What has changed?
The Dutch Cybersecurity Act, or Cyberbeveiligingswet, implements NIS2 in the Netherlands and has applied since 15 August 2026. Article 35 of the implementing decree sets that date. Read the commencement provision.
Coverage depends on sector, activities, size and exceptions. Group structures can also matter. Supplying an organisation covered by the Act does not automatically make a supplier directly subject to every obligation. Start with the NCTV explanation of scope.
This article covers one part: incident follow-up. The Act also addresses risk management and management responsibilities. A well-configured ticketing system does not demonstrate compliance with the entire law. See the official overview.
Start with one service that must keep working
Consider customer order processing. Identify the systems involved, the service owner and an authorised deputy. Agree how staff report a disruption when the normal reporting system is unavailable. A short, practised procedure may be more useful than another platform.
Maintain one case for the event. Link reports shown to concern the same incident while preserving their origins and timestamps. Automatic grouping must not silently merge different disruptions into a single problem.
On a narrow screen, scroll the table sideways. With a keyboard, focus the table and use the arrow keys.
| Activity | Software can support | A person assesses |
|---|---|---|
| Detection | Register a signal, its source and time. | What was observed and which service is affected. |
| Follow-up | Assign a task, request acknowledgement and escalate missing responses. | Who has authority and whether the response is appropriate. |
| Collecting facts | Bring together known systems, contacts and earlier updates. | Facts, uncertainties and possible impact. |
| Reporting and recovery | Prepare a draft and monitor follow-up actions. | Reporting duties, content, submission and safe resumption. |
An internal ticket is not a regulatory notification
For significant incidents, NCTV describes an early warning within 24 hours, an incident notification within 72 hours and a final report within one month of the incident notification. Certain entities have different deadlines. The first two deadlines run from awareness, not whenever someone happens to create a ticket. Have the applicable criteria and trigger points established in advance. Check the reporting rules and exceptions.
Set reminders early enough to act without undue delay. Record initial signals as well as the assessment. A ‘waiting for approval’ status must not pause the reporting clock. Appoint an authorised deputy who can act under time pressure.
Fictional example: orders stop moving
A fictional wholesaler receives several reports of stalled orders. An existing monitoring rule opens a case. The service owner confirms the impact, while the security lead assesses whether this could be a significant incident. A draft overview separates known facts from missing information.
The workflow requests an authorised assessment and monitors the next step. It does not send a government notification on its own. If the primary owner is absent, the agreed deputy receives the task. After recovery, administration checks whether queued orders were processed correctly. A green technical indicator alone does not close the case.
Avoid creating another dependency
Practise a failed integration, a misassigned task and an unavailable ticketing system. Keep a usable fallback route. Restrict access to incident data and omit passwords and unnecessary personal information. Agree retention needs with the responsible owner instead of retaining every log indefinitely.
The ENISA guidance offers examples of evidence and working practices, particularly for the digital sectors covered by the associated EU implementing regulation. It is not automatically a complete framework for every sector.
When does automation justify the effort?
Measure time spent searching, handing work over and resolving missing information. In a limited trial, compare time to an authorised assessment, outstanding actions and rework. Include setup, checks, training and maintenance. Released capacity becomes a financial saving only when expenditure actually falls.
Frequently asked questions
Do we need AI?
Usually not for assignment, deadlines or status checks. Fixed rules are often clearer. AI might draft a summary in an approved environment, with a person comparing it to the source.
Does BMC Helix ITSM make us compliant?
No. An ITSM solution can organise work, but configuration, authority and daily execution determine whether it helps. Read about BMC Helix ITSM.
Where should we start?
With one service, an owner, a deputy and an exercise. Agree who decides, checks and maintains before choosing more software.
Discuss a concrete process?
Want to explore simpler ways to collect, check or transfer information? Describe one process and the systems you already use. A new tool is not always necessary. Introductory conversations are free and without obligation. Further advice and implementation are agreed separately through Korper, including scope and costs.