Cybersecurity and law
Introduction
Our infrastructure is highly dependent on digital processes. IT incidents can therefore disrupt society.
Extensive digitalization, including the increase in the number of remote workers, the rise of the Internet of Things (IoT), and cloud computing, has led to more (successful) digital attacks. AI is also being increasingly deployed by cybercriminals, and the trend is that they are also targeting cloud services and mobile devices more frequently.
Nevertheless, there is still little awareness regarding cybersecurity at many companies. It is not (yet) a standard part of senior management/the board.
Increase in cybersecurity regulations
Cybersecurity is an important theme for the EU in 2026; Europe must be digitally resilient ('cyber resilience'), also to remain competitive with the US and China.
In recent years, various new (European) legislation has been introduced in the field of cybersecurity. Examples include the Cyber Resilience Act (CRA), the Cybersecurity Act, the Digital Operational Resilience Act (DORA), and the NIS2. In the Netherlands, the NIS2 will be implemented via the Cyberbeveiligingwet (Cbw).
This leads to an increase in 'cyber obligations' for many companies across various sectors. The government (such as municipalities and provinces) also faces additional regulatory pressure. The Cybersecurity Act obliges companies and the government to adequately secure their IT systems, report significant IT incidents, and make specific contractual agreements with (IT) suppliers. The board must supervise these matters and can be held liable.
One must be fully aware of these new cybersecurity laws and regulations in the event of a serious IT incident (e.g., a cyberattack). Understanding the legal cybersecurity landscape is essential for Incident Response.
