Dutch Cybersecurity Act (NIS2): get a grip on vulnerabilities
Since 15 August 2026, the Dutch Cybersecurity Act (Cyberbeveiligingswet, or Cbw) has been in force. It is the Dutch implementation of the European NIS2 Directive. Organizations covered by the Act must actively manage their cyber risks and be able to show which security measures they take. Customers and insurers are also setting stricter requirements for the digital resilience of the organizations they work with.
Catcher24 helps you do this. By scanning your publicly reachable IT infrastructure and web applications automatically and regularly, you gain insight into vulnerabilities and record which risks were found, fixed, or formally accepted. That makes your vulnerability management visible, verifiable and manageable.
What the Dutch Cybersecurity Act requires
The Dutch Cybersecurity Act sets new requirements for the digital resilience of thousands of companies and organizations in the Netherlands. It applies to essential and important entities in 18 sectors, including healthcare, energy, transport, water, waste management, chemicals, food, manufacturing, digital services and public administration.
Whether your organization is in scope depends on, among other things, your sector, the size of your organization and the services you provide. The Act can also affect suppliers, for example because their customers set stricter security requirements. Operating in other EU countries? There, the national NIS2 laws of those countries apply.
Organizations covered by the Act must meet obligations including:
Duty of care
You must take appropriate security measures to manage cyber risks and prevent incidents. That starts with knowing your vulnerabilities. By checking systems regularly, assessing risks and addressing vulnerabilities in time, you reduce the chance of cyber incidents.
Incident reporting
Significant cyber incidents must be reported in time to the relevant CSIRT and supervisory authority. An early warning is generally required within 24 hours, followed by a more detailed notification within 72 hours and a final report within one month. This lets the authorities act quickly and help limit further damage.
Registration
Organizations covered by the Act must register in the national entity register. This makes them known to the responsible authorities and provides them with access to support, threat intelligence, and advice from the NCSC or their sector's CSIRT.
Board responsibility
Cybersecurity is not just a task for the IT department. The board must approve security measures, oversee their implementation and have enough knowledge to assess cyber risks. Board members are therefore also required to take appropriate cybersecurity training.
From regulatory obligations to continuous vulnerability management
The Act requires organizations to assess cyber risks regularly and take appropriate measures to manage them. An important part of this is finding, assessing, and fixing vulnerabilities in your IT environment in time.
But cyber risks don't stand still. New vulnerabilities are discovered every day, systems change, and software is constantly updated. A one-off security check only gives you a snapshot. Effective vulnerability management requires regular checks, targeted follow-up, and insight into the measures you've taken.
By running this process continuously and evidence-based and documented, you support your regulatory obligations and reduce the chance that vulnerabilities go unnoticed.
Four steps to demonstrable vulnerability management
With Catcher24, vulnerability management becomes simple, ongoing, and documented. Add your systems, have them checked automatically, and get targeted alerts as soon as vulnerabilities are found. You know where the risks are, can take targeted action, and record how you deal with them.
Add your targets and systems
Add your domains, IP addresses and web applications to your Catcher24 dashboard. Catcher24 scans your publicly reachable systems from the outside, without installing software or agents.
Schedule automated scans
Decide how often your systems are checked. By scanning automatically and regularly, you discover new vulnerabilities and keep ongoing insight into your security risks.
Address vulnerabilities in a targeted way
Receive alerts about discovered vulnerabilities, including a risk assessment and concrete recommendations. This lets you set priorities and tackle the highest-risk vulnerabilities first.
Demonstrate your security efforts
Record which vulnerabilities were found, fixed or formally accepted. With clear reports, you make your vulnerability management visible to your management, auditor or insurer, and support your accountability under the Act.
Do you supply an organization covered by the Act?
Even if your organization is not covered by the Dutch Cybersecurity Act (or by NIS2 in another country), you may still be affected. Organizations that are covered must also manage the cybersecurity risks in their supply chain. That is why they increasingly set security requirements for their suppliers and service providers, and ask for verifiable measures, for example through supplier questionnaires, audits or contractual agreements.
With Catcher24, you make your vulnerability management verifiable. You show which systems are checked, how often, which vulnerabilities were found and which measures were taken. That way, you back up your security approach with concrete results and clear reports, instead of just promises.
Catcher24 takes care of this | You arrange this yourself or with another party |
|---|---|
YesAutomated scans of your publicly reachable servers, ports, and services | ○Reporting incidents to the supervisory authority |
YesWeb application and APIs: Automated scans of your publicly reachable services | ○Access control, policy, and governance |
YesDNS and SSL checks, such as a missing DMARC record or expired certificates | ○For Dutch CLoud, network & endpoint security and additional IT services, you will be supported our partner Triplinq Hosted Solutions. |
YesRisk-based prioritization of vulnerabilities, with clear and concrete recommendations | ○A legal assessment or certification |
YesPeriodic reports showing the vulnerabilities found and how they were followed up |
|
iCatcher24 focuses on your external attack surface: the systems and services accessible from the internet. By scanning these regularly, you gain insight into vulnerabilities that external attackers may also discover. | |
Catcher24 supports vulnerability management as an important part of the regulatory obligations under the Dutch Cybersecurity Act.
The Act also requires additional technical and organizational security measures.
Frequently Asked Questions
That depends on your sector, the size of your organization, and the services you provide. The Act applies to essential and important entities in 18 sectors. Smaller organizations can also be covered in some cases. Not directly covered? You may still face additional security requirements if you supply organizations that are. Use the official information from the Dutch government and the NCSC to be sure. Link: Official information on the Dutch Cybersecurity Act
Official information of the Dutch Cyberbeveiliginswet (in Dutch)
No. Vulnerability management is one part of the broader duty of care under the Act. Catcher24 helps you find and assess vulnerabilities structurally and makes the follow-up visible. The Act also requires access control, incident management, supply chain security, and organizational measures, among other things. Catcher24 supports an important part of your security approach but does not replace a full compliance assessment.
No, they complement each other. A pentest is usually a targeted security investigation in which specialists look for vulnerabilities and try to exploit them. A vulnerability scan checks systems automatically for known security issues. The advantage of automated scans is that you can repeat them regularly. With Catcher24, you also find vulnerabilities that appeared after an earlier pentest.
The Act does not prescribe a general, fixed scanning frequency. How often you need to check depends on your risks, your systems, and any sector-specific requirements. With Catcher24, you set the scan frequency per system or application. For publicly reachable systems, we recommend running automated scans regularly as well as running extra checks after major changes. You set this per target in your Catcher24 dashboard.
A Catcher24 report shows the systems checked, the vulnerabilities found, and their severity. You see which risks need attention and which recommendations help fix them. With historical scan results and recorded follow-up, you can show how your security develops over time to your management, customers, auditors, or insurer.
Scanning publicly reachable servers, domains, and services usually requires no installation or access to your internal network. Catcher24 checks these systems from the outside.
For more extensive checks of web applications behind a login, you provide test credentials or additional configuration.
Catcher24 is a platform developed and hosted in the Netherlands. Your data is processed and stored within the Dutch hosting environment, so your security information stays in the Netherlands.
Catcher24 uses Stripe for payment processing only. Our security documentation explains the technical and organizational measures we take to protect your data.
Blogs
Read the latest insights, trends, and practical tips to make your company resilient against cyber threats.
