Netherlands Baseline Information Security for Government...

What does P1-11.1b require?

Board members are trained and have the knowledge to steer on information security risks and ensure their employees are regularly trained, with training meeting the requirements of the Cybersecurity Act. Reporting significant incidents in good time is the entity's responsibility, and it reports notifiable incidents within the applicable time limits. The RDI, the Dutch Authority for Digital Infrastructure, supervises compliance with the duty of care for the Government sector.

Other controls in Part 1: BIO2 framework (obligations, management system, risk management, governance) – Netherlands Baseline Information Security for Government 2 (BIO2)

P1-11.1a Mandatory application of the BIO under the Cybersecurity Act and board responsibilities
P1-12.2 Line management owns information systems and applies the measures
P1-12.3 CISO role
P1-13 Pass BIO obligations to suppliers in purchase requirements
P1-16 Determine additional measures by type of information
P1-17 Assess incident impact across the required impact areas
P1-4a Establish an ISMS to NEN-EN-ISO/IEC 27001 that covers at least the critical processes and systems
P1-4b Select controls from NEN-EN-ISO/IEC 27002 plus the mandatory government measures

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Netherlands Baseline Information Security for Government 2 (BIO2) controls