Cybersecurity Act (Cbw): what changes for your organisation?

The Cbw explicitly places responsibility for cybersecurity and risk management with the board. Executives must have sufficient knowledge and skills to recognise and assess cyber risks and must undertake appropriate cybersecurity training.

In the boardroom, the question therefore becomes not only “are we compliant with the Cbw?” but also “do we know how resilient our organisation is?”

The duty of care requires proportionate and appropriate measures. Think of risk analysis, incident response, business continuity, supplier and supply‑chain dependencies, cyber hygiene, access management and cryptography.

For significant cyber incidents there are statutory reporting deadlines: an initial notification must be made as soon as possible and no later than 24 hours after discovery. A further report must follow within 72 hours. This requires clear procedures, roles and responsibilities, and clarity on who makes which decisions under time pressure.

Organisations that fall within the scope of the Cbw must register in the national register of entities via the NCSC. This allows relevant authorities and CSIRTs to identify organisations in scope and contact them.

Supervision also changes. Regulators can check whether organisations comply with the obligations, for example by requesting information or conducting an audit. For essential entities this is done proactively; for important entities it is mainly triggered by an incident or signals of non‑compliance. If your organisation does not comply, the regulator can intervene, for example with a binding instruction or a fine.