NIS2 and backup requirements

Since 15 August 2026, the Netherlands has been subject to the Dutch Cybersecurity Act (Cbw), which implements the EU NIS2 directive. The law replaces the Network and Information Systems Security Act (Wbni). For many organizations, this raises the question of what's concretely expected of their backup and recovery.

The law applies to organizations providing essential or important services in 18 sectors, including energy, drinking water, digital infrastructure, healthcare, government, and transport. According to the Dutch government, this covers more than 8,000 organizations. Organizations are responsible for assessing themselves whether they fall under it.

Even if you don't fall under it directly, you may still be affected: customers who do fall under the law must also manage the security of their suppliers, and will therefore place requirements on you.

• Registration duty: registration in the entity register via the NCSC.
• Duty of care: appropriate and proportionate measures to manage risks to network and information systems.
• Reporting duty: timely reporting of significant incidents.
• Board responsibility: the board holds ultimate responsibility and must oversee the measures.

The NIS2 directive explicitly names business continuity, such as backup management and recovery after an incident, and crisis management as part of the required measures (Article 21). In practice, this means for most organizations:

• A documented backup strategy per system, with deliberate choices for RPO and RTO (see RPO and RTO explained).
• Protection of backups against ransomware, for example with immutable storage or an offline copy (see the 3-2-1-1-0 rule).
• Demonstrably working recovery: periodic recovery tests, with documented results.
• Access management and MFA on backup management, because backup environments are a popular target.
• Assessment of your backup provider as part of supplier security: where is the data located, under which jurisdiction does the provider fall, what certifications does it hold?

No backup service makes an organization "NIS2 compliant." Compliance is about your entire risk management, your processes, and your ability to demonstrate them. A good service can, however, fill in a large part of the technical measures around backup and recovery, and provide reports you can use as evidence.

These points factor into our Security & compliance and Recovery & continuity criteria. In the provider comparison, you can also see each provider's data location and parent company country.

Sources: Dutch government, news release 7 July 2026 on the entry into force of the Cbw and Wwke; NCSC, news release 15 August 2026; NIS2 directive (EU) 2022/2555, Article 21.

More guides