The weakest entry may still be someone saying “come in”

The important point is where the rule meets the real scene:Paid “intruders” sometimes need no code exploit. A copied badge, false identity or convincing reception story can cross the first boundary. That scene explains why the new laws address both digital systems and physical resilience: suppliers, caterers and front-desk processes can all become chain entry points. The legislation does not require every organisation to hire a red team. It should first use official scope guidance to decide whether it is important or essential, then register, map dependencies and build incident reporting. Hokimi’s view is that smaller suppliers cannot treat this as only a hospital or energy-company issue because chain requirements travel downward. For context, The Cybersecurity Act and Critical Entities Resilience Act took effect on 15 August, bringing registration, duty of care, incident reporting and board responsibility to 18 sectors.

• Both laws took effect on 15 August 2026.
• The Cybersecurity Act covers 18 sectors and more than 8,000 organisations.
• Duties include registration, risk care, major-incident reporting and board responsibility.
• About 500 critical entities also face designation and resilience duties under the Wwke.

Hokimi field note: A responsible manager should complete the NCTV/NCSC scope check and confirm eHerkenning authority first. Do not buy an expensive test before understanding the actual legal duties.

Information verified on 16 August 2026 · Source1 · Source2 · Source3