Since 15 August 2026, the Cyberbeveiligingswet (the Dutch Cybersecurity Act, Cbw) has been in force in the Netherlands. It is the Dutch implementation of the European NIS2 directive. The act places responsibility for cyber risks with the board. That raises a practical question: do access control and MFA also hold up when someone calls the service desk?
What is the Cybersecurity Act?
The Cybersecurity Act applies to organisations that provide essential or important services, in 18 sectors. Think of energy, drinking water, digital infrastructure, healthcare, government and transport. According to Security Management, this concerns more than 8000 organisations. Organisations must assess for themselves whether they fall under it.
The act has three obligations:
- Duty of care. Taking measures to manage the risks to the security of network and information systems.
- Duty to report. Reporting significant incidents within the statutory deadlines.
- Duty to register. Registering with the NCSC.
What does the act require of the board?
The board bears ultimate responsibility for cyber risk management. Board members must have sufficient knowledge to assess risks and security measures, and must complete appropriate training for this. Cyber security is therefore not just a topic for IT, but also for the boardroom.
Access control and MFA in NIS2
NIS2 Article 21 lists the measures that organisations must take. These include access control policies (paragraph 2, point i) and the use of multi-factor authentication (paragraph 2, point j).
The directive does not specify a method for verifying callers to the service desk.
Where the service desk comes into the picture
Access control and MFA protect the sign-in. But they also have to be recoverable, for example after a forgotten password or with a new phone. That recovery can run through the service desk. Anyone who gets the service desk to carry out a reset bypasses those measures.
CISA and the FBI describe this happening in practice in their advisory on Scattered Spider. That makes the reset via the service desk a logical place to test whether your access control and MFA measures hold up in practice.
What can you do?
- Test whether your service desk holds up. An account takeover assessment shows whether your service desk releases an account to someone who calls. Always within signed authorisation.
- Look at where the process leaves room. A process analysis shows where policy and practice diverge.
- Choose technical verification. Technical measures replace the judgement of a single employee with a control that the caller must pass themselves.
- Bring the board on board. The report and the final presentation give the board a concrete picture of the risk.
