Netherlands Baseline Information Security for Government 2 (BIO2) 5.21.03: Security requirements flow down the subcontractor chain, exclusions justified

What does 5.21.03 require?

The entity sees to it that the security requirements placed on the supplier bind the subcontractor chain equally and in full, unless they are irrelevant to the kind of services the supplier provides; where any requirements are excluded the supplier makes this transparent and justifies it.