Frameworks
Meet the Dutch NIS2 law with Cbw compliance
Falling under the Cyberbeveiligingswet without a clear view of your obligations leaves your board personally exposed.
Tidal turns the Cbw into a managed programme. Work through the duty of care, board training, incident reporting and registration obligations, and show your supervisor current evidence for each one.
These companies run their compliance on Tidal Control
The Cbw in depth
Article 21 of the Cbw obliges essential and important entities to take appropriate and proportionate technical, operational and organisational measures to manage the risks to their network and information systems. Articles 6 to 18 of the Cbb work that duty out into concrete topics: policy, risk management, incident handling, business continuity and backups, supply chain security, secure development and maintenance, cryptography, personnel security and asset management.
It is tempting to treat the Cbw as a compliance checklist to work through once. That misses how a supervisor looks at it, because the law asks for measures that keep matching your risks, and the evidence has to show that they still do.
By running the duty of care as a management system, clarity emerges. Each obligation has an owner, a linked set of controls and current evidence, and a change in risk becomes a task rather than a finding.
How Tidal helps you get certified
Hit the ground running
Start with our pre-built controls, policies, and risk assessment templates.
Our platform guides you through establishing your ISMS scope, identifying assets, and implementing right-sized controls that match your business needs.
Why Tidal Control
We understand your challenges because we've been there. Our team of GRC experts and security professionals built Tidal to solve the real problems compliance teams face every day.
Made in Europe
Built and hosted in Europe. Your compliance data stays in the EU for full control and peace of mind.
Continuous automation
Automated evidence collection from cloud providers and development tools working 24/7 for you.
Real security
Build secure systems that protect your business and satisfy auditors, not just check compliance boxes.
Go beyond the Cbw
Explore frameworks that support your Cbw programme.
NIS2
Working across EU member states? The NIS2 directive is the basis of the Cbw, and the NIS2 Quality Mark gives a structured route to the measures it asks for.
ISO 27001
Want a certifiable foundation? An ISO 27001 ISMS covers most of the Cbw duty of care and gives your supervisor a recognised reference point.
BIO
A government organisation? The BIO is the information security baseline for Dutch government and overlaps closely with the Cbw duty of care.
DORA
A financial entity? DORA takes precedence over the Cbw for ICT risk management and incident reporting in the financial sector.
Integrate with your existing tools
Testimonials
What our customers say
With a single click, one Tidal test checks dozens of disks for encryption. Doing that manually would take a lot of time.
Frequently asked questions
The Cyberbeveiligingswet (Cbw) is the Dutch law that implements the EU NIS2 directive. Together with the Cyberbeveiligingsbesluit (Cbb), which works out its requirements, it has been in force since 15 August 2026 and replaces the Wet beveiliging netwerk- en informatiesystemen (Wbni).
The Cbw applies to essential and important entities: medium-sized and large organisations in the sectors the law lists, such as energy, transport, banking, health, digital infrastructure, ICT service management, manufacturing and the public sector, and some smaller organisations regardless of size, such as DNS service providers. Whether you are essential or important decides how your supervisor oversees you, not which measures you have to take.
The Cbw framework in Tidal holds the obligations an entity itself has to meet: the duty of care in article 21 of the Cbw as worked out in articles 6 to 18 of the Cbb, governance and board training (Cbw article 24, Cbb articles 21 and 22), incident reporting (Cbw articles 25 to 30, Cbb articles 24 and 25) and registration (Cbw articles 44 and 47, Cbb article 27). That is 66 obligations in total. Provisions addressed to ministers, supervisors and CSIRTs are left out, because there is nothing for you to implement.
The board approves the cybersecurity risk management measures, oversees how they are implemented and can be held accountable when they fall short. Board members have to follow training so they can recognise risks and judge the measures. Tidal records approvals and training as evidence, so you can show who approved what and when.
A significant incident is reported in stages: an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours, and a final report no later than one month after the notification. Tidal keeps the incident register and the timeline behind each report, so the notifications are written from the same record.
The Cbw and the Cbb are seeded in Dutch, because the Dutch text is the only authentic one. The rest of the platform, including your own controls, tasks and policies, works in English as well as Dutch, and you can link the Cbw obligations to ISO 27001 controls so English-speaking teams can work from those.