The Cyberbeveiligingswet is in force: what it means for your electrical assets

The short version: since 15 August 2026 the Cyberbeveiligingswet (Cbw), the Dutch implementation of the EU NIS2 directive, applies to organisations in 18 sectors, including energy. Covered organisations must register with the NCSC, take appropriate security measures, report significant incidents, and their board is responsible for cyber risk. For electrical infrastructure, this means substations, protection relays, SCADA and energy management systems are now part of a legal duty of care. At APARA, OT cybersecurity is a standard deliverable in every engineering package, not an add-on.

What changed on 15 August 2026

The Cyberbeveiligingswet replaces the Wbni and applies to more than 8,000 organisations in the Netherlands. The main obligations:

• Registration in the NCSC entity register. Organisations must assess for themselves whether they are in scope.
• Duty of care (zorgplicht): appropriate and proportionate measures to manage risks to network and information systems.
• Incident reporting (meldplicht): significant incidents must be reported to the CSIRT and the competent authority within statutory deadlines.
• Board responsibility: the board must approve the security measures, oversee their implementation and have enough knowledge to judge them.

The Wet weerbaarheid kritieke entiteiten (Wwke) also came into force on the same day, with extra resilience obligations for around 500 designated critical entities, many of them in energy.

Why electrical assets are now in scope

Cybersecurity used to be an IT topic. That is no longer true for the energy sector. A modern substation is a network: digital protection relays, IEC 61850 communication, RTUs, gateways, remote access for engineers and vendors, and links to SCADA and energy management systems. Each of these is a network and information system under the Cbw.

The consequence is practical. If a relay can be reached remotely, if default passwords are still active or if the OT network is flat, that is now a governance issue, not only an engineering one.

More rules on the way

The Cbw is not the only change:

• Network Code on Cybersecurity (EU 2024/1366): a sector-specific code for electricity, with minimum and advanced controls and supply chain requirements for entities designated as high-impact or critical-impact. The EU risk assessment and control sets are being developed through 2026 and 2027.
• Cyber Resilience Act: since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents. Full requirements follow in December 2027. This affects the relays, controllers and gateways we install.

The direction is clear: asset owners will ask more of their suppliers and contractors. Supply chain security is part of the NIS2 duty of care, so the security of what an EPC contractor designs and installs becomes part of the owner's compliance.

How APARA applies this in our projects

We design to IEC 62443, the international standard for industrial automation and control system security. In every engineering package we deliver OT security as a standard part of the scope:

1. Asset inventory
A complete list of every networked device in the scope: relays, RTUs, PLCs, switches, gateways, HMIs, with firmware versions and communication paths.

2. Zones and conduits
We split the installation into security zones (for example protection, station control, remote access) and define the conduits that connect them, following IEC 62443-3-2. Each zone gets a target security level based on risk.

3. Secure network architecture
Segmented OT networks, controlled remote access, no direct paths from office IT to protection devices. Protection and cybersecurity are designed as one system, not bolted on afterwards.

4. Device hardening
Default credentials removed, unused ports and services disabled, role-based access configured, and logging enabled on relays and controllers.

5. Security requirements for vendors
Clear cybersecurity requirements in the specifications for equipment and subcontractors, so the supply chain meets the same standard.

6. Testing and handover
Security checks are part of FAT and SAT. At handover the owner receives the documentation needed for their own Cbw compliance: architecture, inventory, configurations and residual risks.

What this means for asset owners

If your organisation falls under the Cbw, your board now answers for the security of your OT systems. The easiest moment to get that right is during design, not after commissioning. Retrofitting segmentation and hardening into a running substation costs far more than engineering it in from the start.

Planning a substation, grid connection or control system upgrade?

APARA delivers electrical, instrumentation and automation engineering with OT security built into every package. Contact us to discuss how we can support your project and your Cbw compliance.

Related insight: From 10 MW to 5 MW: how we got a project in Amsterdam permitted despite grid congestion