Since 15 August 2026, secure document exchange is no longer optional for Dutch municipalities: it is part of a legal duty of care. Under the Dutch Cybersecurity Act (Cyberbeveiligingswet, Cbw), every municipality is designated an essential entity, regardless of its size. That means appropriate measures to secure information systems, BIO2 as the legal framework for that duty of care, supervision by the Dutch Authority for Digital Infrastructure (RDI) and a municipal executive that is ultimately responsible. External document exchange, with care providers, lawyers, contractors and residents, is exactly where sensitive information leaves the municipal environment. If you cannot demonstrate control over that process, there is a gap in your Cbw approach.
In this article you will read what the Cybersecurity Act requires of municipalities, why email attachments and consumer services do not fit those requirements, and how to set up secure document exchange in a way you can also prove. With the Cbw self-assessment further down, you can see in three minutes where your municipality stands.
In short
– Since 15 August 2026, municipalities and some joint arrangements (gemeenschappelijke regelingen) are an essential entity under the Dutch Cybersecurity Act.
– BIO2, the Dutch government information security baseline, is the legal framework for the duty of care. Information transfer, encryption, access management and supplier management all fall under it.
– The RDI supervises and can enforce with an order subject to a penalty or an administrative fine.
– The municipal executive is ultimately responsible and must complete mandatory training within two years.
– Secure document exchange takes more than encryption: you must be able to demonstrate who shared what with whom, when and under which conditions.
What does the Cybersecurity Act mean for Dutch municipalities?
The Cybersecurity Act is the Dutch implementation of the European NIS2 Directive and replaces the Network and Information Systems Security Act (Wbni). According to the Dutch government (in Dutch), more than 8,000 Dutch organisations fall under the act, across 18 sectors. Government is one of them.
For municipalities, four obligations are key:
- Registration. Municipalities and joint arrangements that fall under the Cbw must register in the national entity register through the portal of the NCSC, the Dutch National Cyber Security Centre.
- Duty of care. Municipalities take appropriate technical, operational and organisational measures based on a broad cyber risk analysis. The Association of Netherlands Municipalities (VNG) confirms that BIO2 (Baseline Informatiebeveiliging Overheid 2) thereby gets an explicit legal basis. What the BIO2 requires for file sharing, and which evidence an auditor expects, is explained in ISO 27001 secure file sharing: what control 5.14 and BIO2 require.
- Incident reporting. You report a significant incident to the NCSC within 24 hours of becoming aware of it, followed by a more detailed notification within 72 hours and a final report no later than one month after that.
- Governance responsibility. The municipal executive is the risk owner. All members complete mandatory training with a certificate within two years of the act taking effect.
Supervision lies with the Dutch Authority for Digital Infrastructure (RDI). The RDI works risk-based and focuses on remediation and improvement first, but can enforce with an order subject to a penalty or an administrative fine. There is no transition period. Just before the act took effect, the VNG told its members that “additional steps are needed for many municipalities”, including in governance, capacity and technical resilience (iBestuur, August 2026, in Dutch).
A full explanation of the act is on our page about NIS2, the Dutch Cybersecurity Act and secure file sharing.
Why external document exchange is a Cbw risk for municipalities
A municipality shares sensitive information with parties outside its own organisation every day. For example:
- Social domain: youth care, social support and participation files shared with care providers, neighbourhood teams and chain partners, often containing citizen service numbers (BSN) and special categories of personal data.
- Spatial planning: building drawings, structural calculations and environmental permits shared with architects, contractors and consultancies. These files are often too large for email.
- Legal affairs: objection and appeal files shared with lawyers and the courts.
- Operations: personnel files, tender documents and accountancy documents.
- Partnerships: exchange within joint arrangements, safety regions and municipal health services (GGD).
In all these flows, information leaves the managed network. And that is where things most often go wrong in practice. According to the 2025 annual report of the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP), the AP received 44,374 data breach notifications, and almost three quarters of them concerned letters and emails that did not reach the right person (Binnenlands Bestuur, April 2026, in Dutch).
Email was designed for messages, not for controlled file transfer. An attachment is a copy you can no longer revoke, you do not know whether the right recipient opens it, and no verifiable trail remains. Free consumer services for large files solve the size problem, but not the control problem. Why email remains so persistent is explained in our article on emailing sensitive documents.
Which Cbw obligations directly affect document exchange?
The Cbw does not prescribe a specific product. The act requires appropriate measures, and the topics that NIS2 lists in Article 21(2) touch external document exchange in several places.
| Cbw / NIS2 topic | What it means for document exchange |
|---|---|
| Risk analysis and policy (Art. 21(2)(a)) | External file flows are explicitly included in the risk analysis, with an owner per flow. |
| Cryptography and encryption (Art. 21(2)(h)) | Files are encrypted in transit and at rest, in line with documented policy. |
| Access management and authentication (Art. 21(2)(i) and (j)) | Only the intended, verified recipient gets access. Employees sign in with MFA or SSO. |
| Supply chain security (Art. 21(2)(d)) | The supplier of your exchange solution is demonstrably reliable, for example through ISO/IEC 27001 certification. |
| Incident handling and reporting | In an incident you can quickly reconstruct what was shared, with whom and when. |
| Governance responsibility | The executive can show the council and the supervisor that the risk is under control. |
A file sent to the wrong recipient is usually first and foremost a GDPR data breach, with its own 72-hour deadline for notifying the Dutch Data Protection Authority. But the underlying question is the same: did the municipality take appropriate measures, and can it demonstrate that? See also our page on GDPR and secure file sharing.
From encryption to provability
Many organisations answer the question “do we share securely?” with “yes, it is encrypted”. Under the Cybersecurity Act, that is not enough. A supervisor, auditor or municipal council asks not only whether you protect information, but also how you demonstrate it.
Provability means that for every external exchange you can show:
- who shared the file and with whom;
- when it was sent, opened and downloaded;
- how the recipient was verified;
- how long the file was available and whether access was revoked;
- under which policy the exchange took place.
Together, this data forms an audit trail. It helps with an incident notification within 24 hours, with a request from the RDI and with the executive’s accountability to the council. Which evidence belongs to which obligation is explained in our article on Cybersecurity Act evidence for file sharing.
How to set up secure document exchange: five steps
1. Map your external file flows
Take stock, per department, of which external parties you share documents with, what type of information is involved and which channel is used today. Start with the social domain and permits: that is where the most sensitive and the largest files are.
2. Classify and link to BIO2
Determine the reliability level of each flow and the BIO2 measures that go with it. The Information Security Service (IBD) of the VNG provides guidance and remains the point of contact for municipalities after 15 August.
3. Choose one controlled channel for sensitive files
Fragmentation is a risk in itself. Agree that confidential and large files go through one managed solution, with fixed rules for verification, expiry and logging. Make sure the channel also works for recipients without an account, otherwise employees will still find a workaround.
4. Make it easy for employees
Security that works is security that gets used. Integration with Outlook and sign-in with the existing municipal identity (SSO) lower the threshold. Combine the rollout with short, practical training, so employees know when and how to use the channel.
5. Record and evaluate
Export activity logs periodically, discuss deviations in the information security meeting and report to the executive and council in the planning and control cycle. This turns secure document exchange into a demonstrable part of your Cbw approach.
White paper: Grip op de Cyberbeveiligingswet (in Dutch)
In the free white paper we work this approach out into a 90-day plan in six steps, with an owner and a concrete piece of evidence for each step. Including a worksheet for mapping your file flows and the self-assessment on paper. The white paper is available in Dutch.
Cbw self-assessment: how does your municipality score?
How well does your municipality control external document exchange? Answer twelve statements, spread across the four essentials for control: policy (what, why and for whom), access (who, how and for how long), usability (can the whole task be completed) and evidence (what can you demonstrate). You see your score straight away, plus the element where you should start. Your answers are not stored.
Cbw self-assessment for municipalities
How does your municipality score?
Twelve statements on external document exchange, across the four essentials for control: policy, access, usability and evidence. At the end you see your score and where best to start. Takes about 3 minutes.
How to read your result: 0 to 10 points means vulnerable, 11 to 18 points on track and 19 to 24 points in control. If an element scores 3 points or fewer (out of 6), that is your first priority.
What to look for when choosing a solution
Use this checklist when selecting a solution for secure document exchange:
- ✓ Encryption in transit and at rest
- ✓ Recipient verification, also without an account
- ✓ Configurable expiry and revocable access
- ✓ Searchable and exportable audit trail
- ✓ Support for large files (building drawings, video, archives)
- ✓ Integration with Outlook and SSO via Microsoft Entra ID
- ✓ Supplier with ISO/IEC 27001:2022 certification
- ✓ Clarity about the hosting location
- ✓ Honest scoping: which responsibility stays with the municipality?
How Msafe supports municipalities
Msafe Secure File Transfer is a managed environment for controlled external file exchange. Employees share files through the web environment or Outlook. Recipients are verified with their phone number and can collect files without an account using Easy Download. Every upload, download, share and deletion can be traced and exported for investigation and reporting.
Msafe has been active since 2012, is ISO/IEC 27001:2022 certified by DEKRA and hosts data in the Netherlands. Files up to 1 TB are supported as standard, larger files on request.
One thing we say honestly: no tool makes a municipality Cbw-compliant automatically. Msafe supports measures such as access management, verification and logging. The setup, the policy and the ultimate responsibility remain with the municipality.
"Municipalities do not have to prove they have the perfect tool. They need to be able to show they are in control: who shares what, with whom and under which conditions. That is what provability is about."
Hennie Jansen, CCO Msafe
Curious how other organisations approach this? Take a look at our customer cases, for example how NS shares confidential and large files securely.
Frequently asked questions about the Cybersecurity Act and document exchange
Do all Dutch municipalities fall under the Cybersecurity Act?
Yes. Municipalities, provinces and water boards are designated essential entities, regardless of their size. Joint arrangements must assess for themselves whether they fall under the act. If they do, the arrangement itself is responsible for compliance.
Who supervises municipalities under the Cbw?
The Dutch Authority for Digital Infrastructure (RDI). The NCSC performs the statutory CSIRT tasks for municipalities and receives incident notifications.
Is BIO2 mandatory under the Cybersecurity Act?
With the Cbw, BIO2 gets an explicit legal basis as the way governments fulfil their duty of care. In practice, BIO2 is therefore the framework along which municipalities set up and account for their measures.
Is encrypted email enough for secure document exchange?
Encryption protects the content in transit, but it does not solve everything. Under the Cbw you also want to be able to demonstrate who had access, how the recipient was verified and whether access can be revoked. For large files, email falls short as well.
How quickly must a municipality report an incident?
You report a significant incident to the NCSC within 24 hours of becoming aware of it, with a more detailed notification within 72 hours and a final report no later than one month after that. If personal data is involved in a breach, the GDPR also requires notifying the Dutch Data Protection Authority within 72 hours.
What does the municipal executive have to do itself?
The executive is ultimately responsible for managing cyber risks, must make sufficient resources available and completes mandatory training with a certificate within two years of the act taking effect.
How do I know whether my municipality is ready for secure document exchange under the Cbw?
Take the Cbw self-assessment in this article. Twelve statements on policy, access, usability and evidence give you an indication in three minutes of where your municipality stands and where best to start.
Free Cbw working session for municipalities
Want to turn your self-assessment into concrete actions? In the free Cbw working session you map, together with an Msafe specialist and in 60 minutes, which files leave your municipality, who receives them and what you can demonstrate about that. Within two working days you receive:
- the completed External Data Control Canvas with your external file flows;
- a scorecard on the four essentials: policy, access, usability and evidence;
- a top 3 of improvement actions with an owner and a deadline.
The canvas remains yours, even if you do nothing further with Msafe. The working session is intended for CISOs, information security officers, privacy officers and information management leads of municipalities and joint arrangements that fall under the Cbw.
Book the free working sessionDownload the white paper (Dutch)
Sources (in Dutch unless stated otherwise)
- Dutch government, Cyberbeveiligingswet en Wet weerbaarheid kritieke entiteiten vanaf 15 augustus 2026 van kracht, 7 July 2026
- VNG, Cyberbeveiligingswet, NIS2-richtlijn en Wet weerbaarheid kritieke entiteiten: nieuws en updates
- iBestuur, Veel gemeenten moeten nog stappen zetten voor cyberwet, 14 August 2026
- Gemeente.nu, Cyberbeveiligingswet van kracht: gemeenten moeten zich registreren bij het NCSC, September 2026
- Binnenlands Bestuur, Meer klachten en datalekken, maar minder boetes, 7 April 2026
- European Union, Directive (EU) 2022/2555 (NIS2) (English)
- European Union, General Data Protection Regulation, Article 33 (English)
