Dutch Government Launches Tender for Cybersecurity Testing and Cyber Investigations

The Netherlands Enterprise Agency (RVO) has officially published the major European tender ‘Information Security Investigations’ (RVICTO2026) on behalf of nearly all Dutch ministries and a range of government organisations. Through the framework agreement, the Dutch central government is looking to select ten specialised cybersecurity companies to systematically test government networks, applications and IoT/OT systems for vulnerabilities and help strengthen their digital resilience.

The tender brings together a broad range of public-sector organisations. In addition to almost all Dutch ministries, several independent administrative bodies, High Councils of State and a sui generis organisation are participating in the initiative. This was announced by Sander Klaver, Category Manager for ICT Professionals at the Dutch central government.

Field-and-Bench Model and MIAUW Methodology

To ensure the assignments can be carried out flexibly and efficiently, the ten selected contractors will work according to a so-called field-and-bench model. The tender requirements are based on the Methodology for Information Security Investigations with Audit Value (MIAUW) and were further developed following a prior market consultation.

To reduce the administrative burden for both suppliers and the government, smaller assignments will, among other things, be allocated according to a rotation system.

Focus on PQC, Consistency and National Security

The Dutch central government is challenging participating ethical hackers and cybersecurity companies to demonstrate both quality and innovation. Applicants must, for example, explain how they apply established penetration testing standards, when and why they may deviate from these standards, and how they combine different methodologies. They must also demonstrate how they ensure consistency and continuous learning throughout longer-term engagements.

The tender also includes a number of specific requirements and addresses several current cybersecurity priorities:

• Post-Quantum Cryptography (PQC): Preparing for future vulnerabilities resulting from the emergence of quantum computing.
• National security: Strict compliance with the General Security Requirements for Government Contracts (ABRO).
• Social return: Creating social value and providing opportunities for people who face barriers to entering the labour market.

Contributing to a Resilient Government

The investigations and penetration tests will cover a broad range of government IT, from critical software applications and internal networks to physical systems and Internet of Things (IoT) environments. The findings are intended to provide direct insight into vulnerabilities, helping government organisations address weaknesses before they can be exploited by malicious actors or state-sponsored threat actors.

Interested cybersecurity companies and penetration testing specialists can view the tender and submit their bids until 30 November 2026.

Source: Dutch IT Leaders