Back to Frameworks
Netherlands Baseline Information Security for Government 2 (BIO2)
Netherlands
vBIO2 version 1.3 final, 9 January 2026 (English translation; Dutch text binding)
5 domains
132 controls
The Netherlands' mandatory government information security baseline: an ISO/IEC 27001-based management system, risk and accountability duties under the Cybersecurity Act, supplier requirements, and 117 government measures that set the obligatory minimum implementation of the ISO/IEC 27002:2022 controls for public bodies.
Verified
Netherlands Baseline Information Security for Government 2 (BIO2) is a compliance framework from Netherlands with 5 domains and 132 controls. The largest domains are Part 2, clause 5: Organisational government measures – Netherlands Baseline Information Security for Government 2 (BIO2) (54 controls), Part 2, clause 8: Technological government measures – Netherlands Baseline Information Security for Government 2 (BIO2) (50 controls), Part 1: BIO2 framework (obligations, management system, risk management, governance) – Netherlands Baseline Information Security for Government 2 (BIO2) (15 controls). Every control below carries what it requires and what an assessor expects to see.
Maintained by Gerard Blokdyk
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (5)
Part 1: BIO2 framework (obligations, management system, risk management, governance) – Netherlands Baseline Information Security for Government 2 (BIO2)
15 controls
| Code | Title |
|---|---|
| netherlands-baseline-information-security-for-government-2-bio2::P1-11.1a | Mandatory application of the BIO under the Cybersecurity Act and board responsibilities |
| netherlands-baseline-information-security-for-government-2-bio2::P1-11.1b | Board and staff training and notification of significant incidents |
| netherlands-baseline-information-security-for-government-2-bio2::P1-12.2 | Line management owns information systems and applies the measures |
| netherlands-baseline-information-security-for-government-2-bio2::P1-12.3 | CISO role |
| netherlands-baseline-information-security-for-government-2-bio2::P1-13 | Pass BIO obligations to suppliers in purchase requirements |
| netherlands-baseline-information-security-for-government-2-bio2::P1-16 | Determine additional measures by type of information |
| netherlands-baseline-information-security-for-government-2-bio2::P1-17 | Assess incident impact across the required impact areas |
| netherlands-baseline-information-security-for-government-2-bio2::P1-4a | Establish an ISMS to NEN-EN-ISO/IEC 27001 that covers at least the critical processes and systems |
| netherlands-baseline-information-security-for-government-2-bio2::P1-4b | Select controls from NEN-EN-ISO/IEC 27002 plus the mandatory government measures |
| netherlands-baseline-information-security-for-government-2-bio2::P1-4c | Operationalise the measures and prove their setup, existence and operation |
| netherlands-baseline-information-security-for-government-2-bio2::P1-6.2 | Apply a risk management methodology with the required components |
| netherlands-baseline-information-security-for-government-2-bio2::P1-6.3-6.5 | Identify, analyse and treat risks, with government measures always mandatory |
| netherlands-baseline-information-security-for-government-2-bio2::P1-7 | Statement of Applicability with BIO measures and an exceptions annex |
| netherlands-baseline-information-security-for-government-2-bio2::P1-8 | Monitor and continually improve the management system |
| netherlands-baseline-information-security-for-government-2-bio2::P1-9 | Transparency and accountability on information security |
Part 2, clause 5: Organisational government measures – Netherlands Baseline Information Security for Government 2 (BIO2)
54 controls
| Code | Title |
|---|---|
| netherlands-baseline-information-security-for-government-2-bio2::5.01.01 | Board-adopted information security policy with the required content |
| netherlands-baseline-information-security-for-government-2-bio2::5.01.02 | Annual policy review aligned with governance cycles |
| netherlands-baseline-information-security-for-government-2-bio2::5.02.01 | Board-defined roles and responsibilities across security, privacy, OT and BCM |
| netherlands-baseline-information-security-for-government-2-bio2::5.02.02 | Appoint a CISO authorised to advise and report independently |
| netherlands-baseline-information-security-for-government-2-bio2::5.04.01 | Regular cyber awareness courses for board and staff, and demonstrable board competence |
| netherlands-baseline-information-security-for-government-2-bio2::5.05.01 | Register of officials holding formal contacts with agencies and regulators |
| netherlands-baseline-information-security-for-government-2-bio2::5.08.01 | Explicit risk assessment for new systems and significant changes |
| netherlands-baseline-information-security-for-government-2-bio2::5.09.01 | Complete and verified asset inventory including OT, remote and cloud assets |
| netherlands-baseline-information-security-for-government-2-bio2::5.10.02 | Rules of conduct for asset use in contracts of external staff and volunteers |
| netherlands-baseline-information-security-for-government-2-bio2::5.10.03 | All employees formally made aware of the code of conduct for asset use |
| netherlands-baseline-information-security-for-government-2-bio2::5.12.01 | Classify information in all systems with an explicit risk assessment and impact methodology |
| netherlands-baseline-information-security-for-government-2-bio2::5.14.01 | Internet-facing systems and email comply with the mandatory open standards, monitored via internet.nl |
| netherlands-baseline-information-security-for-government-2-bio2::5.14.02 | Organisation Validated certificates for sensitive web traffic |
| netherlands-baseline-information-security-for-government-2-bio2::5.14.03 | Electronic signatures conform to the AdES baseline profiles |
| netherlands-baseline-information-security-for-government-2-bio2::5.14.04 | Up-to-date records of internet-facing systems, web applications, IP addresses and APIs |
| netherlands-baseline-information-security-for-government-2-bio2::5.14.05 | Publish public websites in the Government Register of Internet Domains, refreshed every six months |
| netherlands-baseline-information-security-for-government-2-bio2::5.15.01 | Access to a trusted zone only from authenticated devices or a secure enclave |
| netherlands-baseline-information-security-for-government-2-bio2::5.16.01 | Formal registration and de-registration procedure for user identities |
| netherlands-baseline-information-security-for-government-2-bio2::5.16.02 | Group accounts only when motivated, recorded and agreed with the CISO |
| netherlands-baseline-information-security-for-government-2-bio2::5.17.01 | Multi-factor authentication, mitigations where it is impossible, and authentication data management |
| netherlands-baseline-information-security-for-government-2-bio2::5.17.02 | Password manager available to all employees |
| netherlands-baseline-information-security-for-government-2-bio2::5.17.03 | Automated enforcement of password requirements |
| netherlands-baseline-information-security-for-government-2-bio2::5.18.01 | Monitor creation and modification of privileged accounts; unauthorised changes are incidents |
| netherlands-baseline-information-security-for-government-2-bio2::5.18.02 | Annual review of all access rights, with risk-based higher frequency |
| netherlands-baseline-information-security-for-government-2-bio2::5.19.01 | Risk-based information security requirements in every request for proposal |
| netherlands-baseline-information-security-for-government-2-bio2::5.20.01 | Security requirements written into procurement contracts |
| netherlands-baseline-information-security-for-government-2-bio2::5.20.02 | Exclude suppliers' general terms and define acceptable, mitigated and never-accepted consequences |
| netherlands-baseline-information-security-for-government-2-bio2::5.20.03 | Supplier demonstrates setup, existence and operation annually through independent assessment |
| netherlands-baseline-information-security-for-government-2-bio2::5.20.04 | Entity's own investigations, including the option of an external audit, and treatment of residual risk |
| netherlands-baseline-information-security-for-government-2-bio2::5.20.05 | Supplier transparency on vulnerabilities and incidents, including data leaks |
| netherlands-baseline-information-security-for-government-2-bio2::5.20.06 | Pre-contract dependency assessment and a detailed exit strategy |
| netherlands-baseline-information-security-for-government-2-bio2::5.21.02 | Supplier discloses its subcontractor chain and risks before contracting |
| netherlands-baseline-information-security-for-government-2-bio2::5.21.03 | Security requirements flow down the subcontractor chain, exclusions justified |
| netherlands-baseline-information-security-for-government-2-bio2::5.21.04 | Supplier reports changes in the subcontractor chain and their risks during the contract |
| netherlands-baseline-information-security-for-government-2-bio2::5.21.05 | Include supply chain security in the entity's risk analysis |
| netherlands-baseline-information-security-for-government-2-bio2::5.22.01 | Process owner reviews supplier compliance annually and treats the risks |
| netherlands-baseline-information-security-for-government-2-bio2::5.22.02 | Up-to-date register of suppliers and contracts |
| netherlands-baseline-information-security-for-government-2-bio2::5.23.01 | Cloud service provider policy covering inventory to termination, reviewed every three years |
| netherlands-baseline-information-security-for-government-2-bio2::5.24.01 | Low-threshold notification desk for all internal and external staff |
| netherlands-baseline-information-security-for-government-2-bio2::5.24.02 | Notification desk tasks and responsibilities in an incident reporting procedure |
| netherlands-baseline-information-security-for-government-2-bio2::5.24.03 | Process owner responsible for resolving incidents |
| netherlands-baseline-information-security-for-government-2-bio2::5.24.04 | Monthly incident follow-up report to the person ultimately responsible for operations |
| netherlands-baseline-information-security-for-government-2-bio2::5.24.05 | Incident procedure references the crisis management procedure |
| netherlands-baseline-information-security-for-government-2-bio2::5.24.07 | Incident procedure: statutory CSIRT reporting, CSIRT notifications and notifying PII principals |
| netherlands-baseline-information-security-for-government-2-bio2::5.24.08 | Coordinated Vulnerability Disclosure procedure, published, with reports feeding incident records |
| netherlands-baseline-information-security-for-government-2-bio2::5.26.02 | Handle incidents through the incident management process, with regulatory reporting built in |
| netherlands-baseline-information-security-for-government-2-bio2::5.27.01 | Root cause analysis and improvements after incidents |
| netherlands-baseline-information-security-for-government-2-bio2::5.27.02 | Share incident analysis reports widely among relevant partners |
| netherlands-baseline-information-security-for-government-2-bio2::5.28.01 | Retain incident information for at least three years |
| netherlands-baseline-information-security-for-government-2-bio2::5.30.01 | Annual test of continuity plans by the process owner |
| netherlands-baseline-information-security-for-government-2-bio2::5.30.02 | Identify critical systems in the asset inventory and update at least every three years |
| netherlands-baseline-information-security-for-government-2-bio2::5.33.01 | Retention periods set in selection lists, implemented and tested |
| netherlands-baseline-information-security-for-government-2-bio2::5.35.02 | Annual audit plan deciding which systems get which security audit |
| netherlands-baseline-information-security-for-government-2-bio2::5.36.01 | Information security reporting in the P&C cycle leading to an annual In Control Statement |
Part 2, clause 6: People government measures – Netherlands Baseline Information Security for Government 2 (BIO2)
7 controls
| Code | Title |
|---|---|
| netherlands-baseline-information-security-for-government-2-bio2::6.01.01 | Established screening policy, with Certificate of Conduct on a risk basis |
| netherlands-baseline-information-security-for-government-2-bio2::6.02.01 | Staff made aware of their security responsibilities on joining or changing roles, with easy access to the rules |
| netherlands-baseline-information-security-for-government-2-bio2::6.03.01 | Everyone shares responsibility and knows the rules, including for classified environments |
| netherlands-baseline-information-security-for-government-2-bio2::6.03.02 | Security awareness training completed within three months of appointment |
| netherlands-baseline-information-security-for-government-2-bio2::6.03.03 | Management promotes and encourages periodic security training |
| netherlands-baseline-information-security-for-government-2-bio2::6.03.04 | Secure mobile working behaviour in awareness programmes |
| netherlands-baseline-information-security-for-government-2-bio2::6.08.01 | All staff demonstrably informed of the incident notification procedure |
Part 2, clause 7: Physical government measures – Netherlands Baseline Information Security for Government 2 (BIO2)
6 controls
| Code | Title |
|---|---|
| netherlands-baseline-information-security-for-government-2-bio2::7.01.02 | Critical information never reachable through a single secure zone |
| netherlands-baseline-information-security-for-government-2-bio2::7.02.01 | Warnings on specific security risks shared within the government security domain |
| netherlands-baseline-information-security-for-government-2-bio2::7.07.01 | Automatic lock on removal of a chip card token |
| netherlands-baseline-information-security-for-government-2-bio2::7.10.01 | Removal instruction for reusable media leaving the entity |
| netherlands-baseline-information-security-for-government-2-bio2::7.10.02 | Verify and report irretrievable removal, using NBV-advised products where possible |
| netherlands-baseline-information-security-for-government-2-bio2::7.10.03 | Couriers for classified information meet predefined reliability requirements |
Part 2, clause 8: Technological government measures – Netherlands Baseline Information Security for Government 2 (BIO2)
50 controls
| Code | Title |
|---|---|
| netherlands-baseline-information-security-for-government-2-bio2::8.01.01 | Zero footprint on mobile devices, or encryption-based access control with remote wipe |
| netherlands-baseline-information-security-for-government-2-bio2::8.01.02 | Patching and hardening, MDM or MAM, signed mobile working agreement, checked periodically |
| netherlands-baseline-information-security-for-government-2-bio2::8.02.01 | Quarterly assessment of special privileges |
| netherlands-baseline-information-security-for-government-2-bio2::8.03.01 | Physical or logical isolation of information of specific importance |
| netherlands-baseline-information-security-for-government-2-bio2::8.03.02 | Need-to-know access to information of specific importance |
| netherlands-baseline-information-security-for-government-2-bio2::8.05.01 | Risk assessment before granting network access to external suppliers, with a rights register |
| netherlands-baseline-information-security-for-government-2-bio2::8.07.01 | Risk- and need-based restriction of downloads, always scanned |
| netherlands-baseline-information-security-for-government-2-bio2::8.07.02 | Users informed about risky browsing and unknown links |
| netherlands-baseline-information-security-for-government-2-bio2::8.07.03 | Anti-malware and recovery software kept up to date |
| netherlands-baseline-information-security-for-government-2-bio2::8.07.04 | Malware scanning across all environments, downloads and received files |
| netherlands-baseline-information-security-for-government-2-bio2::8.08.01 | Mitigate high-likelihood, high-damage vulnerabilities within a week |
| netherlands-baseline-information-security-for-government-2-bio2::8.08.02 | Mitigation approach based on an explicit risk assessment |
| netherlands-baseline-information-security-for-government-2-bio2::8.08.03 | Interim mitigations where installation cannot happen within a week |
| netherlands-baseline-information-security-for-government-2-bio2::8.08.04 | Technical compliance checks, with continuous testing of internet-facing systems |
| netherlands-baseline-information-security-for-government-2-bio2::8.08.05 | Automated penetration test at every release of internet-facing systems; annual test; no go-live with unmitigated high risks |
| netherlands-baseline-information-security-for-government-2-bio2::8.13.01 | Backup policy with storage and protection requirements, ransomware-resistant and integrity-preserving |
| netherlands-baseline-information-security-for-government-2-bio2::8.13.02 | Maximum data loss and recovery time set by explicit risk assessment |
| netherlands-baseline-information-security-for-government-2-bio2::8.13.03 | Location-separated backup storage |
| netherlands-baseline-information-security-for-government-2-bio2::8.13.04 | Annual recovery test, or after a big change |
| netherlands-baseline-information-security-for-government-2-bio2::8.15.01 | Minimum content of a log entry |
| netherlands-baseline-information-security-for-government-2-bio2::8.15.02 | Log entries never contain data that could cause a security breach |
| netherlands-baseline-information-security-for-government-2-bio2::8.15.03 | List of generated log files |
| netherlands-baseline-information-security-for-government-2-bio2::8.15.04 | Risk-based retention of logs and SIEM data allowing for long-undetected attackers |
| netherlands-baseline-information-security-for-government-2-bio2::8.15.05 | Improper modification or deletion of log data is an incident |
| netherlands-baseline-information-security-for-government-2-bio2::8.15.06 | Independent periodic verification that log files remain unchanged |
| netherlands-baseline-information-security-for-government-2-bio2::8.16.01 | Share newly discovered attacks with the designated CERT |
| netherlands-baseline-information-security-for-government-2-bio2::8.16.02 | SIEM and SOC rules on when to report incidents to responsible managers |
| netherlands-baseline-information-security-for-government-2-bio2::8.16.03 | Detection and response solution for the information processing environment |
| netherlands-baseline-information-security-for-government-2-bio2::8.16.04 | Logging and log monitoring on active network components |
| netherlands-baseline-information-security-for-government-2-bio2::8.18.01 | System utilities restricted to authorised staff when strictly necessary |
| netherlands-baseline-information-security-for-government-2-bio2::8.18.02 | Log use of system utilities and keep the logs six months |
| netherlands-baseline-information-security-for-government-2-bio2::8.19.01 | Control the risk of users installing unauthorised software |
| netherlands-baseline-information-security-for-government-2-bio2::8.20.01 | Network components meet the confidentiality level of their network |
| netherlands-baseline-information-security-for-government-2-bio2::8.20.02 | Management interfaces separated from the user network |
| netherlands-baseline-information-security-for-government-2-bio2::8.21.01 | Flag and mitigate availability attacks at connection points with external or untrusted zones |
| netherlands-baseline-information-security-for-government-2-bio2::8.21.02 | Detection tools monitoring traffic to and from the trusted environment |
| netherlands-baseline-information-security-for-government-2-bio2::8.21.03 | Share newly identified threats within government |
| netherlands-baseline-information-security-for-government-2-bio2::8.21.04 | Encrypt wireless and external wired transmissions, risk-based, with NBV-advised tools where possible |
| netherlands-baseline-information-security-for-government-2-bio2::8.22.01 | Each segregated network group has its own security level |
| netherlands-baseline-information-security-for-government-2-bio2::8.24.01 | Cryptography policy with the required topics |
| netherlands-baseline-information-security-for-government-2-bio2::8.24.02 | Cryptographic controls in the asset inventory with use, ownership and currency |
| netherlands-baseline-information-security-for-government-2-bio2::8.24.04 | Cryptographic strength per NCSC and AIVD Resilience Unit recommendations |
| netherlands-baseline-information-security-for-government-2-bio2::8.24.05 | Backup certificates from an alternative supplier where continuity risk requires |
| netherlands-baseline-information-security-for-government-2-bio2::8.27.01 | Security by design and by default principles adopted and applied in all development |
| netherlands-baseline-information-security-for-government-2-bio2::8.29.01 | Structured, automated-where-possible acceptance testing with reported results |
| netherlands-baseline-information-security-for-government-2-bio2::8.30.01 | Internal development measures apply fully to outsourced development, plus outsourcing measures |
| netherlands-baseline-information-security-for-government-2-bio2::8.31.01 | No testing in production without the process owner's prior approval |
| netherlands-baseline-information-security-for-government-2-bio2::8.31.02 | Significant production changes always tested first unless the process owner approves otherwise |
| netherlands-baseline-information-security-for-government-2-bio2::8.32.01 | Change management covering administration, risk assessment with roll-back plan, and approval |
| netherlands-baseline-information-security-for-government-2-bio2::8.32.02 | Change management based on a generally accepted framework |
What is Netherlands Baseline Information Security for Government 2 (BIO2) and who does it apply to?
Netherlands Baseline Information Security for Government 2 (BIO2) is a compliance framework from Netherlands with 5 domains and 132 controls. The Netherlands' mandatory government information security baseline: an ISO/IEC 27001-based management system, risk and accountability duties under the Cybersecurity Act, supplier requirements, and 117 government measures that set the obligatory minimum implementation of the ISO/IEC 27002:2022 controls for public bodies. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Netherlands Baseline Information Security for Government 2 (BIO2) actually require?
Netherlands Baseline Information Security for Government 2 (BIO2) has 132 controls organised across 5 domains. The largest domains are Part 2, clause 5: Organisational government measures – Netherlands Baseline Information Security for Government 2 (BIO2) (54 controls), Part 2, clause 8: Technological government measures – Netherlands Baseline Information Security for Government 2 (BIO2) (50 controls), Part 1: BIO2 framework (obligations, management system, risk management, governance) – Netherlands Baseline Information Security for Government 2 (BIO2) (15 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Netherlands Baseline Information Security for Government 2 (BIO2) do I already cover?
Netherlands Baseline Information Security for Government 2 (BIO2) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement Netherlands Baseline Information Security for Government 2 (BIO2)?
Start your Netherlands Baseline Information Security for Government 2 (BIO2) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Netherlands Baseline Information Security for Government 2 (BIO2) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 132 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,111 frameworks.
Get Started Free →Free forever, no credit card required