Surinamese companies that supply Dutch organisations may increasingly be asked about their digital security. The Cyberbeveiligingswet (Cybersecurity Act) has been in force in the Netherlands since 15 August. The law does not apply directly in Suriname, but requires organisations covered by it to assess risks among their suppliers as well.
These include organisations in energy, healthcare, financial services, transport and digital infrastructure. They may ask suppliers what security measures have been taken, how incidents are reported and who has access to their systems or data. Such arrangements may also be laid down in contracts. The requirements a Surinamese company faces depend on the service it provides and the risks the Dutch client identifies.
For a supplier that processes customer data or has access to corporate networks, information security may therefore play a role in winning or retaining an assignment. It is then not enough to say that security software or a firewall is in place. A client may also ask how employees are trained, who is responsible for security and how measures are monitored.
This requires demonstrable arrangements and working methods. A company must, for example, be able to show who has access to sensitive information, how systems are updated and what happens when a cyber incident occurs.
An attack on the Belastingdienst van Curaçao (Curaçao Tax Department) showed last year how a digital incident can affect service provision. According to the Minister of Finance, ransomware was used in the attack. Some systems were taken offline; telephone assistance and counter services were temporarily unavailable. No conclusion can be drawn about the exact cause of the attack based on the available information.
For Surinamese companies with Dutch clients, the practical question is therefore becoming increasingly concrete: if a client asks tomorrow for proof of digital security, what measures and documents can they provide?
