It is 16:00 and a question arrives from the regulator: show which security agreements with your IT supplier are currently outstanding, and since when. You know the SLA is somewhere. Which folder, which version, and whether that agreement was ever tested, you can no longer say for certain. Proving compliance with contract agreements means exactly this: being able to show at any moment which agreement applies, what its status is and what evidence supports it.
The difference between holding data and demonstrably being in control is bigger than it seems. You have data: in three folders, two spreadsheets and a mailbox. You only have demonstrable control when a single source shows you within five minutes what is outstanding and who is working on it. Since the Cybersecurity Act came into force on 15 August 2026, that difference is no longer an internal matter but an external inspection.
Why “we have it covered” is no longer enough
The Cybersecurity Act (Cbw), the Dutch implementation of NIS2, came into force on 15 August 2026 with no general transition period (Staatsblad 2026, 189). Only higher education received three years. Around 8,000 to 10,000 organisations fall under it directly, with mandatory registration in the entity register via the NCSC.
For contract managers, one element is relevant: supply chain responsibility. You must demonstrably manage which cyber risks arise from your supplier chain. That means knowing which suppliers you have, which security and continuity requirements sit in the outsourced contracts, and which agreements are outstanding. The question shifts from “do I keep track internally?” to “what do I present when the regulator knocks tomorrow?”
What your regulator actually wants to see
Who the regulator is depends on your sector. Healthcare organisations deal with the IGJ, in the public sector the RDI and the ILT play a role, alongside DNB, AFM and NVWA for other sectors. What they have in common: they do not want a pile of documents, they want traceability.
A regulator rarely asks whether you have a contract. They ask whether you can show which agreement applies, what its status is, what evidence supports it and since when. A folder of PDFs does not answer that question. An overview that shows, per agreement, that the measurement was done, that there was a deviation and that an action is underway, does. Demonstrable is not the same as documented.
The problem with loose folders and Excel as evidence
Excel and shared folders work until the moment someone asks about them. Then the weakness shows: no version control, no ownership, no certainty that you are showing the latest truth. Take a municipality with dozens of supplier contracts containing security requirements. The reports sit partly in the mailbox, partly in the FMIS, partly in a shared folder. Who changed which requirement and when is impossible to reconstruct.
Fragmented data is not demonstrability. You can combine four or five sources and, after half a day, have a picture, but you cannot guarantee it is correct. Inspection is all about that guarantee. The lesson: you do not solve the problem with a stricter folder structure, but with a single source that records what happens by itself.
The minimum evidence set per contract agreement
For each contract agreement you need six elements to make something demonstrable:
- The agreement itself, with a reference to the contract and version
- The standard or KPI attached to it
- The measurement or assessment that was carried out
- The record of any deviation
- The action that follows, with an owner
- The current status, with a date
For an IT SLA with continuity requirements this means: the 99.9% availability requirement, the monthly report that assesses it, the record of an outage in March, the action towards the supplier and the status “resolved as of 12 April”. For an outsourced cleaning service the logic is the same, with a DKS measurement as the assessment. The structure is identical, regardless of the contract type.
One source with a complete audit trail
An audit trail is the mechanism that makes evidence traceable. It records who changed what and when, who held which authorisation and which agreement has been outstanding since when. That is the difference between “I think this is the latest version” and “this is the latest version, changed on this date by this person”.
In the Contract Dashboard from GRIP you see outstanding agreements and expired requirements straight away, with the history behind them. Registration stays in your existing ERP or FMIS. Managing it and making it demonstrable happens in GRIP. So when an audit question comes in, you do not search, you show. According to our own benchmark that saves up to 30% on contract administration, provided you set up the process in a compliant way.
What GRIP does and does not do
Let us be honest here: GRIP makes no one Cbw-compliant. GRIP is contract management software for supplier contracts of Dutch organisations in healthcare, education and the public sector, not a cybersecurity or compliance tool. What GRIP does do is give you a grip on the contract side of your duty of care: which suppliers you have, which requirements sit in the outsourced contracts and which agreements are outstanding. That is the layer most organisations lack, and at the same time the layer a regulator asks for first.
The fact that GRIP itself is ISO 27001 certified (certificate number NL-2596.1.1) and processes contract data exclusively within Europe helps with that accountability. But the core of the value lies in traceability: a single source where the evidence set per agreement is complete and up to date.
Frequently asked questions
What does “proving compliance with contract agreements” actually mean?
It means you can show at any moment which agreement applies, what its status is, what evidence supports it and since when. Having documentation is not enough. Traceability, with history and ownership, is what a regulator asks for.
Who is my regulator under the Cybersecurity Act?
That depends on the sector. For healthcare it is the IGJ, in the public sector the RDI and the ILT play a role, alongside DNB, AFM and NVWA for other sectors. The supervision has been active since 15 August 2026.
When did the Cybersecurity Act come into force?
On 15 August 2026, with no general transition period (Staatsblad 2026, 189). Only higher education institutions received three years. Around 8,000 to 10,000 organisations fall under it directly.
Why are folders and Excel not enough as evidence?
They offer no version control, no ownership and no certainty that you are showing the latest version. When an audit question comes in, you spend hours combining information from email, folders and spreadsheets, with no guarantee it is correct.
What belongs, as a minimum, in the evidence set per agreement?
Six elements: the agreement itself, the standard or KPI, the measurement, the deviation record, the action with an owner and the current status with a date. This structure works for IT SLAs and outsourced services alike.
Does GRIP make my organisation NIS2 or Cbw compliant?
No. GRIP is not a cybersecurity or compliance tool and makes no one compliant. GRIP gives you a grip on the contract side of the duty of care: which suppliers, which requirements in the contracts and which agreements are outstanding.
What is an audit trail in contract management?
An audit trail records who changed what and when, and which authorisation went with it. That way you know for certain which version applies and since when an agreement has been outstanding. That makes evidence traceable.
Want to move from searching to showing? See how the Contract Dashboard brings outstanding agreements and evidence together in one place, and book a demo of GRIP.