Cybersecurity Act Takes Effect: Register Your Organization Before It's Too Late

Cybersecurity is higher on the agenda today than ever before. Cyberattacks are becoming increasingly sophisticated, while organizations are becoming more and more dependent on digital systems and data. To strengthen Europe’s digital resilience, the NIS2 Directive was introduced several years ago.

In the Netherlands, this European directive is now being transposed into the Cybersecurity Act (Cbw). An important part of that is the new registration requirement for organizations subject to the law. Effective August 15, 2026 The organizations involved must be registered in the national entity registry.

But what does this mean, specifically, for your organization?

What is the Cybersecurity Act?

The Cybersecurity Act is the Dutch implementation of the European NIS2 Directive. Its purpose is to enhance the cybersecurity resilience of essential and important organizations and to ensure that cyber incidents are detected, reported, and addressed more quickly.

Among other things, the law imposes obligations on organizations regarding:

• Risk Management and Information Security
• Incident Reports
• Administrative Responsibility
• Supply Chain and Supplier Risks
• Mandatory registration with the government

Who is required to register?

The registration requirement applies to organizations that are classified as essential or significant entity are considered under the Cybersecurity Act. This includes, among others, organizations operating in critical sectors such as energy, healthcare, digital infrastructure, transportation, financial services, and various other sectors.

Are you unsure whether your organization is subject to the law? If so, you can use the NIS2 Self-Assessment tool provided by the National Inspectorate for Digital Infrastructure (RDI).

Why is registration important?

The registration requirement is not merely an administrative formality.

The registry provides the Dutch government with insight into which organizations are subject to the Cybersecurity Act, so that oversight, support, and information sharing regarding cyber threats can be properly organized. In addition, registered organizations receive relevant threat intelligence and can be contacted more quickly in the event of cyber incidents.

Failure to register may also result in enforcement actions, including fines or other penalties.

What do you need to register?

The key is to gather the information in advance. According to the NCSC, the following information, among other things, is requested:

• Organization Information
• Contact Information for Responsible Persons
• Public IP addresses or IP ranges
• Domain Names
• Any Autonomous System Numbers (ASNs)
• Information about the industry in which the organization operates

This often requires the involvement of various internal stakeholders, such as the IT manager, CISO, network administrator, or compliance officer.

How does the registration process work?

Organizations can register via MyNCSC using eHerkenning (EH2+) or via Single Sign-On Rijk for affiliated government organizations. The NCSC recommends verifying in advance whether the required access rights are available.

After logging in, you will be guided through the registration process step by step. Once all the information has been entered correctly, the organization is officially registered. Any changes to the information must be reported afterward within the specified time frame.

Don't wait until the deadline

Many organizations are still hard at work preparing for the Cybersecurity Act. However, registration is only one part of the bigger picture. In addition to the registration requirement, organizations are also expected to align their cybersecurity policies, processes, and technical measures with the requirements of the law.

Starting early not only helps you avoid administrative pressure right before the deadline, but also allows you to identify any compliance or cybersecurity weaknesses more quickly.

How can Alistar help?

The Cybersecurity Act isn't just about complying with regulations. Ultimately, it's about protecting your organization, employees, customers, and business continuity.

Alistar helps organizations strengthen their cyber resilience through audits, risk analyses, policy development, technical security measures, and guidance on achieving compliance with NIS 2 or the Cybersecurity Act.