GRC and compliance software for Dutch organisations.
Since 15 August 2026 the Cyberbeveiligingswet makes boards answerable for cyber risk, on top of the AVG, the Arbowet and, for listed companies, the Corporate Governance Code. XGRC® gives Dutch organisations one auditable platform for risk, compliance, cyber security and SHEQ, with customer data hosted in the Netherlands.
Dutch obligations, in one system.
Each obligation is held as a live, owned record with its evidence, so you can show a supervisor, an auditor or your board where you stand at any time instead of reconstructing it before a review.
Cyberbeveiligingswet (NIS2)
In force since 15 August 2026. Risk analysis, security measures, incident records for the 24-hour and 72-hour reports to the NCSC, and evidence of board oversight, in MSXCyber®.
Learn more →AVG (GDPR) and the Autoriteit Persoonsgegevens
Processing records, DPIAs, data subject requests and breach registers kept as linked, auditable records.
Learn more →ISO 27001 and BIO2
An ISO 27001 ISMS with risk treatment and evidence per control, which public sector organisations can extend to the government measures of the BIO2 baseline.
Learn more →Arbowet: RI&E and plan van aanpak
The risk inventory and evaluation, its plan of action, incidents and inspections as owned records with deadlines, in SHEQX®.
Learn more →Dutch Corporate Governance Code
Risk registers, controls and assurance that support the board’s in-control statement and the risk management statement added to the Code in 2025, in ERM and Integrated Assurance.
Learn more →CSRD and sustainability reporting
The Dutch CSRD act is still going through parliament and the EU Omnibus narrows the scope from 2027. XGRC® ESG keeps the data and audit trail sustainability reporting draws on, in or out of scope.
Learn more →Your data stays in the Netherlands.
Customer data is hosted in Microsoft Azure West Europe, in the Netherlands, on a platform certified to ISO/IEC 27001:2022 by BSI. Risk, compliance, cyber security, SHEQ, environmental and ESG obligations share one data foundation, so the same evidence answers the Cyberbeveiligingswet, the AVG, your ISO certifications and your board. Dutch organisations such as Linckr already run on XGRC®, and implementation partner OSA International works with organisations in the Netherlands.
Read about hosting and security in the Trust Centre →GRC software in the Netherlands.
01Does XGRC® help with the Cyberbeveiligingswet (NIS2)?
Yes. The Cyberbeveiligingswet has applied since 15 August 2026. MSXCyber® supports its duty of care with a documented risk analysis and the security measures that follow from it, records incidents with the timestamps and evidence needed for the 24-hour early warning and 72-hour notification to the NCSC, and keeps the board approvals and training records that show management oversight. Registration with the NCSC and the reports themselves are made through the NCSC’s own channels.
02Where is our data hosted?
In the Netherlands. Customer data is hosted in Microsoft Azure West Europe, and the XGRC® platform is certified to ISO/IEC 27001:2022 by BSI. The Trust Centre sets out hosting, security controls and data protection in full.
03Can XGRC® support the AVG (GDPR)?
Yes. Processing records, data subject requests, data protection impact assessments and data breaches are managed as linked, auditable records, so you can show the Autoriteit Persoonsgegevens how each obligation is met and notify a breach within the GDPR’s 72 hours.
04Does SHEQX® support the RI&E under the Arbowet?
Yes. SHEQX® holds the risk inventory and evaluation (RI&E) and its plan of action (plan van aanpak) as live records, with owners, deadlines and follow-up, and keeps incidents and inspections alongside them, so the evidence is ready when the Nederlandse Arbeidsinspectie asks for it.
05Is the platform available in Dutch?
The XGRC® platform and this website are in English today. Talk to us about Dutch-language needs for your users, policies and reports.
See XGRC® against your own Dutch obligations.
Talk to an XGRC® specialist about the Cyberbeveiligingswet, the AVG, your ISO certifications and your board reporting.
[email protected] · UK +44 161 706 1345