Dutch Cybersecurity Act: which requirements can your customer impose on you?
Since 15 August 2026 the Dutch Cybersecurity Act (Cyberbeveiligingswet) applies, the Dutch implementation of NIS2. Your customer being in scope does not automatically put you as a supplier in scope. Nor are you under Cbw supervision merely because you supply a Cbw organisation. But your customer must manage the risks in its supply chain and may therefore impose security requirements on you. Those requirements can differ per customer. Prepare evidence on your baseline security, access, backups and incidents.
A customer in scope of the Dutch Cybersecurity Act can ask you for controls, evidence and contract terms. What can you expect, and how do you prepare?
Are you in scope yourself?
Not automatically. Your customer being in scope of the Cybersecurity Act does not mean that you as a supplier are in scope. The obligations lie with the organisations in scope of the act. The Dutch NCSC writes that you are not under supervision merely because you supply a Cbw organisation (NCSC, The Cybersecurity Act and suppliers, in Dutch). You can be in scope on your own account because of your own activities, sector and size. Check your own situation separately.
Why your customer imposes requirements
The act requires organisations to take appropriate measures, including for the security of their supply chain. That is why they can impose measures on their direct suppliers and service providers. This does not apply to every supplier: according to the NCSC, not every supplier provides products or services that pose a risk to the supply chain, and the measures must be appropriate, proportionate and based on a risk-based approach. In short: you are not in scope because your customer is, but your customer can ask you for requirements, evidence and contract terms. This can concern one specific risk or your overall security. If you supply several customers in scope, you may receive different lists of requirements.
What you can expect
Based on the NCSC (Suppliers of Cbw organisations, in Dutch) you can expect questions about:
| Topic | Typical question |
|---|---|
| What matters to the customer | Which of our systems and data do you touch, and how much influence do you have on them? |
| Managing risks | How do you handle security updates, secure configuration and timely detection of threats? |
| Access | Do you use MFA or passkeys, and do you keep an overview of who has which rights? |
| Backups and recovery | Do you have a backup strategy and an incident response plan? |
| Agreements | What do we agree on audits, incident notifications and updates? |
| Incidents | Who do you inform when, and how do you limit the damage? |
Agreements often go into an SLA, a separate annex or the existing contract. Certificates such as ISO 27001 can help, but the act does not prescribe them.
How to prepare
- Get the basics in order. The NCSC refers to its five basic principles and its basic cyber resilience scan.
- Start the conversation. Ask which risks the customer sees at your end and which requirements follow.
- Prepare evidence. Access policy, patch policy, backup and restore test, incident procedure. See the evidence ladder.
- Put agreements in writing. And rehearse an incident together with the customer.
- Do not promise more than you can deliver. A notification deadline you cannot meet is worse than an honest answer.
More about the ten topics in the law and the questions that go with them: your customer’s NIS2 questionnaire.
How Holdvero helps
With Questionnaire Rescue we answer your customer’s supplier questions based on your own documentation, with a source for every answer and honest open items. Holdvero does not give legal advice on whether you are in scope yourself. More about Dutch customers on the Netherlands page.
Frequently asked questions
Since when does the Dutch Cybersecurity Act apply?
Since 15 August 2026. It is the Dutch implementation of the EU NIS2 directive.
Will I be fined if I do not meet my customer's requirements?
According to the NCSC, you are not under Cbw supervision merely because you supply a Cbw organisation. But your customer can include requirements in the contract. If you do not meet them, that affects your contract and your relationship with the customer.
Do I need ISO 27001?
The act does not prescribe a certificate. A certificate can help to show how your security is organised. Ask what your customer expects.
Will every customer ask the same questions?
Not always. Each customer decides which risks it sees at your end. Keep your approved answers and evidence in one place, so you can reuse them.
Received supplier questions under the Dutch Cybersecurity Act?
Within 1 working day you'll hear the price and when you get it back. You only pay after agreeing the price.
Get a fixed price