Farron by Montagne Security

From contract to control.

Farron turns Dutch and European cyber obligations into contract requirements, then gives you a clear, clause-by-clause view of what each supplier agreement covers, where attention is needed, and what to do next.

See Farron See why contract control matters

Clause-level evidence
Expert-reviewed
Runs in your environment

Timing gap Review recommended

Supplier agreement · clause 12.4

“The Supplier shall notify the Customer without undue delay and in any case within 72 hours of becoming aware of an incident.”

Your early-warning window: 24 hours
Supplier notification window: 72 hours

The current wording may leave less time than your own early-warning duty allows. Farron brings that gap into view before it becomes an incident-response problem.

01 Contract clause
02 Cbw duty
03 Reviewed finding

The challenge

Responsibility stays, even when IT moves outside.

Organisations face the same challenge. IT is outsourced, and with it a large part of cyber security. Central knowledge of every contract and its relationship to risk and compliance is essential for insight, overview and control.

01Supplier
02Contract
03Risk
04Compliance

Why now

Cyber risk and regulatory pressure are rising together.

Third-party dependence is growing while legislation and oversight demand a clearer, evidence-backed position.

Cyber risk is increasing

48%

of breaches in Verizon's 2026 dataset involved a third party.

Source · Verizon 2026 DBIR

Regulatory and compliance pressure is increasing

NIS2, the Cyberbeveiligingswet and the Wwke put supplier risk, governance and demonstrable control on the same agenda.

NIS2
Cbw
Wwke

15 Aug 2026 the Cyberbeveiligingswet and Wwke enter into force in the Netherlands.

Source · Rijksoverheid

Board duty boards approve cyber-risk measures and supervise their implementation.

Source · NCSC

How it works

Control over contracts.

Your organisation needs a current view of risk across its existing IT contracts, considered in the context of the organisation itself. How your organisation depends on a supplier changes both the risk and the control that is required.

Scope

Establish whether the Cbw applies, why it applies, and which requirements follow for your organisation and the service under review.

Output · Scope note
Trace

Match each requirement to the exact clause, omission or contradiction in the supplier agreement. The evidence and reasoning stay together.

Output · Clause map
Resolve

Turn gaps in deadlines, scope, evidence, access and exit duties into concrete contract requirements for procurement and legal teams.

Output · Negotiation position
Govern

See coverage across the supplier portfolio and identify which agreements need attention when a rule, service or contract changes.

Output · Portfolio view

The Farron Control graph

See what the contract gives you control over.

Select a NIS2 control. Farron traces its third-party requirements to the clauses that support them and brings missing or ambiguous coverage into view.

Select a control to reveal its contract path

Agreement MSA 2026-014

Covered Partial Gap

.control-graph__body { display: none !important; }

NIS2 illustrative coverage

Incident handling: 67% covered
Business continuity: 54% covered
Supply-chain security: 58% covered
Effectiveness & assurance: 42% covered
Vulnerability handling: 79% covered

Enable JavaScript to explore requirements and clause evidence.

01 · Framework Start with the control surface
The framework shows which controls deserve attention first.
02 · Control Open one contract path
Requirements reorganise around the selected control.
03 · Evidence Follow the active clause
Coverage lights up from requirement to supporting contract language.
04 · Gap Keep missing coverage visible
A missing clause remains part of the same traceable path.

Nothing is marked covered without a traceable clause.

Illustrative data · Final assessments remain reviewable and versioned.

See Farron

Built by experts in the field.

Farron combines governance, risk and compliance expertise with security engineering. The product is built around the decisions that legal, procurement, security and leadership teams actually need to make.

The people behind Farron

01
Jan Lugtmeijer GRC specialist LinkedIn · Jan
02
Thomas Pfann Security engineer LinkedIn · Thomas

Speak to us

Bring one contract question.

We will show how Farron traces it from requirement to clause, finding and next action.

See Farron in action Plan an introduction

From contract to control.

Responsibility stays, even when IT moves outside.

Cyber risk and regulatory pressure are rising together.

Cyber risk is increasing

Regulatory and compliance pressure is increasing

Control over contracts.

Scope

Trace

Resolve

Govern

See what the contract gives you control over.

Built by experts in the field.

Bring one contract question.

What do you want to understand?