NL

Blog 3 November 2026 · 4 min read

The Dutch Cybersecurity Act: what does it mean for owners and tenants?

The Dutch Cybersecurity Act has applied since 15 August 2026. Does it cover your building? Usually not directly. But tenants who fall under it will start asking questions.

On 15 August 2026 the Dutch Cybersecurity Act (Cyberbeveiligingswet) came into force. It is the Dutch implementation of the European NIS2 directive, and it replaces the older Network and Information Systems Security Act (Wbni). Many organisations must now do more on digital security. But what does that mean for the owner of an office, and for the tenant?

Who falls under it?

The act applies to organisations in 18 sectors. Think of energy, transport, healthcare, drinking water, digital infrastructure, ICT service providers, waste management, the food chain and parts of industry. According to the government, it concerns more than 8,000 organisations.

Usually the act only applies to medium-sized and large organisations. Medium-sized means: at least 50 employees, or a turnover and a balance sheet total of more than 10 million euros each. There are two kinds:

  • Essential entities. Mainly large organisations in the most critical sectors. Here the supervisor supervises actively.
  • Important entities. Mainly medium-sized organisations. Here the supervisor mainly looks after a signal or an incident.

Whether your organisation falls under it, you have to check yourself. The Dutch NCSC helps with that.

Does a property owner fall under it?

Letting real estate is not a separate sector in the act. So an owner usually does not fall under it directly. That can be different if the owner also has other activities, for example as an energy company or as a provider of data centre services. In doubt? Then have it checked.

But even if you do not fall under it yourself, you will probably have to deal with it. Through your tenants.

What do organisations have to do?

Organisations that fall under the act have four main duties:

  1. Register with the NCSC.
  2. Duty of care. Take appropriate measures, based on a risk analysis. The NCSC names ten kinds of measures. One of them is supply chain security: the suppliers and service providers the organisation depends on.
  3. Duty to report. Give an early warning of a serious incident within 24 hours, a full notification within 72 hours, and a final report within one month.
  4. Directors must approve the measures, oversee them and have enough knowledge.

The fines are substantial: up to 10 million euros or 2 percent of worldwide turnover for essential entities, and up to 7 million euros or 1.4 percent for important entities.

Why the tenant comes knocking on the owner's door

An organisation that falls under the act must also look at the risks at its suppliers. The building is part of that. The network, the technical room, access to the building and the building systems can all be a weak spot.

So a tenant may ask questions such as:

  • Is the network of the building systems separate from our network?
  • Who has remote access to the building systems, and how is that secured?
  • Who can enter the technical room and the patch cabinet?
  • How quickly will we hear about a security incident at the building?
  • Who is responsible for which system?

There is no certificate that proves a building "complies with the Cybersecurity Act". So tenants will ask for explanations, agreements in the lease and evidence that the basics are in order.

A firewall with three separate networks: one for the building systems (climate, access, cameras and sensors), one per tenant and a guest network for visitors.
Separate networks: the firewall decides which traffic may pass between them.

What can you do now as an owner?

  1. Map what is connected to the network. Climate, access, cameras, lifts, charging points, meters. What you do not know, you cannot protect.
  2. Separate the networks. Building systems, tenants and guests each in their own part, with a firewall between them. Read Cybersecurity in smart buildings: separate the networks.
  3. Arrange remote access. Only give installers and suppliers access when it is needed, through one secure entrance, with a personal account per person and two-step verification.
  4. Lock the technical rooms, and keep track of who has access.
  5. Record who does what. The IT Demarcation List makes clear per system who is responsible.
  6. Agree how you report incidents. Tenants with a 24-hour reporting duty want to know quickly when something goes wrong.

What can you do as a tenant?

Does your organisation fall under the act? Then include the building in your risk analysis. Ask the questions above at the viewing, and record the answers in the lease. Also use our checklist for renting an office.

What does this mean for the IT-Label?

The IT-Label is not proof that you comply with the act. But it does show independently how the digital infrastructure of a building is set up, including how the networks are separated and the building systems are protected. That gives owners and tenants a shared starting point for the conversation. Read more about the laws around IT in buildings on IT and regulation. Want to know how your building is doing? Take the free self-scan or request a pre-inspection.

Sources

Further reading

Article 27 October 2026 How much internet bandwidth does an office need? How fast should an office internet connection be? A simple worked example helps you work out what your team needs for video calls, the cloud and AI. Article 22 October 2026 IT and OT: the difference, and why it matters in buildings IT is about data, computers and networks. OT is about the machines and installations that control physical processes. What is the difference, and why do they come together in smart buildings? News 28 September 2026 New: the free IT-Label self-scan Answer nine questions and within two minutes you will see which IT-Label your building is likely to achieve, and where the biggest gains are.

Take the free self-scan and find out within two minutes which IT-Label your building is likely to achieve. Or ask our specialists for help, with no obligation.

Take the free self-scan