If your organisation falls under the Dutch Cyberbeveiligingswet (Cbw), it must have been registered in the NCSC's entity register since 15 August 2026. NCSC registration takes place in MijnNCSC (mijn.ncsc.nl), using eHerkenning or, for connected central government bodies, SSO Rijk. You provide, among other things, your sector, your entity type, a contact person and your network details, and you report changes within two weeks.
In short
- The registration duty is set out in Article 44 Cbw and Article 27 of the Cyberbeveiligingsbesluit (Cbb).
- Registration in MijnNCSC takes five steps. For eHerkenning you need assurance level EH2+ and an authorisation.
- You provide, among other things: sector and subsector, essential or important, Chamber of Commerce (KvK) number, EU Member States, IP ranges and domain names.
- The register does not ask for a list of your suppliers.
- You report changes without delay, and in any case within two weeks.
What is the NCSC entity register?
The entity register is the national register of organisations under the Cyberbeveiligingswet: essential entities, important entities and providers of domain name registration services. The Minister of Justice and Security manages it (Article 43 Cbw); you register with the National Cyber Security Centre (NCSC).
According to the NCSC, the register has two purposes. It gives the EU insight into the digital resilience of essential and important services. And once registered, you can connect to the services of the CSIRT for your sector, the team that helps you during incidents.
Registration is the first of four duties. The others are the duty of care, the reporting obligation and the duties of the board. The overview is in our pillar on NIS2 in the Netherlands.
Who must register with the NCSC?
Every organisation that falls under the Cbw. That depends on your sector and size. Ministries, provinces, municipalities and water authorities are in scope regardless of size (Article 8); the Ministry of Defence, the Public Prosecution Service and the police, among others, are not (Article 5). If in doubt, use the NIS2 self-assessment by the RDI (in Dutch). The outcome helps your assessment, but the responsibility remains yours.
Choose your sector carefully. It is the sector in which your organisation itself operates, not the sector of your customers. The NCSC gives an example: a provider of cloud services to healthcare institutions registers under "Digital infrastructure", not under "Healthcare".
How do you register in MijnNCSC?
First make sure you can log in. For eHerkenning you need assurance level EH2+, linked to your organisation's KvK number, and an authorisation to register on its behalf. No eHerkenning yet? Applying can take a few days.
You then go through five steps:
| Step | What you fill in |
|---|---|
| 1. Organisation details | Retrieved from the KvK trade register or the Register of Government Organisations. If something is wrong, correct it at the source. |
| 2. Additional details | Sector and subsector, type of service, EU Member States and main establishment, essential or important, any designation by the minister and participation in information-sharing groups. Questions about size are optional. |
| 3. Contact details | A first contact person: name, phone number, email address and job title. |
| 4. Network details | Public IP addresses or ranges, domain names and AS numbers. |
| 5. Summary and submit | You declare that everything is correct and that you will report changes within 14 days. |
Five steps in MijnNCSC: organisation details, additional details, contact details, network details and submit. Log in with eHerkenning EH2+ or SSO Rijk.
The NCSC advises having the registration done by someone with decision-making authority and preferably cybersecurity knowledge, such as a CISO. Choose a contact person who can be reached during an incident.
Which details does the entity register ask for?
The act and the decree specify exactly what you provide. Use this checklist to gather everything in advance:
- name, address and up-to-date contact details, including email addresses, IP ranges and phone numbers (Article 44 Cbw);
- your sector and subsector from Annex 1 or 2 of the act, and the type of entity;
- the EU Member States where you provide your services;
- whether you register as an essential or an important entity (Article 27 Cbb);
- your KvK number or, for public bodies, your code in the Register of Government Organisations;
- your domain names;
- participation in an information-sharing arrangement, where applicable.
Checklist for the entity register: contact details, sector, EU Member States, essential or important, KvK number, domain names and information-sharing arrangement. No supplier list.
Network details are often spread across colleagues, such as the CISO and the network administrator. Gather them in advance so you can complete the registration in one go.
What happens if you do not register?
Registration is a legal duty, and your sector's supervisory authority can enforce it. A fine comes together with or after a warning or another enforcement decision (Articles 80 and 87 Cbw). For violations outside the duty of care and the reporting obligation, such as failing to register, the maximum fine is €1 million.
The act only provides personal fines for directors for board members' knowledge and training duty (Article 24) and for failing to cooperate with the supervisory authority (Article 93). Read more in our article on director liability under NIS2 in the Netherlands.
How it works at Prudai
You do the registration itself in MijnNCSC. IRMA (in Dutch), our software for governance, risk and compliance (GRC), does not register you with the NCSC either.
IRMA does help keep the registration current. With custom registers you track what you submitted to the NCSC: sector, entity type, contact person, IP ranges and domain names. When something changes, you update the register and report the change in MijnNCSC within two weeks. In the asset register you record which systems you protect. You fill these registers yourself; IRMA's AI does not fill assets.
This follows a principle we also apply internally: one fact lives in one place. Why that matters is explained in our article on information alignment.
For the specialist
- Digital providers. Cloud and data centre providers, managed (security) service providers, DNS providers, online platforms and similar providers also submit their details for ENISA's register, within one month of falling under the act (Article 47 Cbw).
- Several Member States. As a rule, you register in each EU country where you are established and provide services. Public authorities register in their own country, telecom providers where they offer services, and the digital providers above in the country of their main establishment.
- Main establishment. This is where decisions on cybersecurity are mainly taken. If that cannot be determined, it is where the measures are carried out, and otherwise the establishment with the most employees.
- Changes by the minister. The minister amends, refuses or ends a registration, in agreement with the sector's competent authority, if its basis has changed, lapsed or is missing (Article 43(3) Cbw).
Frequently asked questions
When did I have to register for the Cyberbeveiligingswet?
Since 15 August 2026, organisations under the Cbw must be registered at mijn.ncsc.nl. If you have not registered yet, do so as soon as possible.
What do I need to log in to MijnNCSC?
eHerkenning at level EH2+, linked to your organisation's KvK number, with an authorisation to register on its behalf. Staff of connected central government bodies log in with SSO Rijk.
How quickly must I report changes?
Without delay, and in any case within two weeks of the change (Article 44(2) Cbw). You do this in MijnNCSC as well.
Do I have to list my suppliers in the entity register?
No. The register does not ask for a list of suppliers. Supply chain security is part of your duty of care; see our article on NIS2 supply chain security.
Sources
- Cyberbeveiligingswet, wetten.overheid.nl (BWBR0052872), in force from 15 August 2026, consulted 2 October 2026
- Cyberbeveiligingsbesluit, Staatsblad 2026, 189, 8 July 2026
- NCSC, registering your organisation for the Cyberbeveiligingswet, consulted 2 October 2026
- RDI, NIS2 self-assessment, consulted 2 October 2026
- Dutch government, Cyberbeveiligingswet and Wwke in force from 15 August 2026, 7 July 2026
Would you like to know how IRMA keeps your registration, risks and measures under the Cyberbeveiligingswet up to date? See IRMA, GRC and ISMS software by Prudai (in Dutch) or request a trial environment.
Updated on 4 October 2026