ABRO 2026 & ABDO Readiness
Work on a Dutch government contract, and you have to meet it.
To work on a contract for the Dutch state, Defence or the police that touches national security, you must meet ABRO 2026, or ABDO if the contract was already in place. Without an ABRO-Verklaring from the national industrial security bureau, the NBIV, you do not start. We bring your organisation to that level: baseline assessment, the security plan for that assignment, the security organisation and the annual self-inspection.
Who this is for
Suppliers and subcontractors to Dutch Defence, central government and the police working on a Bijzondere Opdracht: access to a client site, physical or digital storage of a protected asset, or a cloud service. Also companies currently under ABDO 2019 that must move to ABRO 2026 on a new contract or a renewal.
The problem
The requirements run across five chapters and eleven annexes, and which ones apply depends on the protection category of the contract, from departmental confidential up to the highest state secret level. A compliance review that goes badly costs you the declaration, and that counts as breach of contract.
The outcome
A security organisation that actually holds: a security plan the NBIV can read, a security officer who knows what is expected of them, a self-inspection you repeat yourself every year, and an incident response procedure that has been exercised rather than only written.
What you get
- A baseline assessment that says what you still need, per ABRO requirement and protection category
- The security plan for your assignment, written by us together with your security officer
- The security organisation around it: roles, screening, risk analysis, incident procedure and self-inspection
Engagement model
Fixed-price baseline assessment of two to four weeks, then implementation against milestones. ABRO requires the security officer to be an employee of your own company, so we train and back that person rather than replace them, including during a compliance review or after an incident. The ABRO-Verklaring itself is issued per assignment, to the contractor; where our work touches the protected asset, we arrange that up front with your client and the NBIV.
Frameworks & standards
Why CyberBusters
- A Bijzondere Opdracht may not be spoken about publicly, not even the fact that it exists. That is why this site carries no client names and no traceable examples
- The same people who lead real crisis teams put your incident response procedure to the test
- Per requirement and per protection category, not a folder of templates that will not survive a review
Frequently asked questions
- We have an assignment. Where do we start?
- With a conversation. We go through which requirements apply to your assignment, because that depends on the protection category. After that you know what is left to do. You do not have to work through ABRO 2026 yourself.
- What is a Beveiligingsplan?
- The document in which you set out, per ABRO requirement, how you meet it: who is responsible, who gets access, and what you do when something goes wrong. It belongs to one assignment, not to your company. Annex 1 says what goes in it; the NBIV judges it.
- Can you write our security plan?
- Yes, that is what this service is for. We write it together with your security officer and put the measures behind it in place as well. Only that role has to be someone on your own payroll; the rest can be outsourced.
- What does it cost and how long does it take?
- The baseline assessment is fixed price and takes two to four weeks. What follows depends on your protection category and on what you already have, so implementation runs in milestones, with a price per milestone.
- What is the difference between ABDO and ABRO?
- ABRO 2026 replaces ABDO 2019 and now applies across central government and the police, not only Defence. Existing defence contracts keep ABDO; every new contract falls under ABRO. It is not a certification: the declaration is per assignment.
- Does our ISO 27001 help?
- Yes, but it is no guarantee. Part of the ABRO requirements align with the Dutch government baseline and ISO 27002, so existing evidence shortens the route. The NBIV still judges for itself whether the controls are adequate.
- Who has to be screened?
- Anyone who can reach a protected asset. The client sets the level: a security clearance, and for the lowest category sometimes a certificate of conduct. The screening is done by the Dutch intelligence services; a police assignment adds its own.
- Does our system administrator count?
- Yes, and that is usually realised too late. You have to record who holds extraordinary access: administrators, service desk, security analysts, facilities staff. Contractors count the same as employees.
- What do we have to keep on record?
- The assignment, the people involved, their clearance or certificate with its issue date, and every signed non-disclosure statement. A renewed screening is requested three months ahead, a new certificate one month.
- Does this apply to our suppliers too?
- Possibly. If a supplier is designated a subcontractor, ABRO applies to them too and they need their own declaration. Influence on the assignment is possible precisely through a component that looks harmless on its own.
Know within four weeks where you stand with the NBIV
The baseline assessment walks through every ABRO requirement that applies to your protection category and tells you what is left to do, by whom, and what it costs.