Menu

For buyers

Test your suppliers on evidence checked at the source.

Ask a supplier for its about.biz passport. You see for each fact how, where and when it was checked, and next time you do not start again.

A domain or a link to the website. You sign in with your work address; only you see the result.

Read how we check

The duty

What article 10 of the Cyberbeveiligingsbesluit asks

Since 15 August 2026 the Dutch Cyberbeveiligingswet (Cbw) and Cyberbeveiligingsbesluit (Cbb) apply. The second paragraph of article 10 reads (in Dutch):

De essentiële entiteit of belangrijke entiteit toetst of haar rechtstreekse leveranciers en rechtstreekse dienstverleners, bedoeld in het eerste lid, voldoen aan de beveiligingseisen, bedoeld in artikel 7, vijfde lid. De entiteit controleert dit periodiek.

Source:Cyberbeveiligingsbesluit, article 10(2). In English: the entity tests whether its direct suppliers and service providers meet its security requirements, and re-checks this periodically.

  • Policy

    You set down a policy for supply-chain security in writing, and apply it demonstrably (paragraph 1).

  • Your own requirements

    You test against the security requirements you set yourself from your risks (article 7(5)). The decree prescribes no standard.

  • Periodically

    You re-check periodically. The decree sets no term.

The explanatory note names two means: certification of the suppliers, or clauses in supply contracts. A supplier of pencils is out of scope, the note says; a software or hardware supplier relevant to your systems is in.

Source:Stb. 2026, 189, explanatory note to article 10

Read the full explainer (in Dutch): how to test your suppliers under article 10

Municipalities

PLC: three assurance levels

On 2 October 2026 the Dutch municipalities' information security service (IBD) launched Proportioneel Leveranciers- en Contractbeheer (PLC). A municipality classifies each supplier on three dimensions: how critical the service is, how much access the supplier has (chain position), and how easily the municipality can switch (digital autonomy). Each result maps to one of three assurance levels. A higher level includes all requirements of the lower ones. The municipality sets the level, not the supplier.

  1. Level 1

    A demonstrable standard, such as ISO 27001 or comparable evidence. Incident reporting, an SBOM for software and a vulnerability reporting point, among others, apply at every level.

  2. Level 2

    ISO 27001 with a scope that covers the service bought, no more than three years old. For SaaS a yearly TPM or the ISO certificate, and a mandatory exit plan.

  3. Level 3

    ISO 27001 plus a TPM (a statement by an independent third party). Among others, processing within the EEA and a tested exit plan.

In our own words, based on the IBD's PLC documents (version 1.0, 28 September 2026). Those documents are leading and not consistent everywhere: the introduction already names the TPM at level 2, the contract requirements at level 3. Read them at the IBD.

PLC is published by VNG and the IBD under CC BY-NC-SA 4.0. We do not quote the documents or copy text from them.

Source:PLC at the IBD (in Dutch)

What you get

What you get as a buyer

  • A first check, at once

    E-mail and domain settings, TLS, security.txt and an LEI if there is one. With a registration number also the register checks: registration, insolvency and sanctions. Only you see the result.

  • An invitation you send yourself

    Our text and a unique link, from your own mailbox. You change the text as you like. about.biz does not keep the address.

  • The supplier's passport

    Domain proven, certificates checked with the certification body, a questionnaire signed by a named person. Every fact with its source and date.

  • The seal

    At a glance which required checks hold, with the date. If something fails, you see it.

  • Reuse

    If the supplier is already on about.biz, it shares its passport with you at once, if its settings allow.

  • A record of what you tested

    Every fact has a source and a date. That is how you show what you checked, and when.

Requesting

How to request a passport

  1. 01Sign in with your work e-mail. Addresses of free mail services do not work.
  2. 02Enter the supplier's domain, plus its registration number and a contact address if you have them.
  3. 03See the first check. It is for you only.
  4. 04Send the request from your own mailbox, with our text and the unique link.
Check a business

Each organisation can make 20 requests a day.

Frequently asked questions

What does the supplier see of my request?
Who asked, and the privacy information it is entitled to. It can object; the request then stops and we delete the first check.
Is a supplier's ISO 27001 certificate enough?
That is your call, based on your own requirements. The Dutch NCSC points out that a certificate helps, but does not guarantee that your supply-chain risk is covered. At least check that it is real and that the scope fits.
What if the supplier does not respond?
about.biz sends no reminders. Your overview shows whether the link was opened, and you follow up yourself from your own mailbox.