{"id":20248,"date":"2026-10-08T09:00:00","date_gmt":"2026-10-08T07:00:00","guid":{"rendered":"https:\/\/grip-contracts.com\/?post_type=inzicht&#038;p=20248"},"modified":"2026-10-08T09:20:49","modified_gmt":"2026-10-08T07:20:49","slug":"nis2-duty-of-care-register-suppliers","status":"publish","type":"inzicht","link":"https:\/\/grip-contracts.com\/en\/insights\/nis2-duty-of-care-register-suppliers\/","title":{"rendered":"NIS2 duty of care: registering your suppliers, what and where"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Your CISO sends an email: give me a list of every supplier with access to our systems by tomorrow, and what we have agreed with them contractually about security. That is when you realise the answer is scattered across folders, mailboxes and three Excel files. Under the <strong>NIS2 duty of care, registering your suppliers<\/strong> means building a supplier register: a single place where you record, per supplier, which security arrangements exist and what access that party has. It is not a notification to an authority, but the administrative foundation under your supply chain responsibility. That is something entirely different from the statutory registration the law requires of your own organisation.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Registering means three things, and you only do one of them at the NCSC<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The word registering is constantly mixed up in NIS2 content. There are three separate actions, and confusion about this costs you weeks.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Registering your own entity.<\/strong> If you fall under the Cybersecurity Act, you register your organisation in the entity register via MijnNCSC. This covers your organisation name, address, contact details, sector and the member states where you provide services. You do this yourself, outside GRIP.<\/li>\n<li><strong>Recording your suppliers in your own contract register.<\/strong> This is not a statutory notification. It is the administrative foundation you need to demonstrate your duty of care.<\/li>\n<li><strong>Assessing your suppliers in your supply chain risk management.<\/strong> Which supplier has access to which systems, which requirements apply, when you review them.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Point 1 is a form. Points 2 and 3 are the real work, and that is where your CISO&#8217;s question sits. Anyone who lumps these three together goes looking for a compliance tool while the problem is administrative first.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What the Cybersecurity Act really asks of you about your suppliers<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Cybersecurity Act (Cbw), the Dutch implementation of NIS2, entered into force on 15 August 2026 with no general transition period. Only higher education institutions are given three years. Around 8,000 to 10,000 organisations fall under it directly and must register via the NCSC from that date (Staatsblad 2026, 189). You report any changes to your registration details within a short timeframe.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Important: your suppliers do not automatically fall under the law themselves. But as a NIS2-obligated organisation, you must demonstrably manage the cyber risks from your supplier chain. This is called supply chain responsibility. So you need to know which suppliers you have, which security and continuity requirements are set out in the outsourced contracts, and which arrangements remain open. That is exactly where the practical work begins for the contract manager and buyer.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Which suppliers you map first<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Do not start with a complete inventory of all contracts. Start with the suppliers that have access to your systems, your data or management rights. That is the shortest route to your CISO&#8217;s question.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Most NIS2 content is about cloud and software. Rightly so, but incomplete. A facility management or property supplier can carry just as much supply chain risk. Consider the installer with remote access to the building management system (BMS), the fault service that logs in remotely, or the supplier of access control and security. Take an organisation with 40 sites: the party that monitors the climate installations remotely often has deeper system access than many a SaaS supplier.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Suppliers with remote access to systems (hosting, SaaS, BMS maintenance, fault services)<\/li>\n<li>Suppliers that process personal data or sensitive data<\/li>\n<li>Suppliers with management rights or the management of critical installations<\/li>\n<li>Suppliers of critical services whose failure affects your continuity<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The sequence is the advice: access first, then data, then continuity. Anyone who tries to record everything at once gets nowhere.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What you record per supplier in your contract register<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For each supplier you want a fixed set of fields, so that an export is enough when the question comes. Not in someone&#8217;s head, not in a stray email thread.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Contact details and type of service<\/li>\n<li>Level of access to systems and data<\/li>\n<li>Security requirements set out in the contract<\/li>\n<li>Notification deadline for incidents<\/li>\n<li>Continuity and exit arrangements<\/li>\n<li>Sub-suppliers or sub-processors<\/li>\n<li>Date of last assessment and review date<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">These fields are the core of your supplier register for the NIS2 duty of care. They translate a legal obligation into something you can actually maintain and show.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The contract clauses you want to see in outsourced contracts<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For new tenders, you include the requirements up front. For existing framework agreements the approach is different: you cannot renegotiate hundreds of contracts at once. Prioritise the suppliers with system access and update those first via an addendum.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Concrete security requirements (for example alignment with a recognised standard)<\/li>\n<li>Audit rights, so you can verify arrangements<\/li>\n<li>A notification deadline for incidents<\/li>\n<li>Transparency about sub-processors and the requirements that apply there<\/li>\n<li>Continuity arrangements and an exit scheme<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">An IT hosting contract calls for a tight notification deadline and an SLA on availability. A BMS maintenance contract calls for arrangements on remote access and logging. The same clause logic, a different application per contract type. GRIP is contract management software for supplier contracts of Dutch organisations in healthcare, education and the public sector, and keeps those arrangements and open actions in one place.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">From a one-off inventory to a management cycle<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A supplier register that you fill once and then let lapse is worthless at the first audit. Supply chain responsibility is a cycle: you record, you assess, you review periodically and you monitor the arrangements that remain open. A review date per supplier makes that demonstrable. If that register is already in order, the duty of care question is an export rather than a project week. Users save an average of 30% of time on contract administration once arrangements and actions sit in one place.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The <a href=\"https:\/\/grip-contracts.com\/nis2-contractmanagement-leveranciers\/\">article on NIS2 and contract management of suppliers<\/a> goes deeper into supply chain responsibility itself. See also the <a href=\"https:\/\/grip-contracts.com\/en\/platform\/contract-partner-dashboard\/\">Contract Dashboard<\/a> for the overview of contracts, requirements and open actions.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What GRIP does and does not do for you<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">GRIP is not a cybersecurity or compliance tool and makes no one NIS2-compliant. What GRIP does do: give you grip on the contract side of the duty of care. Which suppliers you have, which security and continuity requirements are set out in their contracts, and which arrangements remain open. GRIP is ISO 27001 certified and processes contract data exclusively within Europe. That way you give the answer to the CISO&#8217;s question in an export, not in a project week.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently asked questions<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Do I have to register my suppliers somewhere officially for NIS2?<\/strong> No. The statutory registration applies to your own organisation in the entity register via the NCSC. You record your suppliers in your own contract or supplier register, as the administrative foundation to demonstrate your duty of care.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Do my suppliers automatically fall under the Cybersecurity Act themselves?<\/strong> Not automatically. But as a NIS2-obligated organisation, you must demonstrably manage the cyber risks from your supplier chain. You therefore record which requirements are set out in the contracts and which arrangements remain open.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>When did the Cybersecurity Act enter into force?<\/strong> On 15 August 2026, with no general transition period. Only higher education institutions are given three years. Registration of your own entity is mandatory from that date (Staatsblad 2026, 189).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Which suppliers do I map first?<\/strong> The suppliers with access to your systems, your data or with management rights. Think not only of cloud and software, but also of installers with remote access to the building management system, fault services and security suppliers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Which arrangements do I want to see in outsourced contracts?<\/strong> Concrete security requirements, audit rights, a notification deadline for incidents, transparency about sub-processors, and continuity and exit arrangements. For new tenders you include these up front; for existing contracts you prioritise the suppliers with system access.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Does GRIP make me NIS2-compliant?<\/strong> No. GRIP is not a compliance tool. GRIP gives you grip on the contract side of the duty of care: the supplier register, the requirements in the contracts and the open arrangements.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>How do I keep the register up to date?<\/strong> By recording a review date per supplier and monitoring the open arrangements. Supply chain responsibility is a cycle of recording, assessing and reviewing periodically, not a one-off action.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Want to deliver the answer to the CISO&#8217;s question as an export? See how GRIP solves this through <a href=\"https:\/\/grip-contracts.com\/nis2-contractmanagement-leveranciers\/\">contract management of suppliers<\/a> and book a demo.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Your CISO sends an email: give me a list of every supplier with access to our systems by tomorrow, and what we have agreed with them contractually about security. That is when you realise the answer is scattered across folders, mailboxes and three Excel files. Under the NIS2 duty of care, registering your suppliers means [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"template":"","meta":{"_acf_changed":false,"inline_featured_image":false,"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"platform_module":[],"branche":[],"class_list":["post-20248","inzicht","type-inzicht","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/grip-contracts.com\/en\/wp-json\/wp\/v2\/inzicht\/20248","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/grip-contracts.com\/en\/wp-json\/wp\/v2\/inzicht"}],"about":[{"href":"https:\/\/grip-contracts.com\/en\/wp-json\/wp\/v2\/types\/inzicht"}],"author":[{"embeddable":true,"href":"https:\/\/grip-contracts.com\/en\/wp-json\/wp\/v2\/users\/1"}],"version-history":[{"count":1,"href":"https:\/\/grip-contracts.com\/en\/wp-json\/wp\/v2\/inzicht\/20248\/revisions"}],"predecessor-version":[{"id":20249,"href":"https:\/\/grip-contracts.com\/en\/wp-json\/wp\/v2\/inzicht\/20248\/revisions\/20249"}],"wp:attachment":[{"href":"https:\/\/grip-contracts.com\/en\/wp-json\/wp\/v2\/media?parent=20248"}],"wp:term":[{"taxonomy":"platform_module","embeddable":true,"href":"https:\/\/grip-contracts.com\/en\/wp-json\/wp\/v2\/platform_module?post=20248"},{"taxonomy":"branche","embeddable":true,"href":"https:\/\/grip-contracts.com\/en\/wp-json\/wp\/v2\/branche?post=20248"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}