- The name. Production calls the Cbw "the Cybersecurity Act". That's also the name of an EU regulation on ENISA and certification, so the page only uses "Cbw" and "Cyberbeveiligingswet".
- The exposure: article 21 of the Cbw and articles 9 and 10 of the Cyberbeveiligingsbesluit, quoted in Dutch with an unofficial English translation under each.
- The hook: Besluit article 9(2) asks entities to make back-ups "van software en gegevens" and to verify their reliability periodically. A rebuild is that verification for software you don't control.
- The visual: an example account for a Dutch grid operator, with supplier and in-house applications side by side. Names and dates are fictional and labelled.
The Cbw asks for continuity. Show it with evidence.
Since 15 August 2026, the Cyberbeveiligingswet asks essential and important entities to manage business continuity, back-ups and their supply chain. Codekeeper protects the software behind your services, in-house or from a supplier, and gives you dated evidence that it comes back.
- Trusted by 3,500+ teams
- ISO/IEC 27001:2022 certified
- Evidence mapped to Cbw art. 21 and Besluit art. 9 and 10
Trusted by 3,500+ teams, from regulated enterprises to fast-growing software vendors
- Cbw article 21(3)(c) and (d) (heading "zorgplicht") mirror NIS2 article 21(2)(c) and (d). Note the Dutch wording: "back-upbeheer en herstelplannen", not a literal copy of the Directive.
- Cyberbeveiligingsbesluit articles 9(2) and 10(1) are where the Dutch rules go further than the Directive's list: back-ups "van software en gegevens" whose reliability is verified periodically, and a written policy on dependencies on suppliers' products and services. Article 5 of the Besluit makes articles 6 to 18 the minimum measures under Cbw article 21.
- The callout is Besluit article 4: articles 6 to 18 don't apply to the digital providers listed there, which follow Implementing Regulation (EU) 2024/2690 instead. We didn't read that regulation, so the page doesn't describe it.
- Dates: the Cbw is "Wet van 8 juli 2026" (Stb. 2026, 187). Besluit article 35 (Stb. 2026, 189): "De Cyberbeveiligingswet en dit besluit treden in werking met ingang van 15 augustus 2026." The two-year stat is Cbw article 24(3). Production's timeline ("Q3 2025 (expected)", "Some Cbw provisions take partial direct effect" from 17 October 2024) is out of date or unsupported, and is gone.
- Not used: production's Cbw fines ("up to €10 million or 2% … €7 million or 1.4%"), "around 10,000 Dutch organizations", "seven fundamental obligations" (article 21(3) lists ten points, a to j), and the inspection, seizure, director-ban and shutdown claims. Our fetch tool couldn't reach the Cbw's fines articles (around articles 80 to 87), so no Dutch fine figure is stated anywhere on the page.
What the Cbw asks
Continuity, back-ups and suppliers are in the law.
The Cbw is the Dutch law that implements NIS2. Its duty of care, the zorgplicht in article 21, lists the measures essential and important entities must take at the least. The Cyberbeveiligingsbesluit spells out what two of them mean in practice.
“De maatregelen, bedoeld in het eerste lid, … omvatten ten minste het volgende: … c. bedrijfscontinuïteit, zoals back-upbeheer en herstelplannen, en crisisbeheer;”
Unofficial translation“The measures referred to in the first paragraph … include at least the following: … c. business continuity, such as backup management and recovery plans, and crisis management;”
“d. de beveiliging van de toeleveringsketen, met inbegrip van beveiligingsgerelateerde aspecten met betrekking tot de relaties tussen de entiteit en haar rechtstreekse leveranciers of dienstverleners;”
Unofficial translation“d. the security of the supply chain, including security-related aspects concerning the relationships between the entity and its direct suppliers or service providers;”
“De essentiële entiteit of belangrijke entiteit stelt in het kader van de toepassing van het beleid, bedoeld in het eerste lid, processen en procedures vast voor het borgen van haar bedrijfscontinuïteit, waaronder in ieder geval processen en procedures voor het herstellen van haar netwerk- en informatiesystemen en voor het maken en periodiek verifiëren van de betrouwbaarheid van back-ups van software en gegevens. De entiteit past deze processen en procedures aantoonbaar toe en test deze periodiek.”
Unofficial translation“In applying the policy referred to in the first paragraph, the essential or important entity sets out processes and procedures to safeguard its business continuity, including in any event processes and procedures for restoring its network and information systems and for making back-ups of software and data and periodically verifying their reliability. The entity demonstrably applies these processes and procedures and tests them periodically.”
“De essentiële entiteit of belangrijke entiteit heeft vastgesteld beleid over de beveiliging van de toeleveringsketen. De entiteit bepaalt in dat beleid haar omgang met afhankelijkheden van de producten en diensten van haar leveranciers en dienstverleners die invloed kunnen hebben op de beveiliging van haar netwerk- en informatiesystemen.”
Unofficial translation“The essential or important entity has an established policy on the security of the supply chain. In that policy, the entity determines how it deals with dependencies on the products and services of its suppliers and service providers that may affect the security of its network and information systems.”
The English translations are ours and unofficial; the Dutch text published in the Staatsblad is the law. Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide.
Where software you don't control fits
Back-ups of your own systems are the start. Your suppliers' software is the gap.
You can back up and restore the systems you run. For software a supplier builds and runs, verifying a back-up means rebuilding it without the supplier. That's the evidence Codekeeper produces.
List what your services run on
Add the applications behind each service: the ones you build and the ones you buy.
Attach a protection
Escrow or Continuity for supplier applications, Resilience for supplier or in-house ones, Backup for systems you run.
Verify periodically
With Pro, run up to four rebuilds a year. Each successful run issues a dated Recoverability Certificate.
Put it before the board
Give the bestuur dated evidence per application when it approves the measures.
- Confirm before launch: whether Software Backup carries a Software Resilience Certificate in the new line-up (the first row avoids saying so); whether the live environment map is a document customers receive.
- Rebuild frequency: "periodiek" isn't defined in the text we read. The page says four rebuilds a year are included, and leaves frequency to the entity and its supervisor.
- 16 Oct: Continuity Pro added. Rebuilds, the deployable copy and the SBOM now name Continuity Pro or the Pro levels, since base Continuity no longer includes Agentic Verification; the arrangement and live environment map come with both Continuity levels.
Evidence map
Evidence for each article.
What you can put on file for business continuity, back-ups, suppliers and board approval, and which protection it comes with.
| Cbw and Besluit | Codekeeper evidence |
|---|---|
| Cbw art. 21(3)(c) Backup management | For supplier software, a deposit held by a neutral party, synced daily, checked and certified. For systems you run yourself, daily backups you can restore with Software Backup. Software Resilience CertificateVault reportEscrow · Resilience · Continuity · Software Backup for in-house systems |
| Besluit art. 9(2) Verifying back-ups of software, tested periodically | A rebuild of the deposit in the Codekeeper AI Verification Lab, with no help from the supplier, in hours. Four rebuilds a year are included, run when you choose. Recoverability CertificateRun reportEscrow Pro · Resilience Pro · Continuity Pro |
| Cbw art. 21(3)(c) · Besluit art. 9(4) Recovery plans | The recovery written down step by step, and a deployable copy to start from. With Resilience, Codekeeper runs the recovery for you. Exit workbookBuild stepsDeployable copyEscrow Pro · Resilience Pro · Continuity Pro |
| Besluit art. 9(3) and (5) Continuity plan and crisis management | A recovery you don't run yourself. With Continuity, we map the live environment, keep the map current, and keep it paid and switched on for an agreed period while we recover. Resilience ArrangementLive environment mapResilience · Resilience Pro · Continuity · Continuity Pro |
| Cbw art. 21(3)(d) · Besluit art. 10(1) Dependencies on suppliers' products and services | Release or recovery terms for each direct supplier's application, agreed up front, and a list of the components each rebuilt application needs. Escrow AgreementResilience ArrangementSBOMEscrow · Resilience · Continuity · SBOM with the Pro levels |
| Cbw art. 24(1) Approval by the board | Dated evidence per application for the bestuur to review before it approves the measures. Add an Exit Exercise when the business functions need testing too. CertificatesRun reportsTested Exit ReportEvery protection · Exit Exercise as an add-on |
Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide.
Which protection fits
Who runs the recovery when a supplier stops?
Escrow means the deposit is released to you and you run the recovery. Resilience costs more because we do the recovery. Continuity costs more again because we also keep the live environment switched on.
Escrow
Released to you→Self-Run Recovery
When the agreed conditions are met, the deposit is released to you. Escrow Pro adds proof it builds, from $449. Explore Escrow
From $199
Resilience
Comes to us→Managed Recovery
If the application fails, Codekeeper runs the recovery for you. Resilience Pro starts from a deposit we know builds, from $649. Explore Resilience
From $399
Continuity
Live service kept on+Managed Recovery
Everything in Resilience, plus the live environment kept paid and switched on for an agreed period while we recover. Continuity Pro adds Agentic Verification, from $1,699. Explore Continuity
From $1,449
Prices per application per month, for software applications; SaaS and AI applications have their own rows. Setup is $499 per arrangement for Escrow and Resilience, and $999 for Continuity. For systems you run yourself, Software Backup attaches the same way. See all prices
Supplying software to Dutch essential or important entities?
Under article 10 of the Besluit, your customers need a written supply chain policy that covers their dependencies on products like yours. Escrow gives them release terms, and Escrow Pro shows them your application rebuilds without your team.
Sample evidence pack
See what your auditor would receive.
An anonymised set of outputs from a real Agentic Verification run, so you can judge the evidence before you talk to us.
- Recoverability Certificate
- Run report
- SBOM and Exit workbook excerpts
Questions
The Cbw, answered.
What is the Cbw?
The Cyberbeveiligingswet is the Dutch law that implements NIS2, Directive (EU) 2022/2555. It was enacted on 8 July 2026 (Staatsblad 2026, 187). The Cyberbeveiligingsbesluit (Staatsblad 2026, 189) sets out the measures in more detail. For the EU-wide picture, see our NIS2 page.
Since when does the Cbw apply?
Since 15 August 2026. Article 35 of the Besluit reads: “De Cyberbeveiligingswet en dit besluit treden in werking met ingang van 15 augustus 2026.” Unofficial translation: “The Cyberbeveiligingswet and this decree enter into force on 15 August 2026.”
Who does the Cbw apply to?
Essential and important entities. Articles 8 and 12 of the Cbw, with the annexes to the act, say which is which. As under NIS2, that depends on the type of entity and its size, not on the sector alone, so check your own position with your adviser or supervisor.
Will Codekeeper make us Cbw compliant?
No product can do that on its own. Codekeeper gives you evidence for your file: certificates, run reports, SBOMs, Exit workbooks and, if you add an Exit Exercise, a Tested Exit Report. Whether it meets a specific requirement is for you and your assessor to decide.
Which parts of the Cbw does the evidence relate to?
Mainly article 21(3)(c) on business continuity and article 21(3)(d) on the supply chain, and articles 9 and 10 of the Besluit, which ask for verified back-ups of software and data and a policy on dependencies on suppliers. The evidence also gives the board something concrete to review when it approves the measures under article 24(1). See the evidence map.
We're a cloud or managed service provider. Do articles 9 and 10 of the Besluit apply to us?
No. Article 4 of the Besluit says articles 6 to 18 don't apply to the digital providers it lists, including cloud computing, data centre and managed service providers. Implementing Regulation (EU) 2024/2690 sets their measures instead. The evidence on this page is about business continuity and the software you depend on, so it can still support the measures you take.
What are the fines?
The Cbw sets the fines for the Netherlands. Under NIS2 article 34, every Member State must allow maximum fines of at least €10 million or 2% of worldwide annual turnover for essential entities, and €7 million or 1.4% for important entities, whichever is higher in each case.
We supply software to Dutch entities. Does this help us?
Yes. Under article 10 of the Besluit, your customers in scope need a written supply chain policy that covers their dependencies on suppliers' products. With Escrow Pro you can give them release terms, a Software Resilience Certificate and a Recoverability Certificate showing your application rebuilds without your team.
Is our code safe with you?
Codekeeper is ISO/IEC 27001:2022 certified. Deposits are encrypted at rest, and Agentic Verification runs on our own models, so code stays in our environment. See the Trust Center.
The Cbw asks for continuity. Put the proof on file.
We'll map the applications behind your essential services to the protection and the evidence each one needs.