Cyber Supply Chain Risk Management in the Netherlands: Investigating Structural Elements and Drivers in the Context of EU-Cybersecurity Regulation

The growing complexity of supply chain (SC) ecosystems, along with the proliferation of high-profile SC attacks has forced organisations to gain visibility and control over the corresponding risks. The worsening consequences of such attacks have brought the attention to board level, prioritising SC cybersecurity. This thesis aims to explore Cyber Supply Chain Risk Management (C-SCRM) within organisations in the Netherlands as a possible approach to overview the complex risk landscape. Subsequently, the requirements of current and upcoming EU cyber regulations are taken into account. Additionally, this work aims to contribute to the establishment of a shared paradigm within the field of research and align used terminology. The thesis takes up a holistic organisational perspective and investigates concepts that support the successful implementation and operation of C-SCRM. Conclusions: Despite the rising awareness, organisations in the Netherlands currently cannot keep up with the rapid pace set by threat actors. Upcoming EU regulation is deemed to advance current initiatives and drive standardisation. The identified structural elements and drivers presented in this thesis may enable organisations to increase the speed of their progress. A collaboration between policymakers, research, industry consortia and important market players is needed to tackle the challenge in an effective way.