The Cybersecurity Act and contract management meet the moment this question lands on your desk: which of our suppliers are critical, and what do those contracts say about security and continuity? The Dutch Cybersecurity Act (Cbw) has been in force since 15 August 2026, and the answer sits scattered across dozens or hundreds of separate PDFs, shared folders and the memory of a colleague who left last year. This is the contract side of the duty of care, and without a central overview there is no structured way to answer it.
This piece builds on our earlier article on NIS2 and contract management with the current status of the Dutch implementation and a sharper focus on what you need to do with your existing contract portfolio right now.
The Cybersecurity Act is here: what changes for your supplier contracts?
The Cybersecurity Act is the Dutch implementation of the European NIS2 Directive. Search for one term and you probably mean the other. The Act came into force on 15 August 2026 (Staatsblad 2026, 189), with no general transition period. Around 8,000 to 10,000 organisations fall under it directly. The only exception: higher education institutions get three years.
For contract managers and buyers in healthcare, local government and education, this is not an announcement but a fact. Registration in the entity register via the NCSC is mandatory. The obligation to report incidents starts within 24 hours. Supervision is sector-dependent and sits with bodies including the RDI, DNB, AFM, IGJ, ILT and NVWA. There is no run-up period in which you can calmly get your supplier contracts in order.
What does the Cybersecurity Act duty of care mean for your supply chain?
The heart of the Cybersecurity Act for contract management lies in supply chain accountability. You must demonstrably manage the cyber risks from your supplier chain. Demonstrably is the key word. It is not enough to trust that a supplier has its affairs in order. You need to know which suppliers you have, which security and continuity requirements are in the outsourced contracts, and which agreements are still outstanding.
That shifts the question from legal to operational. A lawyer can write down which clauses a new contract should contain. But the duty of care affects your entire current portfolio, not just what you sign from tomorrow onwards. A healthcare organisation with 200 outsourced contracts cannot wait for every renewal to come around on its own. You need to know which contracts are critical and which ones to open up first.
Which agreements belong in a supplier contract under the Cbw?
Legal sources such as CMS identify six topics that should be included in supplier contracts to support the duty of care. Translated into day-to-day contract practice, these are the six.
- Security standards and certifications: which standard does the supplier apply, for example ISO 27001, and how do you evidence it?
- Incident reporting: within what timeframe does the supplier report an incident to you, so that you can meet your own 24-hour reporting obligation?
- Audit rights: may you check the supplier or have an audit carried out?
- Continuity and exit: what happens in the event of an outage, and how do you leave the contract without damage?
- Liability: who bears the consequences of a security incident?
- Security updates: how and how quickly does the supplier keep its systems up to date?
Knowing which clause belongs in a contract is the easy part. The hard part is checking which of these six topics are already covered in your existing contracts, and which are missing. Without that overview, no plan holds up.
Not every supplier is equal: classifying by criticality
Treat every contract with the same weight and you will waste months on suppliers that do not warrant the effort. So do not start with the strictest contract, but with classification. Sort your suppliers by four factors: how critical the service is, what access the supplier has to your systems, what data it comes into contact with, and how easily it can be replaced.
A hosting provider that runs your primary process calls for a different contract than a supplier that delivers a software update once a quarter. The order is clear: first the critical suppliers with extensive access and difficult replaceability, then the rest. Within that group, tackle the contracts that expire first, because a renewal is the natural moment to add the six topics after all. A local authority with 150 suppliers is left with a workable list of fifteen to twenty contracts that genuinely take priority.
The Cybersecurity Act affects more than your IT suppliers
A lot of content frames the Cybersecurity Act as an IT procurement issue. That misses part of the supply chain. The duty of care also covers suppliers you would not immediately see as a cyber risk. Think of building management systems, access control with digital keys, sensors, camera surveillance and maintenance contractors with access to your network.
A building management system that sits on your network is just as much an entry point as a SaaS subscription. Yet facility management often stays out of sight, because those contracts sit with a different department than the IT contracts. That is exactly why the inventory has to be broader than the IT manager’s licence list. Every supplier with access to systems or data counts. For a client organisation that manages facility and IT contracts separately, this is the first gap to close.
The real problem: an overview of what is already in your contracts
Back to the desk. Knowing the clauses is not the sticking point. The sticking point is that the agreements sit fragmented. Reporting timeframes are in one PDF, audit rights in an annex, continuity arrangements nowhere. A procurement manager who wants to know which contracts should be amended first is missing the simplest fact: which ones expire when.
As long as that information sits in separate documents and Excel files, every accountability question costs days of manual searching. And every missed renewal is a missed chance to still lock in the right clauses. The contract side of the duty of care stands or falls with an overview of what is already in your contracts. According to WorldCC, PwC and McKinsey, 95% of organisations lack full visibility of their own contractual obligations. Under the Cbw, that figure suddenly becomes a concrete risk.
Getting a grip on the contract side of the duty of care
An honest boundary belongs here. GRIP is not a cybersecurity or compliance tool and makes no one Cbw-compliant. GRIP does not solve your duty of care. What GRIP does give you a grip on is the contract side: which suppliers you have, which security and continuity requirements are in the outsourced contracts, and which agreements are outstanding.
In the Contract Dashboard you see in a single view which suppliers are critical, which contracts expire when, and which actions are outstanding. GRIP is ISO 27001 and ISO 9001 certified and processes contract data within Europe. That turns accountability to a CISO or lawyer into a matter of opening a screen, not days of digging. For healthcare organisations and local authorities that must be able to demonstrate tomorrow that the supply chain is mapped, that is the difference between staying in control and falling behind.
Frequently asked questions
What is the Cybersecurity Act?
The Dutch Cybersecurity Act (Cbw) is the Dutch implementation of the European NIS2 Directive. The Act came into force on 15 August 2026 (Staatsblad 2026, 189) and requires around 8,000 to 10,000 organisations to demonstrably manage their cyber risks, including the risks from their supplier chain.
Is there a transition period for the Cybersecurity Act?
No, there is no general transition period. The Act applies from 15 August 2026. The only exception is higher education, which gets three years.
What must a supplier contract contain under the Cbw?
Legal sources identify six topics: security standards and certifications, incident reporting, audit rights, continuity and exit, liability and security updates. These agreements support the duty of care across your supply chain.
Does the Cybersecurity Act also affect non-IT suppliers?
Yes. Building management systems, access control, sensors and maintenance contractors with access to your network or data also fall under the duty of care. The inventory must be broader than the IT contracts alone.
Which contracts should I tackle first?
Classify your suppliers by criticality, access, data and replaceability. Start with the critical suppliers that have extensive access and are hard to replace, and within that group tackle the contracts that expire first.
Does GRIP make my organisation Cbw-compliant?
No. GRIP is not a cybersecurity or compliance tool and makes no one Cbw-compliant. GRIP gives you a grip on the contract side of the duty of care: an overview of your suppliers, the agreements in your contracts and the outstanding actions.
How do I keep an overview of hundreds of existing contracts?
As long as agreements sit in separate PDFs and Excel files, every accountability question costs days of searching. A central contract dashboard shows which suppliers are critical, which contracts expire and which agreements are outstanding.
Want to see how to bring your supplier contracts and their outstanding agreements together in one place? See how GRIP gives you a grip on the contract side of the duty of care and book a demo.