ABDO or ABRO: which one applies to your contract, and why that is not your call

The question almost nobody asks per contract

Ask a supplier to the Dutch government which security regime it falls under and you get one answer for the whole company. Usually "ABRO, that came in this year". That answer is often correct, and that is the problem: correct often enough that nobody questions it, and wrong in exactly the places where it costs money.

Because the question has no answer at company level. A single business can today hold a contract running under ABDO 2019, a contract awarded under ABRO 2026, and an assignment with a client that has not switched over at all. Those three ask different things of you, and they are not set out in your policy but in your contracts.

What is settled

One note before the quotations. The Dutch source documents quoted in this article are published in Dutch only; every passage quoted here is my own translation, and the Dutch original governs.

ABRO 2026, Algemene Beveiligingseisen voor Rijksoverheidsopdrachten, the general security requirements for central government contracts, has applied since 1 January 2026 and replaces a patchwork of regimes with one set of requirements for all of central government and the police. The Nationaal Bureau Industrieveiligheid (NBIV), the national industrial security bureau, set up in March 2025 and run jointly by the AIVD and MIVD, the Dutch civil and military intelligence services, assesses whether a company meets them. The requirements sit in five categories: governance and organisation, personnel, physical, cyber and cloud.

And then the sentence that explains the rest of this article, from the Q&A of the programma Veilig inkopen, the safe procurement programme, at the Ministry of the Interior: departments, their services and agencies, and the police are applying ABRO gradually from 1 January 2026. "They have 2 years to do so; this is not a big bang." It spells out what that means for you: contractors, too, will meet ABRO gradually.

So it depends on your client, and that date is public

Attached to the government's ABRO page is an annex that is barely ever cited and that gives you the most: the start date per contracting organisation in tranche 1. It lists, per department, agency and service, when that body applies ABRO to its procurement. The version this article is based on is dated 27 July 2026.

The organisations that have already switched, with a hard date:

• Nationale Politie (the national police), 1 January 2026.
• Defensie (defence), core department and seven organisational units, 1 July 2026. Paresto, its catering service, the same day.
• Algemene Zaken (general affairs), core department and the Dienst Publiek en Communicatie, 1 July 2026.
• Justitie en Veiligheid (justice and security), core department and Asiel en Migratie, 1 July 2026.

Every other row in that table has no date but a cross in a quarter, and the annex is explicit about it: a concrete date is the date an organisation has stated it will apply ABRO, while "a cross concerns the quarter being aimed for". An aim is not a commitment. The core department of Binnenlandse Zaken en Koninkrijksrelaties (the interior), Logius, SSC-ICT and Rijkswaterstaat are down for the first quarter of 2027; Buitenlandse Zaken (foreign affairs) for the third.

And there is a third category you will not find in any advisory article: rows with no cross at all. The names below are as the annex lists them, because that is how they appear in a contract: Dienst Justitiële Inrichtingen, CJIB, Justis, Justid, Nederlands Forensisch Instituut, NCTV, Nationaal Cyber Security Centrum, Rijksvastgoedbedrijf, Douane, DUO, Nationaal Archief and the core department of Volksgezondheid, Welzijn en Sport have neither a date nor a target quarter. If you work for one of them, "we fall under ABRO now" is at this point an assumption and not a fact.

And it depends on the contract, not on the company

Then the transitional rule, which I would rather quote than paraphrase. The ministry's Q&A, last updated 4 July 2026, on the impact of ABRO on running government contracts:

"ABRO has no consequences for running contracts of central government and the police. For current Defence contracts to which the ABDO applies, the starting point is that the ABDO continues until the end of the contract. New government contracts can be assessed against ABRO."

Note the wording, which is more careful than how it usually gets passed on. It says "the starting point is that", not "continues to apply". And "can be assessed", not "are assessed".

The requirements document itself is firmer on that first point. The foreword to ABRO 2026 reads: "For existing Defence contracts to which the ABDO applies, the ABDO continues to apply for the duration of the contract." Not a starting point, but continues to apply. That the guidance is more cautious than the document is not odd in itself, the Q&A covers all of central government and the foreword covers Defence, but it does mean you cannot deduce the regime and have to check. It is named in the contract itself.

That is also where it belongs legally. ABRO is not law. The ministry's Q&A is blunt about it: "ABRO is not a statutory but a contractual obligation." The requirements as a whole are a special performance condition in the tender, and the contract states that you must continue to meet them. So you do not look up which regime applies to you in the official gazette. You look it up in your own contract folder.

Three things that follow, and that go wrong often

The clearance belongs to the contract, not to your company

This is the most common misconception, and it shows up in the search terms: people type "ABRO certification". There is no such thing. The ABRO clearance applies per government contract, and the Q&A puts it plainly: "If the contract ends, the clearance lapses. A new contract requires a new ABRO clearance from the NBIV." The NBIV will take a lapsed clearance into account as far as possible, but you do not have a certificate on the shelf to walk into the next tender with.

The requirements do not cover your whole company

Also from the Q&A, and this genuinely saves money: ABRO applies "only to the part of the supplier's operations directly involved in performing a special (ABRO) contract and therefore does not apply to the entire company, nor to other contracts". That is the exact opposite of the Dutch NIS2 implementation, where a designation creates obligations for the whole business. Confuse the two and you impose measures on your entire organisation that were meant for one project.

No clearance, no contract, and that holds during the term too

The Q&A: "Without an NBIV clearance no contract can in principle be entered into; if it is withdrawn during the term of a contract, the contract is in principle dissolved." The NBIV assesses before award and checks during performance. That makes this not a paper obligation with an annual moment, but a condition your contract hangs on for as long as it runs.

What you do with this

1. Record, for every running contract, which regime it names. Per contract, not per client. It sits in the contract as a special performance condition, not in a policy document and not in an email from your account manager. When in doubt, your client's contract manager is the source, not an advisory blog.
2. For every new tender, check that particular client's start date. In the annex at Rijksoverheid.nl/ABRO, and mind the version date: that list gets updated. A cross is a target quarter, an empty row is nothing yet.
3. Delimit which part of your business performs the contract. That is the scope of ABRO and therefore of your investment. Skip it and the scope creeps across the whole organisation, a cost nobody decided on.
4. Expect the clearance to disappear with the contract. Plan the next application as part of your bid process, not as an afterthought to the last project.
5. Put one owner on it, with a date on which it was accurate. Contract management or bid management, not security on the side. This is administration with liability attached, and it belongs with whoever knows the contracts.

Where I think this is going

This is my expectation, not a figure. The rollout runs to the end of 2027, and the cabinet wants other public bodies, provinces, municipalities, water authorities and energy companies, to adopt ABRO as well; that decision has yet to be taken. If it happens, this shifts from a defence-sector matter to something an ordinary IT supplier or builder runs into at a municipality.

Which makes the annex of start dates not a one-off announcement but a document you need to re-read every year. That is a dull conclusion, and the only one that holds.

Frequently asked questions

Is ABRO a law?

No. The ministry's Q&A states it literally: "ABRO is not a statutory but a contractual obligation." The requirements are set out contractually between client and contractor as a special performance condition. The investigation the NBIV carries out does have a statutory basis, in the Wet op de inlichtingen- en veiligheidsdiensten 2017 (the intelligence and security services act) and the Wet veiligheidsonderzoeken (the security screening act).

What is the difference between ABDO and ABRO?

ABDO 2019, Algemene Beveiligingseisen voor Defensieopdrachten, the general security requirements for defence contracts, applied to contracts from the Ministry of Defence. ABRO 2026 applies to all of central government and the police, and replaces ABDO for new contracts. Mind the years: ABDO 2019 and ABRO 2026. An "ABDO 2026" does not exist, and you will come across the term online.

Does ABRO apply to my whole company?

No, only to the part of your operations directly involved in performing the special contract, not the whole company and not other contracts. Delimiting that is one of the first things you do, because it sets the size of everything that follows.

We already fall under the Dutch NIS2 implementation. Does that help?

They do not conflict and they do not replace one another. The Cyberbeveiligingswet, the Dutch NIS2 implementation, applies to the entire business once you are designated an important or essential entity, and covers cyber security. ABRO applies only to the special contract and is integral: governance, personnel and physical security as well. According to the ministry the two share a number of similar obligations, and those do not conflict.

We hold ISO 27001. Does that count?

It helps, but it is not enough. The Q&A notes that existing certificates or security declarations can help to verify more quickly whether you meet the ABRO requirements. At level TBB 4 there is some overlap with ISO 27002 and the Dutch government baseline, but the ministry adds that ISO and that baseline are worded more generically and the ABRO requirements more specifically.

Our client has no start date yet. Do we need to do anything?

For that contract nothing changes now, and getting ahead of a regime that does not yet apply is rarely wise. What is wise: knowing it is coming, and asking about it at the next renewal or tender. The switch happens in new contracts, and a renewal is usually one.

Further reading

• Dutch government: security requirements for government contracts (ABRO)
• Ministry of the Interior: Q&As on ABRO
• Ministry of the Interior: ABRO start dates, tranche 1
• Netherlands Enterprise Agency: ABRO for entrepreneurs
• CyberBusters: ABRO 2026 & ABDO guidance
• CyberBusters: your resilience may depend on a supplier you do not control