NIS2 Netherlands for suppliers (Cbw, 2026)
Adopted with its parent Framework for the countries in Countries: NIS2 for suppliers
NIS2 Netherlands for suppliers (Cbw, 2026) lists what the Cyberbeveiligingswet (Cbw, BWBR0052872, https://wetten.overheid.nl/BWBR0052872) and the Cyberbeveiligingsbesluit (BWBR0052875, https://wetten.overheid.nl/BWBR0052875) make a customer demand of its suppliers and service providers, written from the supplier's side: what you give, meet, or apply when your customer is bound by the Dutch law that carries Directive (EU) 2022/2555 (NIS2). It holds Cbw art. 21 and Cbb art. 10, which every supplier meets, and Cbb art. 11, which is optional and applies to a supplier that develops or maintains the customer's network and information systems. This is the Netherlands Sub-framework of NIS2 for suppliers: it is adopted with NIS2 for suppliers by Accounts that list the Netherlands in Countries. Adopt NIS2 Netherlands (Cbw, 2026) too for the measures your own service has to meet; this Framework does not repeat them. The body text in this catalog consists of plain-language summaries authored for ISMS, not the verbatim text of the law. Customers needing the authoritative text should reference wetten.overheid.nl at the links above. This product is not endorsed by the Dutch government, the European Union, or any government.
Requirement bodies below are plain-language summaries authored by Compliance. For the verbatim text of the standard, reference the publication from your national standards body (NEN, BSI, ANSI, ...).
Duty of care (1)
Give your customer what it needs to weigh your specific vulnerabilities, the overall quality of your products, and your cybersecurity practices, including your secure development (article 21(4)). Your customer owes this weighing as part of its own duty of care; you supply the facts it weighs.
Measures (2)
Meet the security requirements your customer sets for its direct suppliers and service providers, and let your customer check periodically that you do (article 10(2)).
Apply processes and procedures for secure development and maintenance, covering at least configuration management and change management, when you develop or maintain your customer's network and information systems (article 11(2) and (3)). Decide this in only if you develop or maintain such systems for your customer.