What has applied since 15 August 2026
NIS2 is the EU directive. In the Netherlands it lives in the Cyberbeveiligingswet, which replaced the earlier Wbni. Organisations classed as essential or important entities have, among other duties, a registration duty (entity register via MijnNCSC), a duty of care (appropriate measures, detailed in the Cyberbeveiligingsbesluit) and a duty to report significant incidents.
There is no statutory phase-in: if you are in scope, the duties apply from that date. Whether you are in scope follows the official criteria — not a blog post. This article is not legal advice and not a scope assessment of your company.
In scope yourself, or via the chain?
An accountancy firm, installer or consultancy is often not automatically under the Cbw. A larger customer in healthcare, government, energy or digital infrastructure may be — and that customer must demonstrably manage supply-chain security. Then you get a questionnaire, a contract annex, or a question about how you report incidents.
That does not automatically make you a Cbw entity. It does mean you can show what already exists: who has access, whether MFA is on, how backups and patching run, and where staff report suspicious mail. Without those facts the questionnaire is guesswork; with them it is a conversation.
What an MSP can put on paper
Floor ICT is not a supervisor and does not issue a NIS2 certificate. What does fit a named-user MSP is the operational layer customers in the chain usually ask for:
- MFA and account management in Google Workspace or Microsoft 365 (from Advanced: cloud admin and joiner/leaver);
- endpoint patching and monitoring, with tickets instead of a public inbox;
- managed endpoint backup in Elite — cloud sync is not a backup;
- Academy security awareness beside that, so phishing is spotted sooner;
- a short note of what is and is not in the package, so you do not have to guess a customer question.
Go deeper
Managed services in the directive
NIS2 lists providers of managed services (and managed security services) as digital service providers. Whether a given MSP falls under the Cbw depends on the legal definitions and size criteria — not on the marketing word “MSP”. Floor ICT assesses its own position separately; this article is about what SME customers notice in the chain.
Badges and self-scans
NCTV and NCSC note that market badges have no standalone legal status. The NIS2 self-assessment and similar tools help you form a first picture; the supervisor judges compliance. An Academy certificate or an MSP package is hygiene, not a waiver.
What you still own
You remain responsible for whether your organisation is in scope, for customer contracts, and for what you tell an auditor or buyer. Floor ICT manages workplace and cloud at the chosen package level and helps line up the facts. Legal scope, fines or “you must do X by 1 October” is not something you hear from us — that is a lawyer or the official NCTV/NCSC tools.