The Dutch Cybersecurity Act (NIS2) and your Microsoft 365 environment
The Dutch Cybersecurity Act (Cyberbeveiligingswet, Cbw) is the Dutch implementation of the European NIS2 directive. Organisations within its scope must manage risks, recognise suspicious events in time and report a significant incident within 24 hours. AlertControl helps with this for Microsoft 365 by making suspicious sign-ins, changes and alerts visible. It does not make your organisation compliant by itself.
Updated 30 October 2026
What does the Cybersecurity Act require?
• Duty of care: appropriate measures to manage risks, such as access management, multi-factor authentication, logging and incident handling.
• Duty to report: you report a significant incident within 24 hours with an early warning and within 72 hours with an incident notification.
• Board responsibility: the directors are ultimately responsible and must approve the measures.
Is my organisation in scope?
The act applies to essential and important entities in sectors such as energy, transport, healthcare, drinking water, digital infrastructure, government, postal services, waste, chemicals, food and manufacturing. It usually concerns medium-sized and large organisations: from 50 employees or more than €10 million annual turnover. For some sectors it applies regardless of size.
If you supply such an organisation, your customer may set requirements for you, because it also has to manage the risks in its supply chain.
How does AlertControl help?
• Recognise: suspicious sign-ins, sign-ins from abroad, new inbox rules, role and consent changes and security alerts are in one overview, with a severity for each event.
• Follow up and escalate: the Timeline lists all sources from the last 24 hours, so you quickly see what happened and when.
• Check measures: you see per user whether MFA is set up, and the optional AI advice names the most important improvements.
AlertControl does not report anything to the supervisory authority and does not make your organisation compliant by itself. It is a tool for recognising and following up.
Frequently asked questions
No. The Cybersecurity Act requires a whole set of measures, policies and responsibilities. AlertControl helps with one part: recognising and following up suspicious events in Microsoft 365 in time.
AlertControl helps you notice an incident in time and gives you the data you need to assess it. You make the report yourself to the designated body, such as your CSIRT or supervisory authority.
Possibly. Organisations under the Cybersecurity Act must also manage the risks at their suppliers and therefore often set requirements for security and monitoring. AlertControl can help you show that you monitor your Microsoft 365 environment.
Check whether your sector is covered and whether your organisation is medium-sized or large. If in doubt, consult the information from the Dutch government or the NCSC, or ask the supervisory authority for your sector.
See for yourself what is happening in your Microsoft 365?
Try AlertControl free for 30 days. You sign in with your Microsoft account and grant read-only consent once.