The Cyberbeveiligingswet (Dutch NIS2) for MSPs: Scope, Registration and Duties

Where the law stands

The Cyberbeveiligingswet and the Cyberbeveiligingsbesluit were published in the Staatsblad on 10 July 2026 (Stb. 2026, 187 and 189) and took effect on 15 August 2026, together with the Wet weerbaarheid kritieke entiteiten. The government estimates that about 8,000 organisations fall under the Cbw.

Older articles mention 1 July 2026 or 'the second quarter of 2026'. Those dates are out of date.

Is your MSP in scope?

Managed service providers and managed security service providers are part of the sector 'ICT service management (business-to-business)' in Annex 1 of the law. Whether you are in scope depends on size:

• Medium-sized (50 or more employees, or fewer than 50 with both turnover and balance sheet total above EUR 10 million): an important entity ('belangrijke entiteit').
• Large (250 or more employees, or turnover above EUR 50 million and balance sheet total above EUR 43 million): an essential entity ('essentiële entiteit').
• Smaller: not in scope on size, unless the government designates you, for example as the only provider of a service.

Partner and linked enterprises count towards these figures, so an MSP that is part of a group may be in scope even if the Dutch entity is small. An MSP falls under Dutch law when its main establishment in the EU, the place where cybersecurity decisions are mainly taken, is in the Netherlands.

The RDI's NIS2-Zelfevaluatie (regelhulpenvoorbedrijven.nl/NIS-2-NL) tells you in a few minutes whether you are in scope and in which category.

What an in-scope MSP must do

• Register. In-scope entities must register in the national register through MijnNCSC, using eHerkenning (level EH2+). The registration asks for contact details, IP ranges, sector, the EU member states you serve, your KvK number and your domain names. Changes must be reported within two weeks. MSPs and MSSPs must also provide the details for the ENISA register within one month of the law taking effect (Cbw article 47).
• Take measures (zorgplicht). The Cbw lists the ten NIS2 measures, from risk analysis and incident handling to supply chain security, vulnerability handling and MFA. For MSPs and MSSPs, the detailed requirements come directly from Implementing Regulation (EU) 2024/2690, not from the Dutch decree.
• Report incidents. A significant incident needs an early warning within 24 hours, a notification within 72 hours and a final report within one month. Reports go through the central reporting point in MijnNCSC, which reaches both the NCSC and the supervisor.
• Involve the board. The management board must approve the measures, and every board member must hold a cybersecurity training certificate within two years of the law taking effect.

The supervisor for ICT service management is the RDI (Rijksinspectie Digitale Infrastructuur), on behalf of the Minister of Economic Affairs. The NCSC is the CSIRT. Essential entities are supervised proactively; important entities mainly after the fact, for example after an incident or a complaint. Fines go up to EUR 10 million or 2% of worldwide turnover for essential entities, and EUR 7 million or 1.4% for important entities, whichever is higher.

What Regulation 2024/2690 asks of an MSP

The implementing regulation is specific. Among its requirements:

• Patch management: security patches applied within a reasonable time, from trusted sources and tested, with documented reasons when a patch is not applied.
• Vulnerability handling: a process to find, assess and fix vulnerabilities, and to handle reports from outside.
• An asset inventory that is kept up to date.
• Monitoring and logging of systems and networks.
• Control of privileged accounts, and MFA or continuous authentication where appropriate.
• A supply chain policy with security requirements in contracts.
• Security testing and an independent review of the security approach.

Where the regulation says 'where appropriate' and you decide a measure does not apply, you must document why. For an MSP, most of this is about your own environment: the remote management tools, admin accounts and access paths into client networks are exactly what attackers look for.

The regulation also defines when an MSP incident is significant. Examples are a service that is completely unavailable for more than 30 minutes, and a suspected malicious action that compromises the integrity or confidentiality of data.

Not in scope? Your clients still are

In-scope organisations must manage the security risks of their direct suppliers. They need a written supply chain policy, must check periodically that suppliers meet their requirements, and under Regulation 2024/2690 must put security terms in contracts: incident notification without undue delay, audit rights, vulnerability handling and rules on subcontracting.

So a small MSP without legal duties of its own will still meet the Cbw through its clients: in questionnaires, contract changes and audits. The MSPs that can answer with evidence instead of promises will keep those clients and win new ones.

The evidence clients will ask for

• A current inventory of the devices and software you manage for them.
• Patch status per device, your patch timelines, and the exceptions you made.
• How vulnerabilities are found, prioritised and fixed, with dates.
• MFA and least privilege on every account that can reach their environment, including your own technicians.
• Your incident process: how fast you notify them, and who does what in the first 24 hours.

This guide is a summary for MSPs, not legal advice. The legal texts, the NCSC (ncsc.nl/cyberbeveiligingswet-nis2) and the RDI are the sources to check before you decide.

Frequently asked