01
Complete asset inventory with owners
Art. 16 of the decree. Infrastructure, applications, information and the people and teams that own them — as a connected register, not a flat list.
The complete, current asset inventory the Dutch Cybersecurity Act requires. Demonstrably.
Since 15 August 2026 the Cyberbeveiligingswet applies to more than 8,000 Dutch organisations across 18 sectors. The implementing decree requires a complete and current inventory of your assets, under a policy you demonstrably apply. A spreadsheet or one-off consulting report goes stale immediately. ITLedger is a living IT register: assets, owners, suppliers, certificates and change history in one place.
The evidence question
What a regulator, auditor or customer can request — and where it lives in ITLedger.
Supervision by the RDI is risk-based, and for important entities largely incident-driven. When something happens, what counts is not the policy you have but the evidence you can show.
02
CIA classification
Art. 16(2) requires classification by confidentiality, integrity and availability. In ITLedger that is a field on the record, not a separate document.
03
Suppliers and dependencies per system
Art. 10 (supply chain). Which supplier touches which system, under which contract — recorded as relationships, not as a questionnaire.
04
Incident records with timelines
Art. 8 and the 24-hour / 72-hour / final-report duties. Incidents, affected assets and the full timeline live in the same system as the register.
05
Certificates and encryption
Art. 21 of the Act names cryptography policy. Sentinel watches certificate expiry and raises what needs attention — before an auditor or outage does.
06
Proof that it stays current
The word “current” is in the law. Change history, source provenance and freshness checks show the register is alive rather than decaying.
From spreadsheet to demonstrable register
Turn existing sources into a register your team can maintain.
We agree sources, scope and expected results before work starts. Timing depends on the volume, quality and structure of your data.
Hand over what you have
The spreadsheets, exports and documentation you already keep. Perfection is not a precondition; provenance is recorded.
Mapping and dry run
Useful fields are mapped to the fixed ITLedger model. You see duplicates, new records and relationship candidates before anything is written.
Controlled import
Only the agreed mutation is applied. Every record keeps its source provenance — that is your evidence later.
Keeping it current
Sentinel flags expiring certificates, stale sources and missing ownership through the checks you enable. Your team reviews the findings and maintains the records.
Evaluation and onboarding
Explore ITLedger and start with your own data.
Explore the app for free. When you choose a licence, onboarding includes processing and importing the spreadsheets, exports and documents you supply. We review the result together.
01
Free evaluation
Explore the model, workflows and inventory capabilities before choosing a licence.
- ✓Explore the app at your own pace
- ✓Test with a controlled selection of your data
- ✓Discuss your sources and operational questions
02
Onboarding with your licence
We help process and import your supplied data into the ITLedger model. Your team reviews records, relationships and open questions with us.
- ✓Processing and importing agreed sources included
- ✓Extra processing for large or unstructured datasets agreed upfront
- ✓Review records and relationships together for daily use
Prefer to look around first?
Start a free evaluation and import a controlled slice yourself. Discuss your scope and timing if you need help processing your sources.
Open free evaluationRegistration duty
Registering with the NCSC is mandatory since 15 August.
Organisations covered by the Cyberbeveiligingswet must register via Mijn.NCSC.nl (login with eHerkenning). You will need, among other things: name and contact details, IP ranges, sector, and the EU member states where you provide services. Failing to register is directly enforceable with a fine or order subject to a penalty. ITLedger’s NIS2 configuration records entity class, sector and NCSC details so this information does not live in someone’s mailbox.
What you need
- —Name, address and current contact details (email, phone numbers, IP ranges)
- —Sector and subsector per annex 1 or 2 of the Act
- —EU member states where you provide services
- —eHerkenning to log in to Mijn.NCSC.nl
FAQ
Questions about the Cyberbeveiligingswet and ITLedger
Does my organisation fall under the Cyberbeveiligingswet?
The Act covers organisations in 18 sectors with at least 50 employees or more than €10 million turnover; some organisations are covered regardless of size. The Dutch government offers a self-assessment at regelhulpenvoorbedrijven.nl. Even outside the formal scope, the obligations can reach you through the supply chain: covered entities must verify their suppliers.
Does ITLedger make us NIS2-compliant?
No — and distrust anyone who promises that. The Act also requires risk management, policy, training and reporting processes. ITLedger delivers the operational evidence layer: the inventory, relationships, certificates and history that all those other obligations refer back to. It works alongside an ISMS or GRC tool, not instead of one.
We already have an ISMS tool with an asset list.
ITLedger connects inventory to tickets, changes, certificates and suppliers. This helps teams capture changes during daily work. Your team remains responsible for maintaining records and reviewing completeness.
15 August has passed. Are we too late?
The obligations apply from the Act’s entry into force. Check which duties apply to your organisation with the NCSC. ITLedger helps organise your inventory and supporting data; timing depends on your scope and available sources.
Start with the inventory. The rest of the programme gets easier.
Every conversation — with a regulator, auditor or major customer — starts with the same questions: what do you have, who owns it, and is it current? Book an introduction and show us the data you have today.