What does P1-16 require?

Each entity determines the types of information it processes and the extra security measures those types require, considering at least open data, personally identifiable information including special categories, sensitive or internal information, and classified information.

Netherlands Baseline Information Security for Government...

Other controls in Part 1: BIO2 framework (obligations, management system, risk management, governance) – Netherlands Baseline Information Security for Government 2 (BIO2)

P1-11.1a Mandatory application of the BIO under the Cybersecurity Act and board responsibilities
P1-11.1b Board and staff training and notification of significant incidents
P1-12.2 Line management owns information systems and applies the measures
P1-12.3 CISO role
P1-13 Pass BIO obligations to suppliers in purchase requirements
P1-17 Assess incident impact across the required impact areas
P1-4a Establish an ISMS to NEN-EN-ISO/IEC 27001 that covers at least the critical processes and systems
P1-4b Select controls from NEN-EN-ISO/IEC 27002 plus the mandatory government measures

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Netherlands Baseline Information Security for Government 2 (BIO2) controls