Netherlands Baseline Information Security for Government 2 (BIO2) 5.20.02: Exclude suppliers' general terms and define acceptable, mitigated and never-accepted consequences

What does 5.20.02 require?

The general terms and conditions of the supplier are expressly excluded and, where possible, the entity's own additional terms put in their place; where they cannot be excluded, a risk assessment is made. On concluding the agreement the entity defines expressly which consequences it finds acceptable, which it requires to be mitigated, and which conditions it will not, or may never, accept.