Out of scope, still on the hook: what the Cbw means for staffing agencies

Ask a lawyer whether a staffing agency falls under the Cyberbeveiligingswet and the answer will usually reassure you: temporary employment is a designated sector under the law's annexes in no version of the text, so an agency's own operations typically sit outside direct scope. No registration, no reporting duty, no supervisor at the door.

Now ask the agency's clients the same question. Food producers, logistics operators, manufacturers, waste processors, healthcare institutions, municipalities: that client list reads like the law's table of contents. Those organisations, where they meet the size thresholds, carry a legal duty to manage their cyber risk, and the duty follows the work rather than the payroll. Temporary workers on their systems and sites belong to their risk management, and the law expects that control to be demonstrable.

Demonstrable is the word that moves the question down the chain. A client that must show its flexible workforce meets its measures will look for evidence where the workforce comes from, and so the question arrives at the agency: can you show, per placed worker, that cyber hygiene is in order?

Note the character of that question. For the client it is a legal obligation. For the agency it is a commercial one: there is no fine for the agency that cannot answer, only the slow consequence of clients comparing suppliers on a criterion where one has the answer ready and the other improvises.

That asymmetry is the whole story of the Cbw for the staffing sector, and it rewards timing. The agencies that organise the proof before the questionnaires arrive will answer them in one motion and sell with them afterwards. EdXactly Pass was built for exactly that motion.