Important update: Cyber Security Act takes effect on August 15, 2026

The Cyber Security Act, the Dutch implementation of the European NIS2 Directive, replaces the current Network and Information Systems Security Act (Wbni) and introduces stricter cybersecurity requirements for organizations across 18 essential and important sectors. These include energy, drinking water, digital infrastructure, healthcare, government, and transport. As of August 15, 2026, new obligations will apply to approximately 10,000 organizations in the Netherlands. And that is just the tip of the iceberg, as the law also extends through the supply chain. Are you a supplier to an organization covered by the act? Then you will be affected through your client. This is expected to involve tens of thousands of suppliers.

What is the NIS2 Supply Chain certificate?

The NIS2 Supply Chain certificate is a quality mark demonstrating that your organization meets the cybersecurity requirements of the NIS2 Directive (in the Netherlands: the Cyber Security Act). This mark helps you prove to clients and partners that you comply with the required security standards. The system consists of three levels: SC10 (basic level), SC20 (substantial level) and SC30 (high level), allowing organizations to implement measures tailored to their specific risks and business activities. The higher the level, the more requirements apply to your organization. As shown in the table below, an ISO 27001 certificate is more than sufficient to meet all levels of the NIS2 Supply Chain certificate (QM = SC).

Why is the NIS2 Supply Chain certificate important?

NIS2 places the responsibility for supply chain security on NIS2 organizations. They must ensure that their suppliers also implement the appropriate cybersecurity measures. For suppliers, this means they must be able to prove that their security is in order. The NIS2 Supply Chain certificate provides this assurance and makes NIS2 compliance demonstrable. The greater the impact of your services on clients, the more requirements you must meet.

The three levels of the NIS2 Supply Chain certificate

✅ SC10 – Basic measures

This level focuses on fundamental security measures such as:

‍

• Cybersecurity policy with clear responsibilities.
• Multi-factor authentication and strict access rights.
• Incident management and monitoring.
• Regular updates and malware protection.
• Employee awareness and training.

‍

Does your organization provide services to a NIS2-regulated company, but are you not subject to registration yourself? Then SC10 is usually sufficient to demonstrate that you have the basics of cybersecurity in order. This applies to most SMEs. Download here all requirements within the SC10.

‍

✅ SC20 – Comprehensive security

In addition to the SC10 requirements, extra measures apply such as:

‍

• Information classification and stricter data security.
• Security requirements in supplier contracts.
• Stricter monitoring and control of user accounts.
• Encryption and secure communication channels.
• Regular internal audits of security measures.

‍

Does your organization provide ICT or OT services ? If so, your client may require SC20 or even SC30 . This depends on the risk and the impact of your service on the availability, integrity, and confidentiality (AIC) of their systems. Download here all requirements within SC20.

‍

✅ SC30 – Advanced cybersecurity

The highest level with additional control measures such as:

‍

• Management and security of OT systems.
• Strict requirements for cloud services and suppliers.
• Secure software development and application testing.
• Procedures for digital forensic evidence.
• Independent external security audits.

‍

Does your organization fall directly under the NIS2 legislation and are you required to register? Then SC30 is the minimum requirement. In addition, supplementary certification, such as ISO 27001, NEN 7510, or IEC 62443, is strongly recommended. Download here all requirements within the SC30.

How long does a certification audit take?

The table below shows how long a certification audit for the NIS2 Supply Chain certificate takes (QM = SC). Do you already have ISO 27001 or NEN 7510 certification? If so, you will be exempt from specific requirements already covered by those standards. The certificate is valid for 3 years and is issued by the Stichting Kwaliteitsinnovatie, which also publishes the certificate in a central register.

‍

‍

How can we help?

Do you want to know where your organization stands and what steps are needed to comply with the Cyber Security Act or to obtain the NIS2 Supply Chain certificate ? Or would you like immediate insight into your cybersecurity status and to be prepared for NIS2 requirements? Feel free to contact us and discover how we can help you. 🚀