Wwke and ports — critical-entity obligations for port and maritime operators

Why ports sit inside the Wwke

The Wwke implements the EU CER-richtlijn, and transport is one of its designated sectors — with water transport as a subsector in the CER framework alongside air, rail and road. Roughly 500 Dutch organisations across all sectors are expected to fall under the law, with designation decided per organisation by the responsible ministry. The threat picture that shaped the law's timing touches ports directly: unidentified drones were observed over Dutch and Belgian ports and energy infrastructure through the past winter, while the national terrorism threat level stands at 4 of 5 (substantieel).

What makes a port a demanding Wwke environment

• Open terrain by design — quays, terminals and waterside approaches cannot be fenced like a campus. Access management has to distinguish thousands of legitimate daily movements from the few that matter.
• Mixed public-private operations — port authorities, terminal operators, shipping lines and service companies share one physical space; the risk assessment must map who owns which essential service and which dependencies cross company lines.
• Insider pressure — ports are a known target environment for subversive crime, and personnel reliability, screening posture and access discipline sit inside the statutory measure set.
• Aerial and waterside exposure — the drone observations over ports make counter-UAS assessment part of a defensible all-hazards picture, and the waterside is an approach vector fences never covered.
• The 24-hour reporting duty across a large estate — detection, alarm verification and a manned decision point are prerequisites for reporting an incident inside the statutory window.

The compliance window, in sequence

Designation starts the clock: nine months to a completed all-hazards risk assessment, ten months to proportionate measures. For a port estate the assessment is the heavy item — it has to cover deliberate physical threats, sabotage, insider action, natural hazards and cross-company dependencies for the full terrain. Operators who expect designation should start with the all-hazards risk assessment now: it gates the measures, and its quality decides whether the ten-month deadline is an ordered programme or a scramble.

What to do now

Map essential services to the assets, people and companies they depend on; assess threat-led rather than checklist-led; prioritise the measures that close the largest exposures first. Mission Support supports port and maritime operators with physical security assessment and protective design and counter-drone measures, delivered by operators with governmental and defence backgrounds. For the regime as a whole, read what the Wwke requires of designated organisations.

Last reviewed: 25 August 2026. Orientation summary, not legal advice — the statutory text and your competent authority's guidance govern.