Your Supplier’s Cyber Failure Can Reach Tomorrow’s Cash

Dutch cyber rules sharpen governance, but every small firm must understand the dependencies behind its next invoice.

The owner of a small wholesaler arrives on Monday with orders waiting and stock in the warehouse. Nobody has attacked her company. The logistics platform is unavailable because its provider has suffered a cyberincident. Goods cannot be released, delivery confirmations cannot be retrieved and customers are already asking questions.

By lunchtime, the technology problem has become a cash problem. Work has been done, but the company cannot support its invoices. Staff can answer the telephone, yet they cannot see reliable order information. The company is open and still unable to trade properly.

This is the cyber risk many small businesses underestimate. The decisive system may belong to someone else.

The Dutch legal position has also changed. The Cyberbeveiligingswet entered into force on 15 August 2026, together with the Wet weerbaarheid kritieke entiteiten. The first law implements NIS2 and covers organisations providing essential or important services across 18 sectors. Those organisations face duties concerning registration, risk management, incident reporting and governance.

Directors of covered organisations must understand cyber risks and security measures well enough to assess them. They must also receive suitable training. Cyber resilience has therefore moved beyond a narrow IT question. For organisations within scope, it is a board responsibility tied to continuity.

Responsibility travels beyond legal scope

Most micro and small businesses are not automatically covered by the Cyberbeveiligingswet. Exceptions apply to certain trust, domain-name and public electronic communications services. A responsible minister can also designate a smaller company whose service is crucial to Dutch society or the economy.

That distinction matters. It prevents every small entrepreneur from being told that NIS2 applies directly to them. Commercial pressure still travels through the supply chain.

A larger customer covered by the law may ask suppliers about access rights, incident contacts, recovery arrangements and essential subcontractors. An insurer or lender may ask similar questions. A contract renewal can suddenly include a security questionnaire that the founder has never seen before.

I read this as a clear Dutch business direction. Legal duties may stop at the company boundary, but continuity responsibility follows the dependency. If your service forms part of another organisation’s essential work, your ability to explain how you manage disruption can affect whether you keep the contract.

This is not about producing an impressive security manual. It is about answering ordinary questions. Who can enter the accounting system? Where is the latest usable customer list? Which supplier controls the company domain? How will staff receive instructions if email is unavailable?

The ordinary failure deserves attention

CBS reported that 4 percent of Dutch businesses with at least two employees experienced an external cyber incident with consequences in 2024. The comparable figure was 11 percent in 2016.

Internal incidents affected 7 percent of businesses. Internal ICT system failure was the most common type, affecting 6 percent. Phishing and spoofing were encountered by 23 percent of businesses.

These figures point to a practical continuity problem. Operations can fail without a dramatic criminal operation. A software update can go wrong. A mailbox can be compromised. An employee can follow a fraudulent payment instruction. A cloud environment can become inaccessible at precisely the wrong moment.

Capability is also uneven. In 2025, data encryption was used by 33 percent of businesses with two to ten employees, compared with 91 percent of businesses employing at least 250 people. Larger organisations usually have more people, money and formal control. Smaller firms often depend on one adviser, one administrator or one provider.

That concentration can be efficient until something breaks. If the same provider manages staff accounts, backups and recovery, the company may lose both its daily systems and its route back into them.

Continuity starts with the next invoice

Return to the wholesaler with goods waiting in the warehouse. Her first concern is not a legal definition of cyber risk. She needs to know what was ordered, what can be released, which customer must be called and whether an invoice can still be produced.

That is where governance becomes practical. A small company should know which outside services it needs to accept work, deliver it, record it, invoice it and collect the cash. Ondernemersplein advises businesses to map digital dependencies, prepare for incidents, maintain backups and protect information about suppliers and production processes.

A useful first step is a one-page dependency map. Name the systems and outside parties required for orders, wages, payments, delivery and customer contact. Beside each dependency, record who owns the relationship, where the contract sits, how an incident is reported and what alternative remains available.

Then test one uncomfortable question: if this service disappeared before opening tomorrow, could the company continue for one working day?

The answer should include records as well as technology. A backup has limited value if nobody knows how to retrieve it, if it sits inside the affected environment or if the only authorised person is unavailable. Insurance may help with a later financial claim, but it does not recreate delivery evidence during the first hour of disruption.

Contracts also deserve a sober reading. Check incident contacts, data export, backup responsibilities, recovery support, transition assistance and liability limits. A promise to discuss damages later is not a substitute for keeping customers informed today.

The Dutch requirement is increasingly straightforward: know what your company depends on and be able to account for the choices around it. Not every small firm needs a large cyber programme. Every firm does need named responsibility, recoverable records and a workable alternative for the activity that cannot wait.

The wholesaler may still lose part of Monday. Good governance cannot prevent every supplier failure. It can stop one failed platform from taking the company’s facts, decisions and cash route down with it.

The data, sourcing, and analysis behind this article were conducted by Paolo Maria Pavan. AI was not used to identify sources, build the factual basis, or produce the analytical judgment contained here. AI was used only as a drafting aid. The final English text was personally reviewed, edited, and approved by Paolo Maria Pavan before publication.

References

• Waarom cyberincidenten bij één organisatie doorwerken in de hele keten | PwC
• Rijksoverheid - Current Dutch cyber resilience law and board responsibility
• Ondernemersplein / Rijksdienst voor Ondernemend Nederland - Which small firms are directly in scope, and which are not
• Ondernemersplein / KVK / Nationaal Cyber Security Centrum / Rijksdienst voor Ondernemend Nederland - Digital dependency mapping and continuity preparation
• CBS - Observed incident patterns among Dutch businesses
• CBS - Internal failure, phishing and data-leak pressure
• Rijksoverheid - Supplier concentration and digital continuity
• Rechtspraak, Gerechtshof Amsterdam - Contract allocation, backups and consequential loss