{"id":198391,"date":"2026-06-17T14:53:44","date_gmt":"2026-06-17T12:53:44","guid":{"rendered":"https:\/\/www.erasmusmagazine.nl\/en\/?p=198391"},"modified":"2026-06-17T14:53:45","modified_gmt":"2026-06-17T12:53:45","slug":"cyberveiligheid-lichter-toezicht-voor-hoger-onderwijs","status":"publish","type":"post","link":"https:\/\/www.erasmusmagazine.nl\/en\/2026\/06\/17\/cyberveiligheid-lichter-toezicht-voor-hoger-onderwijs\/","title":{"rendered":"Cybersecurity: lighter supervision for higher education"},"content":{"rendered":"\n

Universities and universities of applied sciences are already doing well on cybersecurity, so the government only needs to carry out \u2018ex-post supervision\u2019. That is stated in the draft version of a new ministerial regulation.<\/p>\n\n\n\n

\"\"

\n\t\n\n<\/svg>\n<\/span>\n\tImage by:<\/span>\n\n\t\t\t\n\t\t\t\t\t\t\tSonja Schravesande<\/a>\t\t\t\t\t<\/span>\n\t<\/p>\n<\/figcaption><\/figure>\n\n\n\n

Personal data leaking, knowledge being stolen, ransom demands\u2026 Universities and universities of applied sciences also sometimes face hacking attacks. But they are defending themselves robustly, the government believes.<\/p>\n\n\n\n

The government wants more control over cybersecurity in the country. In April, the House of Representatives agreed by a large majority to the Cybersecurity Act, an implementation of a European law. The government also wants to bring higher education under this law. A draft regulation is now available online for public consultation<\/a>.<\/p>\n\n\n\n

The main question was: how strict will this law be for higher education? Beforehand, institutions were concerned: they feared the proposal would have the opposite effect<\/a>.<\/p>\n\n\n\n

Important or essential<\/h2>\n\n\n\n

The law distinguishes between \u2018important\u2019 and \u2018essential\u2019 entities. The main difference is how strict the supervision is. Publicly funded universities and universities of applied sciences are designated as \u2018important\u2019 entities. This means they will be subject to the \u2018lighter supervisory regime\u2019.<\/p>\n\n\n\n

Only ex-post supervision will take place, the explanatory notes state. That is considered sufficient because, in recent years \u2013 following administrative agreements with the Ministry of Education \u2013 education institutions have already worked significantly on strengthening their cyber resilience.<\/p>\n\n\n\n

It is reminiscent of a bill on screening master’s students and researchers in \u2018sensitive\u2019 fields, which Minister Rianne Letschert postponed again last week. The education institutions are already doing well, the minister said in praise<\/a>. Therefore, the announced broad screening would not be proportionate.<\/p>\n\n\n\n

‘Prudent’<\/h2>\n\n\n\n

Last week, universities spoke<\/a> of a ‘prudent reorientation’ by the minister. They were pleased with the emphasis on their own responsibility in matters of knowledge security. They also expressed appreciation for the additional funding the minister is allocating for knowledge security and cyber resilience (80 million for the next five years).<\/p>\n\n\n\n

The Education Inspectorate will be tasked with carrying out supervision. This is therefore an additional responsibility for the inspectorate, alongside, for example, financial supervision and supervision of social safety.<\/p>\n\n\n\n

The education institutions will have a reporting obligation for incidents. It is estimated that there will be around two per institution, meaning more than a hundred per year. The costs of this reporting obligation are assumed to be around one million euros nationally.<\/p>\n\n\n\n\t

\n\t\t\n\t\t
\n\n\t\t\t\t\t\t\t

Read more<\/h2>\n\t\t\t\n\t\t\t