Hiring a cybersecurity contractor in the Dutch public sector takes longer and needs more paperwork than in the private sector. If you sort that out up front, you get better candidates and fewer drop-outs after the intake.
This piece is for CISOs, security managers and procurement teams in central government, municipalities, provinces and water boards. It covers the practical side: when you have to tender, what a candidate has to submit, where it often goes wrong and what you can do yourself.
Why Dutch government bodies are hiring security capacity now
The Dutch Cybersecurity Act (Cyberbeveiligingswet, Cbw) entered into force on 15 August 2026. For government organisations within its scope, a large part of the BIO2 is now anchored in law through the Cyberbeveiligingsregeling for the government sector. Not every BIO measure falls under that legal duty. BIO2 version 1.3 remains the baseline; what is new is that applying it is a legal obligation for these organisations.
The BIO2 (Baseline Informatiebeveiliging Overheid) is the baseline framework for every layer of Dutch government and is based on ISO/IEC 27001:2023 and ISO/IEC 27002:2022. Organisations outside the Cbw remain bound to the BIO2 through mandatory self-regulation.
For many organisations that means catching up: redoing risk analyses, documenting measures, proving they work. That work comes on top of day-to-day security operations. So I expect many government bodies to look for temporary capacity in GRC and compliance, information security and security management.
When do you have to run a European tender?
That depends on the estimated value of the contract. For 2026 and 2027 the European thresholds for supplies and services are €140,000 for central government and €216,000 for sub-central authorities, excluding VAT. The amounts are set in Commission Delegated Regulation (EU) 2025/2152.
An interim assignment of a year or more can reach that threshold. So count the full term, including extension options, before you opt for a quick direct award. If in doubt, check with your procurement team before you start talking to candidates.
Above the threshold, contracts are almost always awarded on the best price-quality ratio. PIANOo, the Dutch public procurement expertise centre, calls that the starting point; if you choose lowest price, you have to explain why. In practice, best price-quality means the candidate's quality documents carry a lot of weight. That is where the problem I describe below sits.
What a candidate has to submit
For a government assignment a CV alone is not enough. A candidate often has to submit a CV of no more than three pages, a short plan of approach, an explanation against the requirements and a motivation. That is a lot of work for a contractor who is also still on a live assignment.
The plan of approach is the hardest part for an outsider. Consultants who already work at the organisation know exactly what the client expects. They know the running projects, the people and the sensitivities. An outsider writes on the basis of a brief of a few paragraphs. A good CV will not close that gap.
I think that is a missed opportunity for government itself. With a new legal duty, you want to bring in people who have already set it up elsewhere. If the brief gives too little context, the person who is already there usually wins.
The maximum rate: say it in the first conversation
In Dutch government tenders the maximum hourly rate is fixed. If a candidate wants a little more, there is almost no room. That is not a negotiation you can still have after the intake.
In my experience you have to be honest about it in the very first conversation with a candidate. If you are not, you lose the candidate after the intake, once the groundwork has already been done.
As a hiring manager you can help here. Give your agency or hiring desk the maximum rate and the conditions as early as possible, together with the requirements. Then everyone knows where the limit is from day one.
False self-employment and the contracting set-up
Since 1 January 2025 the Dutch Tax Administration has been fully enforcing the rules on false self-employment again, and in March 2026 the Dutch cabinet confirmed that this will stay the case. If a self-employed contractor in practice works as an employee, the client still has to pay wage taxes. There are also employment and pension law risks.
That applies to government just as much as to a bank or an energy company. An interim security officer who fills the same role for years, under the same manager, with the same working hours as the permanent team, is exactly the kind of situation you need to look at carefully. Write down what the assignment is, when it is finished and how the professional organises the work. If the role is really structural, consider secondment or a permanent position.
What you can arrange as the client
My advice: put time into the brief, because it decides who responds. This is what you can arrange yourself:
- Write down what has to be done in the first three months, with which BIO2 areas and which systems. Then an outsider can write a plan of approach that actually says something.
- Keep the knock-out criteria to what the work really requires. Every extra certificate requirement removes candidates who could do the job well.
- Include the maximum rate, the number of office days and the screening requirements from the start.
- Set aside time to answer the clarification questions properly. That is where you can put outsiders on an equal footing with the incumbent consultants.
- Check the total term against the tender threshold before you choose the route.
If you are looking for an interim CISO for the transition period, see also our page on CISO and security leadership roles.
Where MVPeople helps
We work for organisations in government and know how a request runs there. Through MVPeople we provide freelance and interim cybersecurity professionals from our network of 7,000+ vetted experts, and we present the first candidate within 4 hours. That helps when the deadline falls shortly after publication.
Do you have a brief ready, or do you want to talk through the requirements first? Call or email me via the contact page. Then we can check together whether the requirements match what the market can deliver.