OT security and the Cybersecurity Act

Your control system is part of the security picture

The Dutch Cybersecurity Act (Cbw) came into force on 15 August 2026. It is the Dutch implementation of the European NIS2 directive. According to the Dutch NCSC, more than 8,000 organisations fall under the act. They must register, analyse their risks and take suitable measures.

For organisations with a PLC/SCADA control system this is more than an IT matter. The control of a bridge, lock or plant is a network and information system, so the duty of care applies to it as well. A failure or attack here directly affects safety and availability.

Does your organisation fall under the act? The scope published by the NCSC decides that. See it at ncsc.nl (opent in nieuw venster), in Dutch.

What we do for you

We work on both sides of the divide between office IT and control systems. That keeps security from getting lost in the handover between two suppliers.

• Inventory: which control systems, networks and connections exist, and who has access.
• Segmentation: separating control and office networks with firewalls, and limiting and logging remote access.
• Maintenance: updates, backups and monitoring of servers, switches and workstations, including in the control centre.
• Design: building security in from the functional design of new or renewed control systems.
• Incident readiness: agreements on who does what, so a report can be made within the deadline.

For owners of national infrastructure this fits the CSIR of Rijkswaterstaat, which we already apply in our IT management.

This page is a general explanation, not legal advice. The current text and scope are published by the NCSC.