Unambiguous security requirements (ABRO) for public contracts with risks to national security

For whom?

• ICT companies, such as cloud providers, software developers, suppliers of ICT equipment, telecoms providers
• service providers, including cleaners, painters, security firms (both physical and digital), audit firms, consultancy firms, transport companies, travel agencies, training centres, translation agencies, catering businesses
• construction businesses, such as architectural firms, construction companies, installation companies
• businesses working with radar, cryptography, weapons systems, personal data, data centres, and communication equipment

What has changed?

Are you an entrepreneur and do you provide a service or product for the central government or the police? Any new contract may be subject to the General Security Requirements for Central Government Contracts (Algemene Beveiligingseisen voor Rijksoverheidsopdrachten, ABRO). These general security requirements apply to all contracts with the central government that involve a potential risk to national security. A contract subject to the ABRO requirements is referred to as a ‘Special Contract’.

The National Office for Industrial Security NOIS (Nationaal Bureau Industrieveiligheid, NBIV) will check whether you as the prospective contractor meet the ABRO requirements. The NOIS will also monitor this during the assignment. 

How does ABRO affect your company?

Are there any risks to national security associated with a public contract? Then the following steps should be taken:

1. The client (contracting authority) first determines whether they can take measures themselves to reduce these risks. 
2. If that is not possible or not entirely possible, you as the contractor must comply with the requirements ABRO sets. 
3. The client then asks the NOIS to investigate the company that will carry out the assignment. 
4. Before the Special Contract is awarded the NOIS advises the client on whether the contractor complies with the ABRO. 
5. The Special Contract will only go ahead with such an ABRO declaration. 
6. The NIBV will conitnue to monitor compliance with the ABRO requirements for the duration of the assignment.  

Examples of situations in which the ABRO applies are:

• You are given access to information that is classified as departmental NLD RESTRICTED (departementaal VERTROUWELIJK), NLD CONFIDENTIAL (staatsgeheim CONFIDENTIEEL), NLD SECRET (staatsgeheim GEHEIM), or NLD TOP SECRET (staatsgeheim ZEER GEHEIM), or an equivalent police classification.
• You will have access to a restricted site, such as a data centre.
• You work with government computer systems or software.
• You work in or a high security facility, such as a prison.

NOIS will advise the contractin autority (the client) whether your company complies with the ABRO. It depends on the nature of the assignment and on the Interests To Be Protected (Te Beschermen Belangen) which parts of ABRO apply to a specific assignment. Interests to be Protected include information, systems, equipment and objects that are critical to national security.

The ABRO consists of 5 chapters. The first 2 chapters, that cover management, organisation, and personnel, apply to all Special Contracts.

• chapter 1: management and organisation
• chapter 2: personnel security
• chapter 3: physical security
• chapter 4: cyber security
• chapter 5: cloud services

When?

The General Security Requirements for Central Government Contracts (Algemene Beveiligingseisen voor Rijksoverheidsopdrachten, ABRO) took effect on 1 January 2026. The ministries, including their departments and agencies, and the police, will implement the ABRO in phases. Existing contracts with the Ministry of Defence covered by ABDO have not changed with the ABRO. The ABRO requirements apply exclusively to new contracts.