The new Dutch Cybersecurity Act imposes demanding digital security requirements for organizations in the Netherlands that provide essential or important services. More than 8,100 companies fall within the scope of the law, including around 1,200 in the food sector. They must comply with the so-called ‘duty of care’, which means, among other things, that these companies will impose strict requirements on their suppliers. This law therefore affects the entire supply chain. Including you.
The Cybersecurity Act (Cyberbeveiligingswet, Cbw) is the Dutch implementation of the NIS2 Directive adopted by the European Union. The goal: to increase the cyber resilience of organizations in the Netherlands. The law applies to 19 so-called ‘essential’ and ‘important’ sectors in the Netherlands. These include healthcare, energy, water, banking, IT service providers, and our food production sector. Companies subject to the Cbw are required to register, fulfill a duty of care, and are obligated to report incidents. Organizations must determine for themselves whether they fall within the scope of the Cbw. This assessment can be complicated, particularly for corporate groups, organizations with multiple locations, and less obvious sectors.
The law has been in force since August 15, but awareness is still limited. Shortly after it took effect, fewer than half of the roughly 8,100 companies subject to reporting obligations had registered. There is still plenty of work to do. Samen Digitaal Veilig, a Dutch platform, helps organizations comply with the requirements of the law. It does this through a platform packed with information and documents, webinars, and support from experts like Henk Bijsterbosch. He brings us up to speed on this rather complex subject.
Let’s start by focusing on the ‘why’ behind this law: “We need to realize that a cyberattack on essential or important sectors can have far-reaching consequences for our society,” Henk begins. “Such an attack can be carried out in various ways. Think of cybercriminals breaking into IT systems. These are increasingly being automated by new AI models, which has significantly increased the risk of falling victim to a ransomware attack. We are also facing rising geopolitical tensions. State actors, such as China, Russia, and North Korea, are not seeking financial gain; their goal is to cause societal disruption. The consequences can be severe. What happens if an energy company can no longer supply power, a hospital shuts down, or clean drinking water is no longer available? Both types of attack are often no longer aimed at a single company. Attackers seek a point of entry through supply chain partners.” The various links in the supply chain are therefore all digital gateways that can be attacked. Henk: “The argument ‘My organization isn’t interesting enough to be hacked, so I don’t need to do anything’ no longer holds. Those days are over. The ultimate question is: ‘What is the impact on the supply chain if I don’t properly manage my cybersecurity?’”
During the webinar on the Cybersecurity Act and regulatory oversight in the food industry, jointly organized by the Federation of the Dutch Food Industry (FNLI), the Dutch Food and Consumer Product Safety Authority (NVWA), and the Samen Digitaal Veilig (SDV) platform, Cees-Jan Adema, director of FNLI, stated that the food sector is ‘a crucial sector’. “We need to realize that, whether we like it or not, we are a target for a lot of parties. We also need to realize that we shouldn’t address this solely because the government thinks we have to do something. I lock my door at home even though no law requires me to so. I do it because I want to keep out people I don’t want in my house. We should take the same approach to cybersecurity.” Over the past 10 years, the food processing industry has automated a great many processes. There is a technological tug-of-war between process automation and the fight against cyberattacks. On the one hand, automation, including AI, offers companies enormous efficiency benefits. On the other, cybercriminals use that very same automation to scale up cyberattacks, accelerate, and make them more efficient. This leaves the industry vulnerable, particularly when it comes to operational technology (OT). “Machines in production facilities typically have depreciation periods spanning decades. They run just fine, but often rely on outdated software for which updates are no longer available,” Henk explains. “In some cases, the software supplier no longer even exists. As long as it works, everyone prefers to leave it alone. A hacker who gains access to an outdated OT environment like this can use these machines to cause serious damage.”
“We are an extremely organized country and an efficiently organized industry,” emphasized Richard van Buuren of the NVWA during the same webinar. Yet the food industry consistently ranks among the top 3 most frequently targeted sectors for cyberattacks in European manufacturing. “Companies that work with raw materials generally have a minimal buffer,” he explains. “After just two days of disruption, a company like that already has a serious business continuity problem. Disruptions therefore have an impact very quickly. Moreover, the Netherlands is also the gateway to Europe for a great many products. If a hacker locks that gateway, it can quickly create a major problem throughout Europe.”
One example of just how significant that impact can be is the so-called ‘cheese hack’, in which transport company Bakker Logistiek (now STEF Groep) was hacked. The immediate consequence was that Albert Heijn no longer received cheese deliveries. The empty cheese shelves, however, were not the biggest problem. Customers went to other supermarkets for their cheese and, once there, did the rest of their grocery shopping as well. The affected supermarket chain suffered an enormous loss of revenue in a short period. “Companies and organizations therefore need to make a conscious effort to improve their cybersecurity and increase their cyber resilience. This is about business continuity, with information security (digital security) as an important component, but it also concerns matters such as the rights, responsibilities, and access permissions you grant to employees and external parties. Can anyone walk into your building unannounced? Can the elevator technician just walk into any department? Which areas do cleaners have access to; are they allowed into a server room, for example?”
Major customers, such as supermarket chains, will increasingly ask their suppliers for concrete evidence that they operate securely and are cyber resilient. “Demonstrable cybersecurity is more than just a prerequisite for continuing to do business,” says Henk. “If you can tell potential customers, ‘We can demonstrate that we meet your security requirements,’ you’re not just selling your product or service, but trust as well. This is particularly important when you have access to major customers’ systems, data, or processes. Getting your cybersecurity in order can therefore give you an advantage over competitors who cannot yet provide that evidence. It may even help you win new contracts.”
Back to the companies subject to reporting obligations. If they have not already done so, they must register as soon as possible at mijn.ncsc.nl (National Cyber Security Centre). They also have a so-called ‘duty of care’. This means that if you fall within the scope of this law, you must ensure that your organization is cyber secure. “In addition, and this is very important,” Henk says, “you must also ensure that security improves throughout the supply chain in which you operate. So if this law applies to you, you must examine your entire supply chain. For each supplier, you will need to determine the impact on your product, service, or business process if that supplier suffers an incident, including a cyber incident. All 8,100 companies subject to reporting obligations must do this for every one of their suppliers. As a result, an estimated more than 100,000 companies and entrepreneurs will be affected by the law indirectly! If there is a risk, the law requires you to take appropriate and proportionate measures.” To help assess this for each supplier, industry associations have developed a standard specifically for the supply chain, particularly small and medium-sized businesses: ‘NIS2 Supply Chain’, with three maturity levels. You can obtain certification for this standard (your demonstrable evidence) through the Samen Digitaal Veilig platform, which provides the necessary supporting materials alongside a range of useful tools.
“A lot of people have no idea where to begin in getting all of this in order,” Henk says. “Most companies do not yet have an adequate Cyber Incident Response Plan and lack sufficient capacity to monitor OT and IT processes. Standards can help them get everything in order in a structured way. Of the three maturity levels mentioned, the ‘Basic’ version will be sufficient for most companies. We guide you step by step through the 17 measures required, a process that takes around two to four months. The highest level includes 55 measures and takes six to nine months. Once you have completed all the steps, an independent audit will be conducted. Did you pass? Then you’ll receive your certification. However, meeting every requirement of the standard and obtaining certification does not automatically mean you comply with the law. You should primarily see it as a tool for providing concrete evidence to major customers, so you can remain part of the supply chain. The good news is that you do not have to start from scratch with certification or a demonstrable level of security for every customer; you can use a single piece of evidence for multiple clients.”
The Cybersecurity Act is the Dutch implementation of the European NIS2 Directive
“Suppose,” Henk continues, “both a company’s production environment and its IT environment go down. Nothing is working anymore. What do you do? Is there an incident response plan? When I ask business owners this question in practice, I regularly hear something like, ‘Uh, yeah, sure. We kind of know what we need to do.’ That is not good enough; you need to know exactly what to do! If your production process suddenly grinds to a halt and your people can’t work, it affects business continuity, your employees, and, by extension, many families. You have a huge responsibility. You need to inform your suppliers, bring in your IT partner, and deal with the press. So much is happening to and within your organization that you can no longer think clearly. You need a clear plan to fall back on. That plan cannot exist only online or in the cloud; you need a printed copy with manuals, instructions, measures, phone numbers, and so on, stored in a cabinet at the office and at home. Ideally, several people should have a copy.”
The reporting obligation is already in effect. So if you are hacked one day, you must report it. The regulator (NVWA) will then assess whether you comply with the law. “Have you actually implemented all the measures you described properly? Have you set up your processes so that people have developed the maximum level of knowledge and expertise? Have you kept this up to date, tested it, and documented it? The regulator will inspect each company once every 4 years and ask for a ‘root cause analysis’: can you identify the exact point where things went wrong?” Henk summarizes. “If you have been negligent as a company director, the regulator can impose a fine. These are substantial amounts. Fines can reach 10 million euros, or a certain percentage of your revenue.” Inspections are starting now. Companies could be audited in 3 months or in 2 years. You do not know when, but preparations start now.
Henk stresses once again that fear of a fine should not be the main reason for getting your cybersecurity and cyber resilience in order. “As a business owner, realize that a well-organized approach to access management, backups, updates, MFA, and incidents makes your company not only more secure, but often more professional and easier to manage as well. Make sure you are ready for tomorrow’s requirements. As major customers continue to raise standards across their supply chains, it is better to be ready now than to have to implement measures under time pressure later because an important customer requests them. Cybersecurity is not an expense. It is a prerequisite for continuing to do business.”
At The Future of Food & Retail powered by Foodindustrie Experts on November 12, Henk Bijsterbosch will give a presentation offering an in-depth explanation and practical application of the step-by-step plan, using a concrete case from the food industry. There will also be an opportunity to talk with him during the break and the dinner that follows. This event is exclusively for owner-directors and decision-makers at food production companies.
www.foodindustrieexperts.nl
Source: Vakblad Voedingsindustrie 2026
Magazine Voedingsindustrie has been made possible in part by:
© COPYRIGHT 2026 VOEDINGSINDUSTRIE | ALLE RECHTEN VOORBEHOUDEN
Powered by Wallbrink Crossmedia © 2026
