Dutch House of Representatives Approves Cybersecurity Act (NIS2): What Does This Mean for Your Supply Chain?

The decision has been made: the Dutch House of Representatives has approved the Cybersecurity Act. This law is the Dutch implementation of the European NIS2 directive and obliges thousands of organizations to structurally improve their digital resilience. This decision marks a significant turning point, as cybersecurity has definitively shifted from an optional IT topic to a strict management responsibility and legal requirement.

But what does this law truly mean for your organization, and particularly for how you interact with suppliers?

Management Responsibility and a Strict Duty of Care

The new Cybersecurity Act leaves little room for interpretation. Directors and management are explicitly responsible for taking appropriate security measures and managing digital risks. Additionally, the law introduces a strict reporting obligation: in the event of a serious cyber incident, an initial warning must be issued to the competent authority within 24 hours.

Supply Chain Security is No Longer Optional

One of the most impactful components of this legislation is its explicit focus on supply chain security. The National Inspectorate for Digital Infrastructure (RDI), which has been designated as the supervisory authority, is crystal clear on this: organizations remain responsible for the risks that enter the organization via their suppliers and service providers.

You must have insight into who your suppliers are, what risks they entail, and you must be able to demonstrate that you actively manage these risks. Without this insight, you simply do not comply with the legal duty of care.

Paper Policies and Questionnaires Fall Short

Supervision under the Cybersecurity Act will not be satisfied with an annually completed questionnaire. The RDI emphasizes that policy alone is not sufficient and that organizations must continuously monitor their suppliers. Because threats, vulnerabilities, and digital dependencies change daily, continuous monitoring is necessary to make timely adjustments and provide accountability. Supplier management must shift from blind trust to verifiable actuality.

Get a Grip on NIS2 with RiskStudio

The requirements from the coalition agreement and the Cybersecurity Act demand scalable, practical tools. RiskStudio helps organizations by replacing traditional, static questionnaires with a continuous, automated information flow.

With our ‘outside-in’ approach, we monitor the digital footprint, vulnerabilities, and current incidents of your entire supplier ecosystem 24/7, without you being dependent on their willingness to share data. This provides immediate insight into which suppliers pose a risk and allows you to quickly detect incidents, which is essential to demonstrate that you have your supply chain under control according to NIS2 guidelines.

Time for Action

The agreement in the Dutch House of Representatives confirms that waiting is no longer an option. Organizations that now begin to structurally implement supplier monitoring and governance will not only build compliance but also create a more resilient organization.

Ensure you stay ahead. Do you want to know how your organization can take the first steps towards a NIS2-compliant supply chain in 60 minutes? Discover it today with RiskStudio.