Digital trust under growing cyber threats

For organisations that depend on digital information exchange, the implications reach beyond their IT departments. An incident can interrupt invoice delivery, expose sensitive information or make it harder to establish what happened to a transaction. The management question is whether essential services and reliable evidence will remain available when something goes wrong.

AI increases the pressure on everyday controls

The NCTV describes how attackers use AI to support reconnaissance, find vulnerabilities, develop malware and perform parts of an attack. This reduces the time available to respond. Yet the report also identifies familiar weaknesses: delayed patching, inadequate logging, compromised identities and insufficient preparation for disruption. _[1]

Organisations should therefore examine the speed and effectiveness of their existing controls. How quickly is an exposed vulnerability assessed? Who acts on an unusual login? Can an investigation reconstruct what happened? AI developments make those operational questions more urgent.

Resilience needs to be demonstrated

A continuity plan becomes useful when people know how to execute it. A backup becomes meaningful when restoration has been tested. Monitoring provides protection when relevant events are captured and alerts lead to timely action.

Recovery also has limits. Restoring a service does not undo the theft of confidential information. Prevention, data minimisation, detection and response need to work together. The NCTV’s emphasis on the gap between documented arrangements and practical resilience is a reason to ask for evidence of results. _[1]

Connecting standards to real performance

Management standards help organise this work. ISO/IEC 27001 addresses information security; ISO/IEC 27701 addresses privacy; ISO 22301 supports continuity. ISO/IEC 20000-1 connects controls to service delivery, ISO9001 supports consistent processes and improvement, and ISO/IEC 42001 provides a framework for responsible AI.

Their value increases when organisations use shared processes and evidence. An access review, supplier assessment or recovery exercise may support several requirements. Scope differences still matter, but the underlying work should remain connected to the service and its risks.

Assurance adds another perspective. A SOC 2 Type II report examines controls over a specified period and within a defined scope. A SOC 3 report provides a less detailed, general-use form of assurance. These reports help customers assess trust, while ongoing control performance remains essential.

Digital delivery carries specific responsibilities

For eDelivery providers, including Peppol service providers, the regulatory connection is direct. The Dutch Rijksinspectie Digitale Infrastructuur identifies eDelivery providers as non-qualified trust serviceproviders under eIDAS unless qualified status is granted, and brings them within the Cyberbeveiligingswet. _[2]

This makes service classification, risk management and incident reporting important operational responsibilities. Data protection obligations may apply alongside them. AI and product-security requirements require their own assessment according to the system, product and organisational role concerned. One general statement of compliance cannot explain all those differences. _{[3, 4]}

Dependencies are part of the service

A service can be well managed internally and still depend on a vulnerable component or an unavailable provider. The NCTV highlights both supply-chain compromise and the risks of concentrated digital dependencies. _[1]

Useful questions for a provider or partner include: Which dependencies are critical? What happens if a supplier is unavailable for an extended period? What can be restored independently? How are customers informed? Answers should be supported by realistic scenarios and tested recovery arrangements.

Our perspective at Semansys

As a provider of regulatory digital infrastructure, we see cybersecurity, service continuity and reliable information exchange as closely connected. Customers need services that protect information and produce dependable results throughout the delivery process.

The NCTV findings reinforce the need to connect governance with everyday operations: clear ownership, controlled changes, responsible use of AI, timely reporting and evidence that recovery works. For management teams, a useful next step is to select one critical service and ask its owners to demonstrate how it withstands an account compromise, data theft or the loss of a key supplier.

_Sources

_{This article interprets the NCTV findings for digital service providers. The practical recommendations reflect the Semansys perspective.
[1] NCTV, Cybersecuritybeeld Nederland 2026, November 2026, chapters 2–4. Read the report
[2] RDI, regulatory classification of eDelivery providers. eDelivery guidance
[3] NCSC and EDPB. Cbw | Personal data breaches
[4] European Commission. AI literacy | Cyber Resilience Act}