A Cybersecurity Checklist for Dutch SMEs

Most Dutch SMEs don't need a large security programme. They need the dozen or so controls that address the majority of real-world risk, tackled in a sensible order. This is that list.

Identity, first

• Enforce MFA on every account with access to email, finance systems, or customer data, not just admins.
• Remove standing admin rights; require elevation to be requested and time-bound.
• Run an access review at least twice a year, and specifically check for former employees who still have active accounts.

Email and endpoints

• Block legacy authentication protocols in Microsoft 365 or Google Workspace.
• Deploy EDR, not just traditional antivirus, on every company device.
• Disable automatic external mail forwarding by default, a common sign of a compromised mailbox.

Data and backups

• Confirm backups are isolated from production credentials: test a restore, don't just check the backup job ran.
• Know where your sensitive data actually lives; most SMEs can't answer this precisely without checking.

Governance basics

• Check whether NIS2 applies to your organisation: the expanded scope catches more mid-sized Dutch companies than expected.
• Write down who has authority to make decisions during a security incident, before you need to know.
• If customers ask about your security posture in procurement, have a real answer ready rather than improvising one.

Where to start if you can only do three things

In order of impact for most Dutch SMEs: enforce MFA everywhere, confirm your backups are actually isolated and restorable, and find out whether NIS2 applies to you. Each addresses a genuinely common cause of real incidents, not a theoretical one.

For a deeper look at any of these, see our NIS2 readiness guide or our ransomware readiness guide.