The inspector calls and asks which incident reporting deadline appears in your ICT hosting contract. Can you show that within a minute? Or does the search through folders, email threads and an old spreadsheet begin? Since the Dutch Cybersecurity Act came into force, proving contract compliance is no longer an administrative luxury. It is exactly what regulators ask for.
Proving contract compliance means being able to show, at any moment, which requirements are in your contracts, who owns them and how the follow-up went. Not with a statement, but with recorded evidence. The Dutch Cybersecurity Act (Cbw, the Dutch implementation of NIS2) came into force on 15 August 2026. Roughly 8,000 to 10,000 organisations fall directly under it. Supervision is sector-specific: RDI, IGJ, DNB and ILT each look at their own domain. And they do not ask for a statement that you comply. They ask for evidence.
Why “we comply” is no longer enough
Ticking a box is something quite different from proving compliance on your contract side. In the past you could often get away with a policy document and good intentions. That no longer works. A regulator wants to see that the security and continuity requirements you set for suppliers are genuinely written into your contracts.
The difference is fundamental. A statement says: we do this. Provability shows: here is the agreement, this is the owner, this is the date, and this is how the follow-up went. Higher education is the only sector granted a three-year transition period. For healthcare, local authorities and most other organisations, the obligation applies immediately.
According to WorldCC, PwC and McKinsey, 95 per cent of organisations lack full insight into their own contractual obligations. That figure long sounded like an efficiency problem. Under the Cbw it is a compliance problem: what you cannot show does not count.
What does a regulator actually ask of you?
The question sounds simple: show that you have control over your supplier chain. In practice it splits into a few sub-questions you must be able to answer at any moment in order to prove contract compliance.
- Which outsourced contracts do you have, and which suppliers are in your chain?
- Which security and continuity requirements are in those contracts?
- Which agreements are currently open, and who owns them?
- How did the follow-up go: when were reminders sent, what changed, what was completed?
An IGJ inspector in healthcare looks at things differently from the ILT, but the underlying demand is the same: evidence, not a promise. A contract manager at a care institution with 80 supplier contracts cannot answer those questions from a shared drive. Not because the agreements are missing, but because they are recorded nowhere in a traceable way.
Where does provability break down in practice?
Without a central overview, provability almost always breaks down in the same three places. If you recognise one, the other two are probably at play too.
- Contracts in folders. Scattered across network drives, SharePoint and mailboxes. No one is certain the picture is complete.
- Agreements in people’s heads. The incident reporting deadline, the indexation agreement, the continuity clause. Once discussed, rarely recorded in a findable place.
- Follow-up in no one’s memory. An agreement was made, but whether it was met and who steered on it cannot be reconstructed.
The result: when the inspectorate calls, a search of days begins instead of an answer in minutes. That is precisely the difference between provable and not. For the contract-managing organisation that steers on suppliers rather than delivering services itself, that difference is decisive.
From agreement to evidence: what an audit trail does
An audit trail records who did what and when. Which agreement was open, who owned it, which change was made and on what date. That is not overhead, it is your evidence. Proving compliance starts here: with a history you can show at any moment.
Take the procurement manager at a local authority with dozens of providers in the social care domain. If a supplier fails to meet the continuity requirement, the question is whether you can show that you steered on it: when you flagged it, what you agreed, and how the supplier followed up. Without a recorded history it is one word against another. With an audit trail it is a fact.
Chain responsibility: control over the contract side of your duty of care
Here honesty is called for. GRIP is not a cybersecurity tool and makes no one “Cbw-compliant”. No contract system can. What GRIP does do: give you control over the contract side of your duty of care. The Cbw requires organisations to demonstrably manage cyber risks from the supplier chain. That means knowing which suppliers you have, which requirements are in the contracts and which agreements are open.
That boundary is not a weakness, it is the point. Registration in the entity register via the NCSC you arrange yourself. Your technical security you arrange with your IT department. But the question “can I show which requirements are in my contracts and how I steered on them” is answered on the contract side. That is where it starts, and that is where it breaks down without a central overview. This applies not only to ICT contracts, but also to outsourced services in healthcare such as catering, security and technical maintenance.
How does contract compliance align with ISO 9001 and 27001?
Many organisations in healthcare and education are already ISO 27001 or ISO 9001 certified. Yet the contract file often lives in a separate spreadsheet, detached from the quality system. At the audit that means double work: gathering everything manually and hoping you have not missed anything.
It works better to link contract compliance to your existing governance. One evidence system where agreements, owners, changes and follow-up come together aligns with what your certification already requires. GRIP is itself ISO 27001 and ISO 9001 certified and processes contract data exclusively on European platforms, under European law.
How to prove compliance with a central contract dashboard
The solution does not start with a stricter contract or an extra policy document. It starts with one place where contracts, agreements, owners and follow-up come together, with a history you can show at any moment. Registration stays in your ERP or FMIS. Managing and proving contract compliance you do in a central contract dashboard.
For the FM manager at a university of applied sciences that means: one source at the audit instead of a manual search. For the contract manager in healthcare: the incident reporting deadline from the hosting contract on screen in a minute. Book a demo of GRIP and walk through your own contract situation.
Frequently asked questions
What does proving contract compliance mean?
It means you can show, at any moment, which agreements are in your contracts, who owns them, and how the follow-up went. Not with a statement, but with recorded evidence: who did what, when, and which agreement was open.
What does a regulator under the Dutch Cybersecurity Act actually want to see?
An overview of your outsourced contracts, the security and continuity requirements they contain, which agreements are open, and the history of follow-up. Supervision is sector-specific, including RDI, IGJ, DNB and ILT.
Does GRIP make my organisation Cbw-compliant?
No. GRIP is not a cybersecurity or compliance tool and makes no one compliant. GRIP gives you control over the contract side of your duty of care: which suppliers you have, which requirements are in the contracts and which agreements are open.
What is an audit trail in contract management?
An audit trail records who made which change or carried out which action, and when. This lets you trace at any moment which agreement was open, who owned it and how the follow-up went. That is your evidence towards a regulator.
How does contract compliance align with my ISO certification?
By linking contract agreements, owners and follow-up to your existing quality system instead of keeping a separate spreadsheet alongside it. This gives you one evidence system that aligns with the governance ISO 9001 and ISO 27001 already require.
Is there a transition period for the Dutch Cybersecurity Act?
The act has been in force since 15 August 2026, with no general transition period. The only exception is higher education, which is granted three years. For healthcare, local authorities and most other organisations, the obligation applies immediately.
What goes wrong without a central contract dashboard?
Contracts are scattered across folders, agreements sit in people’s heads and the follow-up is not recorded. When the inspectorate calls, it becomes a search of days instead of an answer in minutes.