Resilience depends on more than your own organization

6 October 2026

On 15 August 2026, the Wet weerbaarheid kritieke entiteiten (Wwke; based on the Critical Entities Resilience Act or CER Act) entered into force in the Netherlands. The legislation aims to enhance the resilience of organisations that provide essential services, ensuring that these services remain available even during significant disruptions.

Very few essential services are delivered entirely by a single organisation nowadays. Suppliers, outsourced processes, energy supplies, operational sites, digital infrastructure, logistics chains and specialist personnel often play a crucial role in service delivery. A disruption affecting any one of these elements can have immediate consequences for the organization’s ability to continue operating.

This is precisely why the Wwke is more than a new legal requirement. It requires organisations to understand which factors are essential to their service delivery and which risks could threaten those factors. This means looking not only at within the organisation itself, but particularly at risks arising from dependencies beyond its boundaries.

Wwke at a glance

Who? Organizations designated by the Dutch government as critical entities.
What? The Wwke requires designated critical entities to conduct a risk assessment, implement appropriate resilience measures based on their duty of care, and report significant incidents in accordance with the reporting obligation.
Why? To strengthen the resilience of organizations that provide vital services to our society.
When? In force since 15 August 2026. The Dutch government has yet to formally designate the entities within its scope.

Wwke: the obligation is new, the risk is not

Boards and management generally have a good understanding of their own processes, activities and responsibilities. They are often also aware of the key vulnerabilities within their organisation. However, the most significant disruptions do not always originate within the organisation itself or within its sphere of influence.

To deliver an essential service, organisations depend on a wide range of external parties, resources and facilities. An outage at a telecommunications provider, a prolonged disruption to the energy supply,, an incident at a critical site or problems affecting a a key supplier can have direct consequences for service continuity, even when the cause lies outside the organisation.

The Wwke therefore requires organisations to look beyond their own boundaries.. Ultimately, the legislation is not about conducting a risk assessment as an end in itself, but about safeguarding the delivery of essential services under a wide range of circumstances. This means considering which events could disrupt service delivery, what could cause those events and which dependencies may play a role.

How dependent are you really?

Many organisations now have a good understanding of their critical suppliers, external service providers and outsourcing partners. However, the next question is often more difficult to answer. How dependent are you actually on these parties? What measures do they themselves take to prevent disruptions? Are viable alternatives available if a supplier becomes unavailable? And are there dependencies that could affect several parts of service delivery at the same time?

These questions extend beyond individual suppliers. Organisations often rely on the same energy supplies, telecommunications networks, cloud platforms, logistics partners or specialist service providers. As a result, a single disruption may impact multiple organisations or several parts of a chain at the same time.

It is precisely this concentration of dependencies that makes resilience particularly complex. An organisation may manage its own processes effectively, , yet still be vulnerable because crucial aspects of its service delivery depend on the same external parties, resources or facilities.

Resilience starts with understanding dependencies

The Wwke provides organisations with an opportunity to take a fresh look at the factors that truly determine the continuity of their service delivery. This means not only identifying risks, but above all understanding which resources, parties and facilities are essential and how vulnerable they are to disruption.

Organisations that undertake this exercise thoroughly often discover that their greatest vulnerabilities are not necessarily found in the processes that receive daily attention. More often, they are embedded in dependencies that have functioned reliably for years and therefore have rarely been challenged or reviewed.

Perhaps the most important question is not: "What risks exist within our organisation?" but:: "What does our organisation depend on to ensure that we can continue delivering our essential services tomorrow?"

What can you do today?

1. Identify what is essential
Determine which services are essential and which processes, resources, locations and parties are needed to ensure their continued delivery.

2. Assess vulnerabilities
Examine which threats could disrupt service delivery and where critical dependencies or concentration risks exist.

3. Strengthen your resilience
Determine which additional measures are needed, , assign clear responsibilities and ensure that incidents can be detected, escalated and reported in a timely manner.

Organisations that have not yet been formally designated under the Wwke can already begin taking these steps. After all, the risks and dependencies addressed by the legislation exist regardless of whether a formal legal obligation currently applies.