On 15 August 2026 you woke up to a law that was already in force. The Cybersecurity Act (Cbw, the Dutch implementation of NIS2) took effect that day, with no general transition period. Only higher education institutions were given three years. Around 8,000 to 10,000 organisations are directly obliged to comply, and registration in the entity register via the NCSC has been mandatory from that date. If your manager now asks whether your suppliers are in order, that is no longer a theoretical question.
This piece builds on an earlier article about NIS2 and contract management. The focus shifts from “what you need to do” to “how you demonstrate you have done it”. That is where most organisations get stuck: NIS2 supply chain responsibility is not a matter of knowing, but of being able to prove what you know.
What does NIS2 supply chain responsibility mean in practice?
NIS2 supply chain responsibility means you not only keep your own security in order, but also demonstrably manage the cyber risks in your supplier chain. You need to know which suppliers there are, which security and continuity requirements are set out in the outsourced contracts, and which agreements remain open. It comes down to evidence: can you show it when a regulator asks?
Supervision in the Netherlands is arranged by sector. Depending on your organisation, you will deal with the RDI, DNB, AFM, IGJ, ILT or NVWA. The underlying question is the same for every regulator. Do you know which parties have access to your systems and processes, and have you secured that contractually?
Which suppliers do you really need to assess now?
Prioritise on access and impact, not on contract value. A cleaning company that unlocks every door at night can pose a greater risk than an expensive software supplier with no access to sensitive data. Supply chain responsibility covers both digital and physical access.
The suppliers to examine first:
- IT suppliers, SaaS providers and hosting: access to systems, networks and data
- Security and access control: physical access to buildings and installations
- Cleaning: often outside office hours, with keys or passes for the entire building
- Technical management and installation engineering: access to critical infrastructure such as climate, power and access systems
An FM manager with cleaning, security and technical services outsourced has the most work here. Physical access also falls under supply chain responsibility, and many organisations grasp this late. Start with a short list of critical suppliers and only expand from there. Reviewing all 200 contracts at once simply does not work.
Which requirements must demonstrably appear in the contract?
A contract that only covers price and service is not enough for NIS2 supply chain responsibility. Six elements should be set out concretely for each critical supplier:
- Security requirements: the level of information security the supplier demonstrably maintains, for example a certification such as ISO 27001
- Incident reporting: the deadline within which the supplier must report a cyber incident or data breach to you, and through which channel
- Audit rights: the right to assess the supplier’s security or have it assessed
- Continuity agreements: what happens in the event of an outage, and which recovery times apply
- Sub-processors: which subcontractors the supplier engages and whether they meet the same requirements
- Exit: how data and access are returned or destroyed at the end of the contract
The pitfall lies in time. Security clauses agreed in 2021 do not automatically carry over into the renewed or revised contract of 2026. During a tender or renewal, you must actively check whether these requirements are still present and up to date.
The real problem: you know it, but can you show it?
Take a contract manager at a healthcare organisation with 200 active contracts. The contracts are scattered across Excel, a document management system and the mailbox of a colleague who has since left. The question “which of these contracts actually have an incident reporting obligation?” cannot be answered in five minutes. It becomes manual work, every single time.
That is exactly the gap between knowing and demonstrably knowing. Most organisations think they know their suppliers. But the moment a regulator asks for a current overview of suppliers, contractual requirements and open actions, the search begins across four or five sources. By the time the picture is complete, the question is already out of date.
Get a grip on the contractual side of your duty of care
To be clear: GRIP makes no one NIS2-compliant. GRIP is not a cybersecurity tool and not a compliance system. NIS2 touches technology, processes, governance and more. GRIP addresses one specific part: the contractual side of the duty of care.
The GRIP Contract Dashboard shows in a single overview which suppliers there are, which requirements appear in the contracts and which agreements remain open. The AI assistant Kaia reads contract documents and recognises where clauses on incident reporting, audit rights or continuity are set out, even in contracts of dozens of pages. This makes the supply chain question answerable without manual digging. Users save an average of 30% on contract administration, provided it is approached in a structured way.
Treat supply chain responsibility not as a one-off project but as a fixed cycle. Suppliers change, contracts are renewed, sub-processors shift. Set the reassessment of critical contracts as a recurring action in your dashboard, so the requirements stay current and open points do not evaporate before the next supervisory question.
Frequently asked questions
What is NIS2 supply chain responsibility?
NIS2 supply chain responsibility means your organisation demonstrably manages the cyber risks in its supplier chain. You need to know which suppliers have access to systems, data or buildings, which security and continuity requirements appear in the contracts, and which agreements remain open.
When did the Cybersecurity Act take effect in the Netherlands?
The Cybersecurity Act took effect on 15 August 2026, published in Staatsblad 2026, 189. There is no general transition period. The only exception is higher education, which is given three years.
Does cleaning fall under NIS2?
Cleaning can fall under supply chain responsibility when the supplier has physical access to buildings and installations, for example with keys or passes outside office hours. Physical access counts too, not only digital access.
Which requirements should I include in supplier contracts?
For critical suppliers, include at least: security requirements, a deadline for incident reporting, audit rights, continuity agreements, arrangements on sub-processors and an exit provision for data and access. Check at renewal whether these requirements are still up to date.
How many organisations are directly obliged under the Cybersecurity Act?
Around 8,000 to 10,000 organisations are directly obliged. From 15 August 2026 they must register in the entity register via the NCSC. Supervision depends on the sector and lies with, among others, the RDI, DNB, AFM, IGJ, ILT and NVWA.
Does GRIP make my organisation NIS2-compliant?
No. GRIP is not a cybersecurity or compliance tool and makes no one NIS2-compliant. GRIP gives you a grip on the contractual side of the duty of care: one overview of suppliers, contractual requirements and open actions, so you have that side demonstrably in order.
How do I keep the contractual requirements up to date?
Set the reassessment of critical contracts as a recurring action in your contract dashboard. Suppliers, sub-processors and contracts change, so treat supply chain responsibility as an ongoing cycle rather than a one-off project.
Want to see in a single overview which suppliers there are, which requirements appear in your contracts and which agreements remain open? Explore the Contract Dashboard or book a demo.