SIDN and .nl registrars work together on Cyber Security Act compliance

Productive SIDN-RA collaboration

The new Dutch legislation has been in the making for more than 3 years. Right from the start of the consultation process, SIDN and the Registrars' Association (RA) have been working together closely to arrive at a workable set of requirements for domain name registrations through dialogue with the government. That has involved intensive discussions with the Ministry of Economic Affairs and the Dutch Authority for Digital Infrastructure (RDI), the body that will monitor compliance with the new act. The shared objective was to ensure that the new rules were in line with internationally established practices (ICANN requirements) and workable for all parties in the chain.

Workable interpretation of Sections 49 and 50

SIDN and the RA are broadly supportive of the outcome. The interpretation of Sections 49 and 50 of the Cyber Security Act agreed with the ministry is closely aligned with the ICANN rules that many registrars are already familiar with. Details are given in the Cyber Security Act’s implementation matrix agreed with the RDI, RA and other registries in the Netherlands. As a result, established verification procedures can be largely replicated, and there won’t be a distinct Dutch regime for domain name validation. "The CSA introduces new requirements that registrars and registries must meet,” says SIDN’s Strategy and Identity Manager Maarten Simon. “However, what’s expected in practice is fortunately in keeping with established international norms. Consequently, we’re able to focus on a workable implementation, rather than the development of completely new processes."

Data verification under the CSA

Registrars are now required to obtain registrant data for every registration they make, and to check that the registrant is contactable by verifying an e-mail address or phone number. That applies to all domain names registered in the Netherlands, not just .nl domain names. A registrar also has to have a procedure for making registration data available to legitimate enquirers, such as investigative authorities.

Short interval before CSA became effective

Although the European and Dutch legislation was years in the making, the interval between publication of the CSA’s final wording in July and the act coming into force on 15 August was relatively short. To clarify the situation for registrars as soon as possible, SIDN and the RA organised 2 webinars, one in Dutch and one in English, immediately after the CSA came into effect. The webinars were watched by an audience of more than 100.

Practical implications for registrars

The webinars explored the legal and operational impacts of the CSA. RA Board member Bart Mortelmans looked at the practical consequences of the act’s key sections for registrars and their processes. He covered the verification of registrant data, what to do about existing registrations, transfer processes, acceptable evidence, and making registration data available to legitimate enquirers.

“What it comes down to is that registrars have to follow the ICANN procedure,” says Bart. “The one difference being that the domain name can’t be activated until verification is complete. And the procedure has to be followed for all domain names, including the ones with country-code extensions.”

More support planned

In the months ahead, SIDN and the RA will continue investing in information and support for registrars. The two organisations will be developing additional documentation, FAQ material, practical aids and illustrations to help registrars meet their new obligations.

En route to compliance

For .nl, the next milestone is 1 January 2027. On that date, we’ll be introducing new terms and conditions aligned with the Cyber Security Act. From then on, .nl registrars will be expected to comply with Sections 49 and 50 of the act. An implementation matrix has been drawn up by SIDN, the RA and the registrar community to provide a clear framework for a smooth transition to the new regime.