Cyber Security Act introduces new domain name registration requirements

1. Validation of registrant data

Section 49 of the CSA requires that the registration data for all domain names used in the Netherlands is verified. For new domain names registered in the Netherlands, verification has to be part of the registration process. That applies regardless of the internet extension involved – whether it’s .nl, .com, or anything else. In practical terms, what that means is that the website linked to any such domain name can’t go live until you’ve confirmed by phone or by e-mail that the registration data is correct. The law also requires that the registration data has to be checked annually and that, providing certain conditions are met, the registration data for a domain name has to be made available to a suitably authorised body within 72 hours of being requested.

2. Supply chain security: know your suppliers

The CSA emphasises the importance of the supply chain. Organisations covered by the new legislation must assess whether their suppliers satisfy appropriate security requirements, and the assessments have to be repeated periodically. Where a domain name is concerned, the supply chain includes both the registrar through whom the name is registered and the registry (i.e. SIDN if it’s a .nl domain name). Because individual audits aren’t practical for organisations with numerous domain names, most opt to publish the necessary data on an online dashboard. That’s what we do with https://trust.sidn.nl, for example. However, many organisations don’t actually know who their registrar is, because their domain names are registered through a hosting service provider or advertising agency, or by an employee who has since left. It’s therefore important to check that you have the relevant information. Where .nl domain names are concerned, you can find out who a name’s registrar is by looking up the name at https://sidn.nl/whois.

The supply chain security principle has another implication: even if the CSA doesn’t apply to your organisation, a business service client to whom it does apply may ask you to demonstrate that you meet the requirements.

3. Mandatory declaration of domain names for registered entities

One less well-known but important requirement arises out of the rules on the national registration of entities covered by the CSA. The organisations in question must ensure that their current contact and identification details are correctly declared in a national register. The practical implications of that requirement are set out in Article 27 of the Cyber Security Decree, where clause 3 states that the information declared must include the organisation’s domain names. Any organisation covered by the act must therefore have a complete overview of its domain name portfolio – something that SIDN BrandGuard can help with.

What are the implications for your organisation?

For a CISO or a security team, this is a good time to review the way your organisation manages its domain name portfolio:

• Check that all your registered domain names have the correct legal entity named as the registrant.

• Check that contacts, e-mail addresses and phone numbers are up to date.

• Ask your suppliers what they are doing to comply with the new verification requirements.

• Make DNS and domain name management explicit elements of your supplier risk management and compliance processes.

Remember: the security of your digital infrastructure begins with reliable registration data. And the Cyber Security Act places a legal responsibility on all parties in the domain name supply chain to ensure that registration data is correct.

Enforcement

To make sure the new rules are followed, the CSA makes the most senior managers of relevant organisations liable for compliance. It’s their responsibility to ensure that cyber risks are properly assessed and appropriate risk management measures put in place. So executives can no longer shift responsibility on to the security or IT department. They must also take cybersecurity training, so that digital illiteracy cannot be used as an excuse.

Want to know more?

Want to know more about the CSA? Visit the NCSC website. Need help surveying, monitoring and managing your domain name portfolio? Check out what SIDN BrandGuard has to offer.