Netherlands Baseline Information Security for Government 2 (BIO2) P1-4a: Establish an ISMS to NEN-EN-ISO/IEC 27001 that covers at least the critical processes and systems

What does P1-4a require?

NEN-EN-ISO/IEC 27001 is the standard the entity shall apply when it formulates the requirements for setting up, implementing, maintaining and continually improving its information security management system and when it sets that system's scope; the management system must comply with that standard. When the entity determines its context, the business processes and the information systems on which its services critically depend are, at a minimum, brought into the design, the implementation, the maintenance and the continual improvement of the management system, and it decides how far supporting processes are included; where authorities share equivalent processes, using the umbrella organisation's support offer is recommended.