What does P1-13 require?

An entity remains responsible for the risks of outsourced or procured services and products. Depending on the risk, the obligations government takes on through the BIO or other guidelines must be built into the purchasing requirements imposed on suppliers.

Netherlands Baseline Information Security for Government...

Other controls in Part 1: BIO2 framework (obligations, management system, risk management, governance) – Netherlands Baseline Information Security for Government 2 (BIO2)

P1-11.1a Mandatory application of the BIO under the Cybersecurity Act and board responsibilities
P1-11.1b Board and staff training and notification of significant incidents
P1-12.2 Line management owns information systems and applies the measures
P1-12.3 CISO role
P1-16 Determine additional measures by type of information
P1-17 Assess incident impact across the required impact areas
P1-4a Establish an ISMS to NEN-EN-ISO/IEC 27001 that covers at least the critical processes and systems
P1-4b Select controls from NEN-EN-ISO/IEC 27002 plus the mandatory government measures

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Netherlands Baseline Information Security for Government 2 (BIO2) controls