BBN

What is BBN?

BBN (basisbeveiligingsniveau, or baseline security level) is the three-tier classification, BBN1, BBN2 and BBN3, that the original Dutch BIO (Baseline Informatiebeveiliging Overheid) used to decide, per business process or information system, which controls and mandatory government measures a Dutch public-sector organisation had to implement. The idea was proportionality: the greater the interest at stake and the more serious the threat, the more measures and the stricter the accountability. The BBN scheme belonged to BIO 1.04, which took effect on 1 January 2020. BIO2, adopted on 23 September 2025, dropped the three levels in favour of an explicitly risk-based approach.

🧠 What did BBN1, BBN2 and BBN3 mean?

Each level consisted of a set of ISO 27002 controls, a set of mandatory government measures and an accountability and oversight regime. Each level built on the previous one: BBN2 added to the controls and measures of BBN1 or replaced them with stronger variants, and BBN3 did the same relative to BBN2. The controls were taken unchanged from ISO 27002:2013: the BIO adopted all of them except two, 6.1.4 (contact with special interest groups) and 14.2.4 (restrictions on changes to software packages).

The key point to remember: BBN2 was the default level, not a middle category. The BIO explicitly called BBN2 the starting point for government information systems, because confidential and privacy-sensitive data is common in government. BBN2 applied as soon as a system processed confidential information, an incident could cause political or administrative turmoil, or the security of other systems depended on that of the system itself. This also covered commercially confidential information and information used in policy-making, not just classified documents. BBN1 was the exception for systems where BBN2 was too heavy, and BBN3 the exception for systems needing protection against state actors. For BBN3 the BIO aligned with the Dutch central government regulation for classified information (VIR-BI) and, because they are more detailed than the EU rules, with the NATO security regulations (CM(2002)49) as far as relevant to NATO Restricted; the additional BBN3 requirements were not yet fully worked out in BIO 1.04 itself.

🔧 How did you determine the right BBN level?

The process owner (line management) chose the BBN per business process using the BBN test in part 2 of the BIO. The test was designed to select the right level quickly and was explicitly not a substitute for the Quickscan BIO or a full risk assessment. It had three steps, with BBN2 as the starting point:

1. Is BBN2 sufficient? No if the information had to be protected against state actors or comparable threat actors, if a third party required BBN3 for the information it supplied, or if connection to a BBN3 infrastructure was needed. In those cases BBN3 or higher applied.
2. Is BBN2 too heavy? BBN2 was needed if unwanted disclosure could cause so-called BBN2 damage. If no such damage was plausible, BBN1 was enough.
3. Are extra availability or integrity requirements needed? A BBN1 system whose outage or corrupted data could still cause BBN2 damage could adopt the BBN2 measures for availability and integrity, with accountability and oversight under the BBN2 regime. For BBN2 or BBN3 systems facing even greater damage, an explicit risk assessment determined stronger measures, with accountability and oversight under the BBN3 regime.

The BIO gave these examples of BBN2 damage:

• Direct reputational damage - for example through negative publicity
• Political damage - an administrator has to answer to the elected oversight bodies
• Diplomatic damage - recoverable by escalation at civil-service level
• Financial consequences - no longer absorbable within the organisation’s budget, or no unqualified auditor’s opinion
• Loss of public respect - complaints from citizens or a significant drop in staff motivation
• Privacy breach - a binding instruction from the Dutch Data Protection Authority under the AVG (the Dutch name for the GDPR)

Step 1 is therefore about confidentiality and threat; step 3 corrects for the other two sides of the CIA triad. A system that mainly has to stay available does not automatically become BBN3.

🔐 Who was responsible at each level?

The BBN determined not only the measures but also where responsibility for risk management sat:

For BBN1 and BBN2, organisations could deviate from this split in their information security policy. For information classified as Departementaal Vertrouwelijk, the BBN3 accountability regime always applied.

🏭 How did BBN work out for a municipality or water board?

Some illustrative classifications at a Dutch municipality under BIO 1.04:

• Public website with news items - no confidential information and limited damage from a leak: BBN1, possibly with extra integrity measures against defacement
• Citizen portal with DigiD login and personal data - privacy-sensitive data and a risk of action by the regulator: BBN2
• System for classified information facing a state threat - BBN3, rare in practice outside central government

For OT the scheme worked less well. A sewage pumping station or movable bridge controlled through SCADA processes hardly any confidential information, but an outage or manipulation can cause flooding or injury. Under the BBN test such an installation ended up at BBN1 or BBN2, with extra availability and integrity requirements from step 3. That is why Rijkswaterstaat and Het Waterschapshuis developed the CSIR, which classifies objects not by BBN but through a business impact analysis into function boxes A to E and resistance levels 1 to 4, linked to the security levels of IEC 62443. See also Water Sector OT Security.

🔄 What changed for BBN in BIO2?

The practical effect of dropping the levels is that an organisation can no longer simply adopt the standard package for its level, but has to justify for itself which threats and risks apply to each process or system. BIO2 puts the emphasis on an ISMS according to ISO 27001 with a genuine risk assessment, while the mandatory government measures guard the floor. This also aligns BIO2 with the duty of care under NIS2.

🧭 What should you do with existing BBN documentation?

Many organisations still have system files, risk assessments and contract requirements that state a BBN. A practical approach when moving to BIO2:

1. Take stock - search system files, procurement terms and supplier contracts for references to BBN1, BBN2 or BBN3.
2. Reuse the analysis - the reasoning behind a BBN (confidentiality, potential damage, chain dependencies) is valuable input for the BIO2 quickscan.
3. Run the quickscan - determine per process or system whether the government measures are sufficient or a full risk assessment is needed.
4. Record it in the ISMS - include the outcomes in the statement of applicability and the risk register of your information security management system.
5. Update contracts - replace “supplier complies with BBN2” with concrete requirements or a reference to the relevant BIO2 measures.

❓ Frequently asked questions

What does the abbreviation BBN stand for?

BBN stands for basisbeveiligingsniveau, Dutch for baseline security level. The term comes from version 1.04 of the Dutch Baseline Informatiebeveiliging Overheid (BIO), which had three levels: BBN1, BBN2 and BBN3. Each baseline security level linked a set of controls and government measures to the importance of the information.

Which BBN level was the default?

BBN2 was the default BIO level for government information systems. The BBN test always started at BBN2 and then checked whether a lower or higher level fitted better. Systems holding personal data or confidential policy information almost always ended up at BBN2.

Do the BBN levels still exist?

No, the BBN levels were dropped with BIO2. BIO2 was adopted on 23 September 2025 and uses a quickscan and, where needed, a full risk assessment instead of fixed levels. The BBN scheme now only appears in older documentation and contracts.

What is the difference between BBN2 and BBN3?

BBN2 protects information up to Departementaal Vertrouwelijk preventively against all threats except advanced attacks by state actors or professional criminals, which only need to be detected and responded to. BBN3 had to resist those APTs and therefore aligned with the VIR-BI and NATO rules. BBN3 also required prior permission from the most senior civil-service management.

Was BBN suitable for operational technology?

BBN was only of limited use for operational technology, because the scheme was built mainly around the confidentiality of information. For pumping stations, locks and bridges the priorities are availability, integrity and safety. Dutch government bodies therefore use the CSIR for OT, with function boxes and resistance levels linked to IEC 62443.

Is BBN the same as an IEC 62443 security level?

No, BBN and the IEC 62443 security levels measure different things. A BBN set the security level of an information system within the BIO based on confidentiality and threat, whereas an IEC 62443 security level describes the resistance of a zone or component against attackers with increasing means and skills. There is no direct conversion between the two.

📌 In summary

BBN (basisbeveiligingsniveau) was the BBN1, BBN2 and BBN3 split in BIO 1.04 that Dutch government bodies used to match their measures and accountability per process or system to the interest at stake and the threat, with BBN2 as the default. With BIO2 and the Cyberbeveiligingswet, the fixed levels have been replaced by a risk-based approach with mandatory government measures as the floor; for OT, government bodies use the CSIR and IEC 62443, within an overall security programme.