Netherlands Baseline Information Security for Government 2 (BIO2) 5.20.03: Supplier demonstrates setup, existence and operation annually through independent assessment

What does 5.20.03 require?

The procurement contract obliges the supplier to show, through assessments carried out by independent third parties, that every specified requirement as to setup, existence and operation is met; those assessments cover the whole span of the contracted services, with express attention to the supply chain and to the way the supplier manages its own suppliers (see 5.21). The supplier demonstrates this annually.