Netherlands Baseline Information Security for Government 2 (BIO2) P1-11.1a: Mandatory application of the BIO under the Cybersecurity Act and board responsibilities

What does P1-11.1a require?

Under the Cybersecurity Act the BIO is obligatory for securing the network and information systems of every entity in the Government sector; entities outside the Act apply it as obligatory self-regulation under an OBDO (Government-wide Digital Policy Board) decision, as do all government entities for measures excepted from the Act and for information security beyond network and information systems, such as paper. The board answers for taking technical, operational and organisational measures, appropriate and proportionate, that manage the entity's risks, for approving cybersecurity risk management measures and for monitoring the quality of their implementation and management; section 24(12) of the Act defines which board members this means for the Government sector, and the board is advised by a CISO, CIO, DPO and similar roles. One board member oversees how information security is applied across the entity, and an internal supervisor can assist.