Netherlands Baseline Information Security for Government 2 (BIO2)

Part 2, clause 5: Organisational government measures – Netherlands Baseline Information Security for Government 2 (BIO2)

Netherlands Baseline Information Security for Government 2 (BIO2) 5.20.06: Pre-contract dependency assessment and a detailed exit strategy

What does 5.20.06 require?

A risk assessment made before the contract is signed determines whether the dependency on the particular supplier is manageable, and an explicit and detailed exit strategy is a standard component of the contract.

Maintained by Gerard Blokdyk

Other controls in Part 2, clause 5: Organisational government measures – Netherlands Baseline Information Security for Government 2 (BIO2)

5.01.01 Board-adopted information security policy with the required content
5.01.02 Annual policy review aligned with governance cycles
5.02.01 Board-defined roles and responsibilities across security, privacy, OT and BCM
5.02.02 Appoint a CISO authorised to advise and report independently
5.04.01 Regular cyber awareness courses for board and staff, and demonstrable board competence
5.05.01 Register of officials holding formal contacts with agencies and regulators
5.08.01 Explicit risk assessment for new systems and significant changes
5.09.01 Complete and verified asset inventory including OT, remote and cloud assets

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Netherlands Baseline Information Security for Government 2 (BIO2) controls