Cyber Security Act and the digital workplace

Your business needs to become more digitally secure. But do you actually know how digitally secure and future-proof the workplace you work from is? It is a simple question, and yet it remains unanswered at many organisations.

Cybersecurity is usually seen as something for the IT department: firewalls, passwords, software, virus scanners and cloud security. That makes sense, because a lot happens there. But a digital organisation does not consist of software alone. Employees work from a building. That is where internet enters, where cabling runs, where network equipment is placed, where WiFi is used, and where technical rooms, access control, cameras, sensors and increasingly smart building systems are located.

In other words: digital security also has a physical location. And that location is often the part discussed least when choosing an office or business space.

What is the Cyber Security Act?

The Cyber Security Act (Cbw) is the Dutch implementation of the European NIS2 directive. The act came into force on 15 August 2026. Its purpose is easy to understand: the government wants important organisations to be better protected against cyberattacks, digital disruptions and outages.

Not every company automatically falls directly under the act. Organisations in sectors considered important or essential, think of energy, healthcare, transport, digital services and parts of industry, are the first to be affected directly. But there is an important consequence that reaches further: suppliers and chain partners of these organisations can also be indirectly confronted with stricter requirements. Anyone working with a party that falls under the act will therefore also feel the effects.

The core of the act can be summarised without jargon. Know your digital risks. Take appropriate measures. Know what you use. Make sure you are prepared if something goes wrong. And keep checking whether your security is still in order. Reading this, it becomes clear that it is not only about technology, but about awareness and continuity.

What does this mean for an ordinary user?

An entrepreneur does not need to become a cybersecurity specialist. That is not the intention of the act either. But organisations do need to increasingly know what their operations depend on. And much of that dependency lies in the building itself.

A few recognisable questions make this clear:

• What happens if the internet at the office goes down?
• Is a second connection available?
• Who has access to the technical room?
• Who manages the WiFi?
• Is it clear which network equipment belongs to the landlord and which to the tenant?
• Are smart devices and building systems sufficiently separated from the business networks?
• Who is responsible in the event of an outage or security incident?
• Does the organisation actually know what is technically present in the rented space?

Two simple examples bring this into sharp focus. A fast internet connection is not automatically a secure internet connection. And a modern office is not automatically a digitally modern office. Appearance and digital quality are two different things.

A building that looks sleek can still be a digital blind spot. What you cannot see can hit your business operations the hardest.

Why does this concern real estate?

When renting an office, an organisation usually asks the familiar questions. How many square metres do we get? How many workstations fit in it? What is the energy label? How many parking spaces are there? What are the service costs? All fair questions.

But a question is being added that is becoming increasingly important: what can this location digitally handle? Organisations are becoming ever more dependent on cloud software, video calling, data, cybersecurity and AI. This means that the quality of a building's digital infrastructure directly affects how well and how securely an organisation can work.

Digital infrastructure is therefore no longer a technical detail to be dealt with afterwards, but a part of the quality of the accommodation itself. Anyone who considers this in advance avoids surprises after moving in.

What does IT-Label have to do with this?

IT-Label aims to make the digital infrastructure and IT delivery level of commercial real estate visible and understandable. Not only for IT specialists, but specifically for the user: the entrepreneur, the facility manager, the tenant and the advisor.

The comparison with the energy label helps. The energy label helps you understand how a building performs energetically. IT-Label aims to make visible how a building is digitally prepared. During an audit, relevant parts of the digital infrastructure are assessed, after which this technical information is translated into an understandable delivery level, ranging from IT1+ PREMIUM to IT5 SHELL.

It is important to be clear about this: IT-Label is not an NIS2 certificate, and an IT-Label does not automatically mean that an organisation complies with the Cyber Security Act. What IT-Label can do is create insight into a part that is often difficult for users to see: the digital infrastructure of their physical work environment.

Who is responsible for what?

A practical question that keeps coming back: is the landlord responsible for IT, or the tenant? There is no universal answer to that question. Some facilities belong to the building, others to the rented space or to the tenant's own fit-out. Responsibilities can also differ contractually.

This is precisely why transparency matters. As a complement to IT-Label, an IT demarcation list can help. Such a list makes clear what is present, who manages it, who maintains it and who is responsible for any expansion or replacement. Not a legal document, but a practical overview that gives tenant and landlord the same picture.

This overview connects to questions that often arise around the division of responsibilities in rented real estate. Anyone who arranges this in advance no longer has to argue about it during an outage.

A practical example

Take a fictional company with 50 employees moving to a new office. The building looks modern and has fibre optic connectivity. Management therefore concludes that the digital infrastructure must be well arranged.

After the move, however, questions arise. Who manages the network equipment? Is there redundancy if the connection fails? Who has access to the patch room? How is the WiFi set up? What happens in the event of an outage? Which equipment belongs to the building and which security must the company arrange itself? Each of these questions is difficult, and sometimes costly, to answer afterwards.

Ideally, this information is made clear before signing the lease agreement. That turns IT from a technical problem dealt with afterwards into part of the housing decision made in advance. This is exactly where an objective, understandable overview of the IT infrastructure makes the difference.

AI makes this even more important

AI is accelerating this development. Companies are processing more data, using more cloud applications and becoming increasingly dependent on a stable, fast and secure digital environment. What is more than sufficient today may be tight within a few years.

As a result, the question shifts for a future move. From "how many m² do we need?" to "how many workstations do we need, and what must those workstations be able to digitally handle?" Space and digital capacity become inseparably linked.

Put the digital workplace on the agenda

The Cyber Security Act is not a scare story. It encourages organisations to think more consciously about digital continuity and resilience. IT-Label fits into this as a practical translation between IT, real estate and the user: not complicated technical reports that only specialists understand, but insight that allows the entrepreneur, tenant, landlord and advisor to have the same conversation.

Digital resilience does not only begin in the cloud. It also begins at the place where we log in every day: our workplace. So when making your next housing decision, consider not only how many m² you need, but also: what can my workplace digitally handle? A good first step is to find out what an IT-Label can make visible for your location, so you ask the question in advance rather than afterwards. IT-Label makes visible what often remains digitally invisible.