Netherlands Baseline Information Security for Government 2 (BIO2) 5.01.01: Board-adopted information security policy with the required content

What does 5.01.01 require?

The entity has an information security policy adopted by its administration, containing at least: the strategic principles and preconditions it applies for information security, in particular how it integrates and aligns with the overall security policy and with the information management policy; how the information security function is organised, with its responsibilities, tasks and authorities; how responsibilities and interrelationships for information security across chains of information systems, for OT security, for privacy protection and for continuity of task execution (BCM) are allocated to line managers; the shared reliability requirements and the standards that apply; the frequency of policy evaluation; and the promotion of security awareness.