Registration duty, step by step

Alongside the duty of care, the Cyberbeveiligingswet has a separate registration duty. Here's what's settled so far.

What registering actually means

Essential entities, important entities and domain-name registration service providers are entered into a national register kept by the central contact point (article 43 Cbw). That register is separate from sectoral oversight: while oversight differs per sector (article 15 and 68 Cbw, see the supervisory authorities page), registration itself runs through a single central point.

Which data, and when

Article 44 Cbw requires you to submit registration information. Exactly which data, within what deadline, and how you report changes, is worked out through a general administrative order (AMvB) — which, at the time of writing, has not yet been published. Once that AMvB appears, we'll update this page with the exact fields and deadlines.

What you can already prepare

• Your chamber-of-commerce (KvK) number and statutory name.
• The sector(s) you operate in, with a first estimate via the scope check.
• A fixed point of contact for cybersecurity within your organisation.
• An overview of the organisations, projects or services covered by your registration.

Exemptions

Article 45 Cbw allows the competent authority to fully or partly exempt you from the information duty, under conditions likewise set by AMvB or decision. Such an exemption doesn't follow automatically — you request it from your supervisor.

How Munitor helps

The Pro subscription includes a registration tracker that keeps track of which data you've submitted, when, and when an update is due, so registering never turns into a yearly hunt through old emails.