Your customer is in the Netherlands. What can you expect?
Dutch business customers may ask for evidence of your information security, for example through a security, privacy or NIS2 questionnaire. Since 15 August 2026 the Dutch Cybersecurity Act (NIS2) applies. Government customers work with BIO2, municipalities with GIBIT, healthcare organisations with NEN 7510 and insurers with their own supplier questionnaire. On this page you find the right guide for each situation.
This page brings together what is different in the Netherlands compared with the rest of Europe. The general guides apply here too; the guides below cover Dutch laws, standards and questionnaires.
What applies in the Netherlands
| Framework | For whom | Status on 13 October 2026 |
|---|---|---|
| Cybersecurity Act (NIS2) | Organisations in the sectors of the act, and through them their suppliers | In force since 15 August 2026 |
| BIO2 | Central government, municipalities, provinces and water authorities | Version 1.3, Government Gazette 5 March 2026 |
| GIBIT 2025 | Municipalities buying ICT | Published in March 2026 |
| NEN 7510 | Healthcare organisations and their IT suppliers | 2024 version |
| Insurers' questionnaire | Insurers selecting suppliers | Version 1.0 (July 2023) |
| DORA | Banks, insurers and other financial entities | Applies since 17 January 2025 |
Sources: NCSC on the Cybersecurity Act and suppliers, BIO2 version 1.3, VNG on GIBIT. Sources for NEN 7510, the insurers’ questionnaire and DORA are in the respective guides.
Guides for the Netherlands
- Dutch Cybersecurity Act (Cbw): What Dutch NIS2 customers ask their suppliers since 15 August 2026.
- Dutch insurers' supplier questionnaire: The 18 questions of the list Dutch insurers use.
- BIO2 questions from Dutch government customers: What Dutch ministries, municipalities, provinces and water boards ask under BIO2.
- GIBIT for suppliers to Dutch municipalities: The IT purchasing terms of Dutch municipalities: what you must provide.
- NEN 7510 questions from healthcare customers: NEN 7510, 7512 and 7513: what Dutch healthcare organisations ask.
Supervisors
| Topic | Supervisor |
|---|---|
| Privacy (GDPR) | Autoriteit Persoonsgegevens (Dutch Data Protection Authority) |
| Financial sector (DORA) | De Nederlandsche Bank or the AFM, depending on the entity |
| Cybersecurity Act | A supervisor per sector |
General guides that also apply in the Netherlands
- Completing a security questionnaire as a supplier
- Your customer's NIS2 questionnaire
- GDPR questionnaire for processors
- DORA questionnaire for ICT providers
- Security questionnaire without ISO 27001
- Answering your customer's AI due diligence
- The evidence ladder
- 9 mistakes in questionnaire answers
Also supplying Belgian customers? See Belgium.
How Holdvero helps
With Questionnaire Rescue we answer your customer’s questionnaire based on your own documentation, with a source for every answer. Unsure about a few questions? With the free Deal Review we look at up to 10. Holdvero does not provide certification, audits or legal advice.
Frequently asked questions
Am I in scope of the Dutch Cybersecurity Act as a supplier?
Not automatically. Your customer being in scope does not bring you into scope. You can be in scope on your own account because of your own activities, sector and size; check that separately. Your customer can impose requirements on you.
Which guide fits my questionnaire?
Look at who the customer is: government (BIO2), municipality (GIBIT), healthcare (NEN 7510), insurer (insurers' questionnaire), bank or insurer (DORA), or an organisation in scope of the Cybersecurity Act.
Does Holdvero only work in the Netherlands?
No. We work for suppliers across Europe, in Dutch and English.
Received a questionnaire from a Dutch customer?
Within 1 working day you'll hear the price and when you get it back. You only pay after agreeing the price.
Get a fixed price