How can ManageEngine support essential and important entities in meeting the Cbw?
With ManageEngine Log360 (SIEM), organizations in scope can start aligning with the duty of care and reporting obligations under the Cbw. See the key requirements and how our solution helps in the table below.
Duty of care (zorgplicht) Duty of care (zorgplicht)
| Clause | Functionality | Explanation |
|---|---|---|
| Take appropriate technical and organizational measures to manage the risks to the security of network and information systems, on the basis of a risk assessment. | Log360 - Security and risk posture management, 2,000+ MITRE ATT&CK®-mapped detection rules, correlation engine, UEBA. | Log360's security and risk posture management identifies misconfigurations and attack-surface exposures across critical systems such as AD and SQL servers, supporting the risk assessment that drives the measures. Its detection rules, correlation engine, and UEBA provide the ongoing technical monitoring the duty requires. |
Reporting obligation (meldplicht) Reporting obligation (meldplicht)
| Clause | Functionality | Explanation |
|---|---|---|
| Detect significant incidents that significantly disrupt, or could disrupt, the continuity of services, in time to report them. | Log360 - Real-time event correlation, UEBA anomaly detection, Vigil IQ TDIR, dark web monitoring, threat intelligence (IoC/IP/URL/domain reputation). | Log360's correlation engine and ML-powered UEBA baseline normal behavior and flag time, count, and pattern anomalies that signal incidents such as account compromise, insider threats, and data exfiltration. Vigil IQ, threat-intelligence matching, and dark web monitoring surface threats early enough for the organization to begin the reporting clock. |
| Provide an early warning within 24 hours and a follow-up notification within 72 hours, with supporting incident detail. | Log360 - Incident Workbench, AI-generated incident and user timelines, Zia Insights, process lineage visuals, real-time alert profiles. | Log360 supports the substantive content of the early-warning and follow-up stages: the Incident Workbench consolidates telemetry from AD, threat feeds, and other tools, while AI-generated timelines and Zia Insights summaries assemble the incident detail an organization includes in its 24-hour and 72-hour notifications. Submitting the report through the NCSC portal is a procedural step performed outside the product. |
| Submit a final report no later than one month after the first notification, describing the incident, its severity, and its consequences. | Log360 - Searchable log archive, log retention, 1,000+ prepackaged report templates, incident and user timelines, ATT&CK mapping. | Log360 retains correlated event data in a searchable archive and reconstructs the sequence of an incident through incident timelines and ATT&CK mapping, providing the evidentiary basis for the detailed final report on the incident, its severity, and its consequences. Drafting and filing the report itself remains an organizational task. |
| Take measures to respond to and mitigate the impact of significant incidents. | Log360 - SOAR with 50+ default playbooks, visual playbook builder, automated incident response workflows, ITSM integration. | Log360 orchestrates response through SOAR playbooks and automated workflows that execute on detection to contain or reduce an incident's impact, and integrates with ITSM tools so cases are tracked to closure. Decisions about service restoration and crisis communication remain with the organization. |
Management oversight and accountability Management oversight and accountability
| Clause | Functionality | Explanation |
|---|---|---|
| The governing body is responsible for, and must be able to oversee, the cybersecurity risk-management measures the organization takes. | Log360 - Interactive dashboards, scheduled compliance reports, security posture dashboards. | While the assignment of responsibility to the governing body is an organizational matter outside any product, Log360 gives that body the oversight evidence it needs: its dashboards and posture reporting let leadership see the state of security monitoring. The mandatory director-training requirement itself is a personnel obligation with no software control and is not mapped. |
Supervision (toezicht) Supervision (toezicht)
| Clause | Functionality | Explanation |
|---|---|---|
| Demonstrate, to an independent supervisory authority, compliance with the duty of care and the reporting obligation. | Log360 - 1,000+ prepackaged report templates, searchable archive, log retention, audit-ready compliance reports. | Log360 produces the audit-ready evidence a supervisor reviews, retaining correlated logs in a searchable archive and shipping prepackaged report templates and dashboards. These let the organization show how the duty of care and reporting obligations are met without manual log parsing. |
| Maintain records of activity sufficient for independent verification and forensic review. | Log360 - Comprehensive audit trail, time-stamped logs, log retention, searchable archive. | Log360 centrally records time-stamped events with retention and a searchable archive. This gives supervisors and incident responders a defensible activity trail for verification and forensics. |
Registration obligation (registratieplicht) Registration obligation (registratieplicht)
| Clause | Functionality | Explanation |
|---|---|---|
| Maintain an accurate inventory of the entity's assets, including the internet domains under its responsibility, to support registration. | Log360 - Asset inventory, automatic device discovery, data discovery. | Log360 partially addresses this clause. Automatic device discovery and asset inventory catalog the systems an organization runs, helping keep registration data current. Mapping the specific internet domains in scope and submitting them to the NCSC entity register is a registration process performed in the portal, not a function of Log360, which supplies supporting asset data only. |
Conclusion
Now that you've explored how the Cbw raises the bar for digital resilience across essential and important entities in the Netherlands and how Log360 helps you meet its requirements, it's time to take the next step.
Whether it's identity governance, access control, audit logging, threat detection, meeting incident reporting deadlines, or building a compliance-ready audit trail, we're here to guide you through it. Start a 30-day free trial to experience our solutions in your own environment, or contact us to schedule a one-on-one consultation.
Disclaimer: The information provided on this page is for general knowledge and awareness purposes only. It is not intended to serve as professional, legal, or regulatory advice. Compliance with the Cyberbeveiligingswet depends on your organization's specific environment, processes, and risk profile. Organizations are themselves responsible for determining whether they fall within the scope of the law.
To accurately assess your compliance posture, we strongly recommend engaging a qualified consultant, compliance agency, or referring directly to the official Cyberbeveiligingswet text and guidance published by the Rijksoverheid, the Nationaal Cyber Security Centrum on ncsc.nl, and the relevant sectoral supervisory authority.