Wet beveiliging netwerk- en informatiesystemen (Wbni)

Wbni: the Dutch NIS1 law that made essential providers and government secure their networks and report cyber incidents, replaced by the Cyberbeveiligingswet.

The Wet beveiliging netwerk- en informatiesystemen (Wbni) was the Dutch law that transposed the EU's first Network and Information Security Directive (Directive (EU) 2016/1148, "NIS1") into national law. The Wbni applied from 9 November 2018 and aimed to strengthen the digital resilience of the Netherlands, in particular of essential providers, central government and digital service providers. Covered organisations carried a duty of care and a duty to report incidents that could disrupt their services - organisations falling under the Wbni had a duty to report and a duty of care - in most cases towards the Nationaal Cyber Security Centrum (NCSC) and their sector regulator.

The law also gave the NCSC a clearer role in sharing information: from 1 December 2022 the Nationaal Cyber Security Centrum (NCSC) had a statutory basis to share information with other organisations, for example about a vulnerability or a ransomware attack. The Wbni applied until 15 August 2026, when the Cyberbeveiligingswet (Cbw) took its place, transposing the broader successor directive NIS2 and extends the duty of care and incident reporting obligations to many more sectors and organisations.