BIO

What is the BIO?

The BIO (Baseline Informatiebeveiliging Overheid, or Baseline Information Security for Government) is the common information security framework of the Dutch government, which supplements the international standards ISO 27001 and ISO 27002 with mandatory government measures for central government, provinces, municipalities and water boards. The current version, BIO2, was adopted on 23 September 2025 and, since the Dutch Cyberbeveiligingswet (Cbw) entered into force on 15 August 2026, has been a legal requirement for the government bodies within its scope. The BIO covers not only office systems and IT but explicitly also OT: pumping stations, locks, treatment plants and other installations that government bodies operate themselves.

🎯 What is the purpose of the BIO?

• One common baseline - every tier of government protects information at a comparable level, so chain partners can trust each other when exchanging data
• One shared language - municipalities, provinces, water boards and ministries use the same terms and measure numbers
• Risk-driven security - measures follow from a risk analysis within an ISMS, not from a fixed checklist
• Transparency - citizens, supervisors and chain partners can see how a government body has organised its information security
• Compliance with legislation - including the AVG (the Dutch name for the GDPR), the Police Data Act (Wpg) for municipal enforcement officers, and the NIS2 duty of care through the Cbw

🕰️ How has the BIO evolved?

Before 2020, each tier of government had its own baseline. The BIO replaced them with a single framework, and BIO2 aligned it with the latest ISO standards and NIS2.

The OBDO is the government-wide policy council for digital government. The Ministry of the Interior and Kingdom Relations (BZK) is responsible for the system as a whole, and the BIO is maintained by the Centre for Information Security and Privacy Protection (CIP).

🛠️ How is BIO2 structured?

BIO2 has two parts:

• Part 1, the BIO2 framework - structured according to ISO 27001:2023. It covers the ISMS, the risk management process, governance, suppliers, information security principles and the relationship with the Cbw.
• Part 2, the government measures - linked to the 93 controls of ISO 27002:2022 (37 organisational, 8 people, 14 physical, 34 technological). Number 5.01.01, for example, refers to control 5.1 (information security policy), followed by a sequence number.

Key rules in BIO2:

• Government measures are always mandatory - they are the minimum implementation of a control and cannot be dropped through risk acceptance, unless they demonstrably do not apply
• Statement of Applicability (SoA) - must include all government measures; deviations go into an annex of exceptions that references the risk analysis
• Publication duty - the scope of the ISMS and the SoA are made public
• Design, existence and operating effectiveness - demonstrated through self-assessments, audits, penetration tests or red team exercises
• No certification requirement - an ISO 27001 certificate is not mandatory, but it makes accountability easier

🔄 What is the difference between BIO 1.04 and BIO2?

Under BIO 1.04, BBN1 was the minimum for every system, BBN2 applied to information up to Departementaal Vertrouwelijk (department confidential) and privacy-sensitive data, protecting against everything except advanced threats, and BBN3 was intended for information that has to withstand state actors and advanced persistent threats (APTs). BIO2 replaces this with a quick scan per process or system, followed by a full risk analysis where the baseline is not sufficient.

🧱 Who does the BIO apply to?

The BIO applies to every tier of government:

• Central government - ministries, their services and agencies
• Provinces - the twelve provinces
• Municipalities - including tasks such as civil affairs, social services and municipal infrastructure
• Water boards - the 21 water boards, which run extensive OT for water level management and wastewater treatment

Under the Cbw, these government bodies are designated essential entities regardless of their size. Independent administrative bodies (zbo’s) at central government level and joint arrangements are only in scope if they meet four criteria for public administration entities. Defence, the intelligence services, the Public Prosecution Service, the police and the safety regions are exempt from the Cbw, but must strive for an equivalent level of resilience. The judiciary, both houses of parliament and De Nederlandsche Bank also fall outside the act. For government bodies outside the Cbw, the BIO remains mandatory self-regulation.

🔐 What obligations does the Cbw bring for government bodies?

BIO2 is how government bodies fulfil the Cbw duty of care. On top of that, the Cbw obligations themselves apply:

• Board accountability - the executive approves the cyber risk management measures and oversees their implementation
• Training - executives undergo training to assess cyber risks and make sure staff are trained regularly (security awareness)
• Incident reporting - significant incidents are reported within the NIS2 deadlines: an early warning within 24 hours, a notification within 72 hours and a final report within one month
• Registration - entities register with the NCSC
• Supervision - the Dutch Authority for Digital Infrastructure (RDI) supervises ministries, provinces, municipalities, independent administrative bodies and joint arrangements on behalf of BZK; for water boards, the Human Environment and Transport Inspectorate (ILT) is the supervisor

Roles within the organisation are defined too: the executive carries ultimate responsibility, line management owns the information systems and applies the measures, and the CISO coordinates, gives solicited and unsolicited advice and reports to the board.

🏭 How do you apply the BIO to OT at water boards and municipalities?

Water boards operate pumping stations, weirs, locks and wastewater treatment plants; municipalities run sewage pumping stations, movable bridges, tunnels and traffic control systems. These installations run on SCADA, PLCs and telemetry and fall under the BIO. BIO2 even requires the information security policy to assign responsibility for OT security explicitly.

Generic IT measures do not always fit OT, for example when patching a controller that must run 24/7. BIO2 therefore allows controls to be replaced by, or combined with, equivalent measures from the CSIR and IEC 62443. The CSIR (Cybersecurity Implementatierichtlijn Objecten, the cybersecurity implementation guideline for physical assets), developed by Rijkswaterstaat and Het Waterschapshuis, classifies each asset and links it to a set of measures drawn from the BIO and IEC 62443. Typical OT measures include network segmentation into zones, a data diode for one-way traffic, secured remote access for suppliers and logging of the process environment.

🧭 How do you implement BIO2 step by step?

1. Define the ISMS scope - include at least the business processes and information systems that are critical to your services, including OT.
2. Establish the context - internal and external factors as well as the legal obligations under the Cbw.
3. Choose a risk methodology - with a quick scan, a method for full risk analysis, a risk register for temporarily accepted risks and a follow-up process.
4. Identify risks - using tools such as ISO 27005, the NIST CSF or NIST SP 800-30; consider supply chain dependencies and threats to OT.
5. Select measures - ISO 27002 controls plus all government measures, recorded in the SoA.
6. Operationalise and demonstrate - turn the tactical government measures into concrete procedures and technology, and show that they work.
7. Publish and account - make the ISMS scope and SoA public and report to the board, the supervisor and chain partners.
8. Improve continuously - internal audits and management reviews following the PDCA cycle.

BIO2 also names principles such as security by design, need to know, assume breach, zero trust and defence in depth. The Information Security Service for municipalities (IBD) of the Association of Netherlands Municipalities (VNG) and the CIP provide guidance and model documents.

📋 How do municipalities account for the BIO?

Municipalities use ENSIA (Eenduidige Normatiek Single Information Audit) to report in a single annual cycle to the municipal council and to the national supervisory authorities.

Provinces, water boards and central government account for information security through their own planning and control cycle and internal audit functions.

🔗 How does the BIO relate to other frameworks?

Through the Harmonized Structure of ISO management system standards, these frameworks can be combined in a single ISMS, avoiding duplicated effort.

❓ Frequently asked questions

Is the BIO mandatory for Dutch municipalities?

Yes, the BIO is mandatory for Dutch municipalities. Since 15 August 2026, applying BIO2 has been a legal requirement through the Cyberbeveiligingswet, because municipalities are essential entities under that act. Before then, municipalities had adopted the BIO through the VNG as mandatory self-regulation.

What is the difference between the BIO and ISO 27001?

ISO 27001 is an international standard for setting up an information security management system. The BIO requires Dutch government bodies to build that ISMS according to ISO 27001 and adds mandatory government measures, governance arrangements and a publication duty. The BIO therefore does not replace ISO 27001 and ISO 27002, but supplements them.

Does a government body need ISO 27001 certification to comply with the BIO?

No, the BIO does not require ISO 27001 certification. A government body must, however, demonstrate that its measures are designed, in place and operating effectively, for example through audits and penetration tests. A certificate can make that accountability easier.

Do the BBN levels still exist in BIO2?

No, the baseline security levels BBN1, BBN2 and BBN3 were dropped in BIO2. Instead, a government body uses a quick scan and, where necessary, a full risk analysis to decide which additional measures are needed. The mandatory government measures always form the minimum.

Does the BIO also apply to operational technology?

Yes, BIO2 explicitly applies to operational technology such as pumping stations, locks and treatment plants. For OT, government bodies may implement controls through equivalent measures from the CSIR and IEC 62443. The information security policy must explicitly assign responsibility for OT security.

What is ENSIA?

ENSIA (Eenduidige Normatiek Single Information Audit) is the annual accountability instrument through which Dutch municipalities report on the BIO and on domains such as DigiD, Suwinet, BRP, BAG, BGT and BRO. The municipal executive issues a management statement, which an IT auditor assesses for DigiD and Suwinet. The documents go to the supervisors by 30 April.

📌 In summary

The BIO is the mandatory information security framework for Dutch central government, provinces, municipalities and water boards: an ISMS based on ISO 27001, supplemented with mandatory government measures based on ISO 27002. With BIO2 and the Cyberbeveiligingswet, the BIO has been anchored in law since 2026, is risk-driven rather than based on BBN levels, and explicitly applies to OT through the CSIR and IEC 62443.