On 3 September 2026 four people whose job is to supervise the Cyberbeveiligingswet sat at one table and spent an hour explaining how they intend to do it. Lies van Harten and Myrthe Aresvik of the Rijksinspectie Digitale Infrastructuur, Allard de Rond of the Nederlandse Voedsel- en Warenautoriteit, and Patrick van de Heisteeg of de Inspectie Leefomgeving en Transport, hosted by the NCSC. The RDI published the recording on 11 September. It runs 58 minutes and carries Dutch subtitles.
This is a different kind of source from the statute. It is the inspectorates describing their own method, on the record, and answering live questions from the organisations they will be inspecting.
Four things stand out for anyone in scope.
- The law has been in force since 15 August 2026 and there is no transition period. The supervisors are already competent to act. In practice they were not on the doorstep on 16 August, but nothing stops them.
- Supervision is divided by sector. Several inspectorates share the work, and some organisations fall under more than one. When you complete your registration, the result tells you which supervisor you fall under.
- Essential entities get proactive supervision, planned from a risk assessment. Important entities are subject to reactive supervision: the supervisor may act once it has evidence, an indication or information suggesting a possible infringement. An incident may trigger that process, but it is not the only trigger.
- A viewer asked the question every certified organisation wants answered: do I meet the Cyberbeveiligingswet if I hold a certificate? The answer was no. A certificate helps you apply the law and take the right measures, and the supervisors called it a useful instrument. It is not a legally binding statement that you are compliant. The supervisor investigates whether you comply, and the supervisor has the last word.
That last point deserves to be read carefully, because it cuts both ways. Certification is not a shield. It is also not wasted effort, and the inspectors said so themselves without being asked to be generous about it.
The powers are not new. Under the Cyberbeveiligingswet, inspectors work with the same authority they already hold under other legislation, drawn from the Algemene wet bestuursrecht: they can request and demand documents, gain access to locations where an inspection is carried out, examine products and processes, and require cooperation. These are the same inspectorates doing the work they have done for years, with the Cbw added to the list of subjects.
What the Cbw adds sits at the far end of the ladder. The additional powers include binding instructions and, for essential entities, the appointment of an independent monitoring officer. For serious breaches, maximum fines can reach €10 million or, if higher, 2% of worldwide annual turnover for essential entities; for important entities, the corresponding maximum is €7 million or 1.4%. In an escalated case involving an essential entity, the authority may ask a civil court to suspend one or more board members temporarily. One of the supervisors described it as an interesting extra toolbox on top of the general administrative law, which is an accurate way to put it: the base is ordinary, the additions are not.
Between those two ends is a process, and the process is not a raid.
De Inspectie Leefomgeving en Transport described how it runs an inspection, drawing on its experience under the previous law. It contacts the known contact person. It requests documentation and does desktop research on it. The most sensitive material, the documents tied to the risk analysis, it prefers to leave with the organisation rather than take copies, to keep the exposure down. It then agrees a day on site, carries out reality checks against what the documents claim, and conducts interviews. At the end of the day it shares its findings and asks whether the organisation sees it the same way. An inspection report follows, offered first for hoor en wederhoor so you can correct or contest it. Where something is wrong, what usually follows is a request for an improvement plan with a reasonable deadline. Meet it and, in their words, there is nothing further the matter.
Two details are worth holding on to.
They go further than paper. Asked directly whether they look at policies and procedures or at how the operation actually runs, the answer was unambiguous. Paper says something about design, and design is not enough. Is the risk analysis complete? Are all the processes actually in view? Does the measure work, and will it still be working in six months once the inspectors have left? Operational technology is explicitly in scope and moving closer to the centre of attention.
You will be asked to explain your reasoning. One inspector put it as organisations being allowed to explain why they made a given choice, while acknowledging it amounts to the same thing as accounting for it. What remains after your measures is residual risk, and residual risk is the board's risk appetite. The board sets the measures, accepts what is left, and should be able to describe why. Prepare that before the visit, not during it. Where the supervisor disagrees, the conversation is about whether the measures are proportionate to the risk, not about whether you filled in a form.
The most useful part of the hour was the answer to a simple question: what do organisations get wrong most often?
The pattern named on the record, from real inspections under the previous law, was consistent.
- The board is not sufficiently engaged with the risks.
- There is a gap between what the CISO asks for and the resources actually made available.
- Documents have not been formally adopted and approved, which is itself a signal that involvement is thin.
- Systems are missing from the risk analysis, so the asset inventory is incomplete. Smaller systems that look irrelevant, but sit inside a process, were called a good breeding ground for getting in.
- Supplier and supply chain arrangements are not properly organised, including parties who come onto your site.
Not one of those is a firewall problem. Every one of them is a management problem: governance, ownership, documentation, inventory, and suppliers. An organisation with excellent technical controls and no board minutes approving them will fail on this list.
Three practical mechanics also came out of the session.
Where several supervisors apply to one organisation, they coordinate. A cooperation protocol has been published in the Staatscourant, a coordinating supervisor is appointed to take the lead, and joint inspections are possible. The intention, in their own framing, is to stop an entity dealing with one inspectorate on Monday, another on Tuesday and a third on Wednesday. Two supervisors may arrive together, but you have one conversation.
Reporting runs through one window, with one exception that matters. A report through the NCSC portal notifies both the CSIRT and your supervisor, so for the Cyberbeveiligingswet you file once. The Algemene verordening gegevensbescherming is a different law. Supervisors have a duty to pass on to the Autoriteit Persoonsgegevens when personal data is involved, and that passing on does not discharge your own breach notification. If personal data leaked, you still report it to the AP yourself. The thresholds are not the same either, so the two reports can cover genuinely different events.
Higher education runs on different rules. Anyone working in that sector was pointed to the Inspectie van het Onderwijs for the specifics rather than to the general guidance.
One more thing, offered honestly by the panel rather than glossed over. A live poll asked viewers whether they met the most important obligations, and only one percent admitted they still had to start. One of the inspectors immediately pushed back on his own poll, pointing out that "most important" is doing a lot of work in that sentence: there are four duties, and being on top of the board-level obligation is a different thing from having the duty of care in order. The host had already noted the selection bias in an audience that chose to watch a webinar about supervision. Read the reassuring number with both of those in mind.
If you have not registered, that is the first move and it is overdue. It is also self-interested rather than merely obedient: an organisation that has not registered is not connected to the NCSC or the relevant CSIRT, and gets no support from them when something goes wrong.
If you are in scope and behind, the advice from the table was ordinary and correct. Bring your risks into view, identify your crown jewels, and put measures against the largest risks first. Phase the rest rather than trying to land everything at once. Get the board attached to it, with the training the law requires, so the person accountable can make informed decisions. And write it down as you go, in whatever form you like, so that someone arriving later can follow the analysis you actually did.
That last instruction is the one most organisations underestimate. The inspectors are not asking for a particular template. They are asking to be walked through your reasoning. A decision you made well and never recorded looks identical, from the outside, to a decision you never made.
This is where a certificate earns its keep, within the limits the supervisors set on it. ISO 27001 does not transfer the judgement to your certification body, and it does not answer the Cyberbeveiligingswet on your behalf. What it does produce, if you run it properly, is precisely the material an inspector asks for: a documented risk assessment, measures traceable back to the risks that justify them, decisions formally approved by the people accountable for them, an asset inventory that is actually complete, supplier controls, and a record of why you chose what you chose.
Much of the underlying risk-management and evidence work overlaps, so it makes sense to manage it as one connected process. The Cbw nevertheless adds statutory obligations that an ISO 27001 management system does not automatically satisfy, including registration, incident-reporting requirements and specific governance duties.
ISOPlanner™ exists to keep that work in one place, inside the Microsoft 365 tenant your organisation already runs, so the risk assessment, the controls, the approvals and the supplier register live together rather than in a folder someone assembles before an audit. It will not make you compliant, because nothing makes you compliant. It makes the evidence a by-product of the work instead of a project of its own, which is the difference between an inspection you can walk someone through and an inspection you have to prepare for.
The next webinar in the series runs on 1 October and covers the reporting duty. If you are in scope, that is an hour worth booking.
Check out the Full Webinar here
Log in to your ISOPlanner™ workspace, or start a free trial.
Log in Start your free trial