NIS2 supplier contracts are contracts with your suppliers in which you set out the security and continuity requirements demanded by the Dutch Cybersecurity Act (the Dutch implementation of NIS2). GRIP is contract management software for the supplier contracts of Dutch organisations in healthcare, education and the public sector. The act came into force on 15 August 2026, without a general transition period. The difficulty lies not in what your supplier must do, but in what you can demonstrably show you have set out in your contracts. If you manage 300 contracts in folders and Excel, you probably do not even know which of them contain a security clause.
The Cybersecurity Act puts the supply chain on your plate, not your supplier’s
The Dutch Cybersecurity Act was published in Staatsblad 2026, 189 and applies directly to roughly 8,000 to 10,000 organisations. Registration in the entities register via the NCSC is mandatory from 15 August 2026. Only higher education institutions are given three years. Beyond that, there is no transition period.
A common misconception: the act does not require your suppliers to fall under the law themselves or to hold a quality mark. There is no certificate that proves a supplier is compliant with the act. The duty of care rests with you as the contracting organisation. You must demonstrably manage the cyber risks in your supply chain. That means knowing which suppliers you have, which security and continuity requirements appear in the contracts, and which arrangements are still outstanding.
Which requirements belong in a supplier contract? Six concrete blocks
IT sourcing analyses name at least six contract topics you need to set out. Treat them as a checklist, not as abstract legal text.
- Security measures. Concrete requirements on how the supplier protects your data and systems. Think of access management, encryption and patching policy, not a vague reference to appropriate measures.
- Incident reporting and reporting deadlines. Within how many hours must a supplier report an incident that affects your service delivery? Set a firm deadline, plus who to notify and how.
- Audit rights and evidence requests. The right to check compliance and request evidence: reports, test results, statements.
- Subcontractors. What may your supplier outsource, to whom, and do the same requirements then carry through the entire chain? A chain is only as strong as its weakest subcontractor.
- Continuity and exit. What happens in the event of an outage, insolvency or contract end? Arrangements on data transfer, backups and an orderly exit.
- Liability. Who bears which damages in the event of an incident, and up to what amount?
The order in which you start is not arbitrary. Incident reporting and security measures are the first things relevant to a regulator. Those are the blocks you get in order first for your most critical suppliers.
Does every supplier get the same requirements?
No. Imposing the same heavy set on everyone drives up cost and hassle for suppliers who carry barely any digital risk. Differentiate by risk. The question is not whether this is an IT supplier, but what access this party has to your data or systems.
- ICT and software: a hosting provider or SaaS supplier with access to your core systems gets the full package, including tight reporting deadlines and audit rights.
- Facility management and real estate: do not assume too quickly that this is IT. An access control system, building management system (BMS) or installation partner has digital components connected to your network. These belong in the critical category.
- Social domain: a Wmo or youth care provider processes client data. That is sensitive data, even without being a software supplier.
- Low risk: a supplier with no access to data or systems gets a light set. There is no reason to put a landscaping contractor through the same wringer as your cloud service.
So start by classifying before you write clauses. A risk ranking of your supplier base determines where you invest time first.
A clause in a PDF is not yet proof of compliance
This is the core of the problem. Including a clause is a different matter from demonstrating compliance with it. Supervision is sector-dependent: RDI, DNB, AFM, IGJ, ILT and NVWA each police their own domain. If such a regulator asks for evidence that you manage your supply chain, a reference to clauses in the contracts is not enough. You have to be able to show which requirements, in which contract, with which supplier, and which evidence is still outstanding.
That cannot be done with a folder full of PDFs. Take a healthcare organisation with 15 locations and more than 200 supplier contracts. The audit results sit in Excel, the incident arrangements in a contract annex, the outstanding evidence requests in someone’s inbox. You then have to combine four sources before you can answer a single question. Demonstrating compliance starts with a KPI you measure periodically, not with a stricter contract that nobody can find again.
Your existing contracts: reopen or add an addendum?
Because there is no transition period, this also applies to contracts that run for years to come. Reopening a complete contract is rarely necessary and often not feasible. The practical route is an addendum for your critical suppliers, in which you add or sharpen the six blocks.
Prioritise by risk, not by end date. Start with the suppliers that have access to your core systems or sensitive data. Factor new tenders in properly from the outset. Build the requirements into the specifications and vary the weight per lot. That way you avoid having to write addenda all over again a year from now.
From clause to overview: keeping a grip on hundreds of contracts
On the contract dashboard you can see, per contract, which requirements it contains, which supplier falls into which risk category, which evidence has been supplied and which actions are outstanding. The arrangements do not live in your head or in Excel, but in one place where you can show them. For healthcare organisations, this also feeds into the specific sector requirements around client data.
Be honest about the boundary. GRIP is not a security tool and makes no one compliant with the act. GRIP solves the contract side of the duty of care: knowing which suppliers you have, which requirements are demonstrably set out in the contracts and which arrangements are still running. The cybersecurity itself remains the work of your IT team and your suppliers. GRIP is ISO 27001 certified and processes contract data exclusively within Europe. That makes it usable as a demonstrable foundation beneath your supply chain accountability.
Frequently asked questions
What does the Dutch Cybersecurity Act mean for contracts with suppliers? The act obliges you to demonstrably manage the cyber risks in your supply chain. That translates into concrete security and continuity requirements in your supplier contracts, plus evidence that those requirements are being met.
Which requirements must I include in supplier contracts under the Cybersecurity Act? Six blocks: security measures, incident reporting with reporting deadlines, audit rights and evidence requests, arrangements on subcontractors, continuity and exit, and liability.
Does the act also apply to my cleaning or maintenance supplier? Possibly. It is not the sector that is decisive, but the digital access. Access control, building management systems and installation partners have digital components connected to your network and then belong in your risk assessment.
Do I have to reopen all my existing contracts? Usually not. For critical suppliers you work with an addendum in which you add the required blocks. Prioritise by risk, not by end date, because there is no transition period.
Can a supplier prove it is compliant with the act? There is no quality mark or certificate with which a supplier can prove this. The duty of care rests with you as the contracting organisation. You secure it through contractual requirements and by requesting evidence.
Who supervises compliance? That is sector-dependent. RDI, DNB, AFM, IGJ, ILT and NVWA each police their own domain. They can ask for evidence that you manage your supply chain.
Does GRIP make my organisation compliant with the act? No. GRIP is not a security tool. GRIP gives you a grip on the contract side: which requirements are in which contract, which evidence is outstanding and which actions are running. The cybersecurity itself stays with your IT team and your suppliers.
Want to see how to show, per contract, which requirements it contains and which evidence is outstanding? Take a look at the GRIP contract dashboard or book a demo.