat network, a services company managing drinking water on a site: a side activity can pull one legal entity of the group into scope. Scope is reasoned per entity and per service, never per logo.
3. You are assessed without being in scope. This is the most common situation and the most expensive in sales time: Dutch institutional tenders now copy Cbw requirements into their supplier grids. You answer the same questions as an essential entity, without the regulatory support that comes with the status. A ready supplier security questionnaire template saves about two weeks on the first bid.
If you were in scope — worth knowing, because it is what your clients are living through. Mandatory registration in the national entity register via Mijn.NCSC.nl since 15 August 2026, enforceable by a fine or a penalty payment order (last onder dwangsom)[5]. Phased reporting: early warning within 24 hours, notification within 72 hours, final report within one month, filed through a single desk that reaches both your sectoral CSIRT and the supervisor[3]. Plus a board training duty: since entry into force, management body members are expected to train on recognising and assessing security risks[4].
What Dutch law actually demands of you: the Wet goed verhuurderschap
This is the statute that does bind you. The Wet goed verhuurderschap (Wgv) applies to landlords, letting intermediaries and managers of residential and accommodation space. Its Article 2 requires, among other things: a clear and transparent selection procedure, objective selection criteria communicated when the property is offered, reasons given to rejected candidates for the tenant chosen, a written tenancy agreement, and written information to the tenant covering rights and obligations, the amount and treatment of the deposit, contact details for a point of contact, and the contact details of the municipality's meldpunt[6].
Two Dutch specifics are easy to miss. First, when letting to migrant workers, the tenancy agreement must be recorded separately from the employment contract, and the information must be provided in a language the tenant prefers[6]. Second, a municipal council may introduce a verhuurvergunning — a letting permit — for designated areas or categories of housing[6]. Enforcement is municipal, not national.
The link to information security is direct and almost nobody draws it: every one of those duties is a duty of written proof. Ransomware encrypting your tenancy file system does not only expose you to a data breach; it leaves you unable to show the municipality that you gave reasons for a rejection, handed over the deposit information, or itemised the service charges. Availability of your records has become a housing-law compliance condition.
The precedent that matters: eight associations halted by one supplier
On 27 March 2022, eight Dutch housing associations were told on the same day that a criminal organisation had breached them. Alwel, Laurentius and Trivire were among them. Email was unusable at most of them; directors fell back on Teams, WhatsApp and private addresses. The internal crisis app, built for exactly this, was down too. They had to decide whether to pay a bitcoin ransom and assess the risk of tenant, supplier and employee data appearing on the dark web[7].
What the eight had in common: a shared external ICT provider. That is the operating model of Dutch real estate — pooling sector software across mid-sized organisations — and it is exactly what turns a supplier incident into a sector incident. Aedes published the joint evaluation as "Samen uit, samen thuis"[7] and maintains the Baseline Informatiebeveiliging Corporaties (BIC), a sector information-security baseline that is not mandatory[8]. For a private manager, the BIC is still the closest thing to a trade-specific control set in Dutch.
The risk that actually costs money: the diverted payment
Before ransomware comes the altered invoice. In 2025 the Fraudehelpdesk logged 101,734 reports, 60% more than in 2024, 15,116 people reporting financial loss (+65%) and a total reported loss of 68,492,848 euros (+30%)[9]. These are national, all-sector figures: they do not measure property fraud, and presenting them as such would be dishonest. They give the order of magnitude of a method your trade is structurally exposed to, because it moves deposits, rents and service-charge settlements between parties who have never met.
Run this on your own numbers (replace the assumption): average deposit × tenancies signed per month = the amount exposed each month to an unverified change of bank details. Control rule: confirm every IBAN change on a phone number you already held, never the one printed in the email or on the invoice.
The first five actions
- Settle your status in writing, once. Run the RDI Zelfevaluatie, print the outcome, date it. That single PDF answers every client questionnaire asking "are you in scope of NIS2?" for the next twelve months.
- Bring your email up to standard. SPF, DKIM and DMARC on an enforcing policy: the direct countermeasure to payment diversion and the first line of any supplier grid. Our free email security check gives a verdict on your domain in a minute.
- Name your ICT dependency. One page: who hosts your trade software, who administers your accounts, what recovery time is contractually owed, who tells tenants if that provider goes down. The eight associations of 2022 found those answers mid-crisis[7].
- Back up out of reach. One copy of tenancy files and accounts, isolated from the domain, restore-tested quarterly. That is what lets you evidence your Wgv duties even during an incident.
- Write your standard questionnaire answers. The same twenty questions recur. Answered once properly, they shorten every institutional tender after that.
For the country picture, see our NIS2 Netherlands page; for the same trade under a different national law, our read on Belgian estate agents and syndics, where the regime and the supervisor differ.
At CyberNovaLabs.io
CyberNovaLabs.io works in the Netherlands, Belgium, France and Luxembourg. Start with the free NIS2 check: it places your organisation and, if you are out of scope like most property businesses, tells you what your clients will ask for anyway.
If your problem is as commercial as it is regulatory, we also fill diaries: see B2B appointment setting in commercial real estate and our Amsterdam page. Quoted per engagement, no minimum term.
Ask for a 30-minute review of your exposure: email, ICT dependency, client questionnaires.
Sources
- NCSC — Valt mijn organisatie onder de Cyberbeveiligingswet (NIS2)?
- NCSC — Cyberbeveiligingswet (NIS2)
- NCSC — Meld incidenten onder de Cyberbeveiligingswet (meldplicht)
- RDI — De Cyberbeveiligingswet treedt in werking (15 augustus 2026)
- RDI — Registratieplicht Cyberbeveiligingswet
- Wet goed verhuurderschap (wetten.overheid.nl)
- Aedes — De digitale inbraak bij 8 corporaties
- Aedes — Informatiebeveiliging en privacy (Baseline Informatiebeveiliging Corporaties)
- Fraudehelpdesk — Terugblik 2025
Qualified meetings, no lock-in.
Criteria in writing before launch, pay per meeting or monthly, stop with a simple email.
Read next
Critical PHP flaws: your website is affected (21/10/2026)
Two critical vulnerabilities in PHP, the engine under most small-business websites, allow unauthenticated remote code execution. Patches shipped on 21 October 2026. What to check this week, and what will never be fixed.
Read the article →October 22, 2026 · 9 min readNIS2 Netherlands: are software vendors and IT providers in scope?
Publishing software is not a listed category in Dutch law. Running a client's infrastructure, hosting it, monitoring it, is. Here is how to settle your own case in ten minutes, with the Dutch dates, the right regulator and the main-establishment rule that decides who inspects you.
Read the article →October 19, 2026 · 8 min readNIS2 Belgium: webshops, marketplaces and the CCB register
A Belgian webshop selling its own products is almost never in scope of NIS2. A marketplace is — as an important entity that had to register with the CCB by 18 December 2024, three months ahead of everyone else. What applies, what does not, and what your customers will ask for anyway.
Read the article →October 18, 2026 · 7 min readB2B appointment setting for accounting firms and fiduciaries
Two very different briefs hide behind "I want meetings with accountants": selling to firms, or being a firm that needs clients. The first runs into a calendar set by law. The second runs into a professional code that governs both promotion and taking over a colleague's engagement. Both are covered here.
Read the article →October 16, 2026 · 7 min readAlbert Heijn down four days: the supplier's view (11/10/2026)
Four working days with no systems at a major retailer. Seen from the supplier's side, that is not news: it is a week of revenue moved. The dated sequence, the three mechanisms that cost real money, and the list to clear before next Friday.
Read the article →October 16, 2026 · 7 min readB2B appointment setting: 7 levers that cut no-shows
No ghosts in your calendar. A missed B2B meeting costs the prep, the slot and the follow-up. Here are 7 levers to cut your no-show rate, and what the public evidence does — and does not — let you expect.
Read the article →