Cyberbeveiligingswet · NIS2
The Cyberbeveiligingswet (NIS2) starts with your external attack surface
Since 15 August 2026, the Cyberbeveiligingswet — the Dutch implementation of NIS2 — requires around 8,000 essential and important organizations to manage their cyber risk, report incidents and hold their boards accountable. The duty of care begins with a question most organizations can't fully answer: what of ours is exposed to the internet? AKASCAN answers it, every month.
What the law asks
Four obligations, one starting point
The Cyberbeveiligingswet (Cbw) transposes the EU NIS2 directive and replaces the Wbni. Whether it applies to you depends on your sector and size. These are the duties at its core — all of which assume you know what you're defending.
Duty of care (zorgplicht)
Assess your cyber risks and take appropriate, proportionate measures — risk analysis, access control and incident procedures among them.
Reporting & registration
Register with the NCSC and report significant incidents through the national channel within the set deadlines.
Board accountability
Management must approve the risk measures, oversee them and be trained — responsibility sits with the board, not only with IT.
Supply-chain security
Your duty of care extends to the security of your suppliers and service providers, not just your own systems.
Where AKASCAN fits
External discovery, as evidence for your duty of care
AKASCAN is not a compliance checklist — it's the offensive-style external discovery that feeds the risk analysis the zorgplicht requires. Each month, AI agents re-map your internet-facing assets and exposure, and AKASEC specialists validate and prioritize what changed.
Know your real attack surface
You can't assess a risk you can't see. We surface forgotten domains, shadow IT and exposed services — the external footprint behind your risk analysis.
Board-ready monthly evidence
A documented, validated report every month — the kind of demonstrable record a board can point to when overseeing cyber risk.
Supplier-facing exposure
We map the externally visible exposure of the domains and third parties in your scope, supporting the supply-chain side of your duty of care.
Local AI, analysed in the Netherlands
Analysis runs on our own hardware in the Netherlands with local AI models — never a third-party or non-EU AI cloud. Reports are shared EU-hosted or end-to-end encrypted.
Scope
A building block, not a compliance guarantee
AKASCAN supports specific parts of the Cyberbeveiligingswet's duty of care — knowing and continuously monitoring your external attack surface.
See what's exposed before your supervisor — or an attacker — does
Start monthly external asset discovery, or request a custom scope for larger or sensitive environments. AKASEC reviews every scope before any work begins.