Markets
Solutions
All solutions
Aviation - Digital - Infrastructure - Water
Buildings - Energy - Maritime
Data centres - Industry - Mobility
Twinn by Haskoning
Careers
Global
Europe
Africa
Americas
Asia
Oceania
The landscape is changing for organisations that play a vital role in our society. In the Netherlands, the introduction of the Wet weerbaarheid kritieke entiteiten (Wwke), the Dutch implementation of the EU Critical Entities Resilience Directive, and the Cyberbeveiligingswet (Cbw) creates new legal obligations. If your organisation provides essential services in the Netherlands, you may be subject to these requirements. Organisations must ensure that both their physical and digital resilience are structurally in place. For many, this marks a significant shift from non-binding policies to mandatory risk assessments, reporting obligations and increased legal accountability.
This legislation does not automatically apply to every organisation in the Netherlands. The Dutch implementations of the Critical Entities Resilience Act and the Cybersecurity Act target organisations that play a vital role in the functioning of our society. Although the Cybersecurity Act and the Critical Entities Resilience Act are closely related, they do not target exactly the same organisations. While the Wwke focuses on organisations designated as critical entities by the government, the Cbw has a broader scope. Organisations that fall under the Wwke also fall under the Cybersecurity Act automatically, but not vice versa.
1. Your organisation provides essential services
This includes organisations in sectors such as:
2. Failure of your organisation causes social disruption
If an incident at your organisation could lead to disruption of basic services, risks to safety or health or long-term social or economic damage, you are highly likely to be classified as a critical entity.
3. You are formally designated by the government
Dutch ministries can formally designate organisations as critical entities. After designation, clear deadlines apply for risk assessment, action and reporting.
Even if you do not officially fall under the law (yet), this legislation can often serve as a guide. Regulators, supply chain partners and insurers increasingly expect demonstrable resilience, both physical and digital.
Resilience begins where vulnerability is recognised; security is not an option but rather a foundation for the functioning of our society.
The Critical Entities Resilience Act is the Dutch implementation of the European Critical Entities Resilience Directive (CER Directive), adopted at the end of 2024. The purpose of the law is to ensure the continuity of essential services against a variety of threats caused by man or nature.
The law targets organisations that play a vital role within vital sectors such as energy, transport, banking, financial market infrastructure, healthcare, drinking water, wastewater, digital infrastructure, government, aerospace and food production and distribution. This does not mean that entire sectors fall under the act automatically: organisations are individually designated by Dutch authorities based on specific criteria.
After designation, a clear obligation applies to each critical entity. A risk assessment must be carried out within nine months. That risk assessment identifies the threats such as natural disasters, terrorist offences or accidents that could affect the organisation and their impact. After that, the assessment should be repeated at least every four years.
But the law goes beyond analysis, it also imposes a duty of care: organisations themselves are responsible for taking appropriate measures to strengthen their resilience. Those measures can include crisis management procedures, physical security measures and organisational safeguards. There is also a duty to report incidents and a structural reporting obligation towards the regulator.
The Cybersecurity Act (Cbw) is the Dutch implementation of the European NIS2 directive which sets a new standard for digital security across Europe. Whereas the Wwke focuses on physical security, this law requires organisations to put their cybersecurity in order. Measures include reducing the likelihood of cyber attacks, detecting incidents promptly and responding appropriately if something does go wrong.
The Cbw applies to a broader group of organisations than the above legislation. If you are classified as a critical organisation for the Wwke, you also automatically fall under the Cbw. But not only sectors such as energy, water and healthcare fall under it but also logistics, research institutes, digital services and local authorities, for example. If your organisation falls under the law, you must identify risks, take appropriate technical and organisational measures and report serious cyber incidents to the regulator within 24 hours. Under the Cbw, the most senior directors of an entity become jointly and severally liable for complying with these rules.
The first step to legal compliance and true resilience is to gain insight. That starts with a risk analysis that examines not only physical vulnerabilities, such as unauthorised access to buildings or the impact of extreme weather, but also your digital environment and how your organisation functions during and after an incident. Is it clear who is responsible for what? What decisions are made and when? And how do you restore services if there is an emergency?
Haskoning can help you take an integrated approach to resilience. Together, we identify risks, set priorities and determine which measures are effective and appropriate for your organisation. This involves considering not only technical and physical solutions for risk mitigation and response but also how your organisation is set up to fulfil its duty of care and report incidents in a timely and correct manner. We explicitly include what level of risk is acceptable for your organisation and translate that into concrete choices in terms of measures, processes and responsibilities. This results in a practical approach that makes your organisation demonstrably resilient, now and in the future
What you can expect from us
Whether you are looking for a partner for the entire process, from risk analysis to implementation, or just need specific help with compliance or technical measures: we are here for you. And that goes for all the sectors that fall under this legislation.
The new legislation sets clear requirements and deadlines so by starting now, you can maintain control over implementation and avoid having to fulfil statutory obligations under time pressure.
Share this page