BIO2 certification

BIO2 differs from its predecessor, BIO 1.04zv, in several respects. The main changes are:

• Part 1 of BIO2 is structured according to ISO 27001. Part 2, containing the mandatory government controls, follows the structure of ISO 27002.
• The three Basic Security Levels, known as ‘Basisbeveiligingsniveaus’ or BBNs, have been discontinued. This places greater emphasis on risk management and the selection of controls based on identified risks.
• Roles and responsibilities are described at a general level rather than separately for each control and government control.
• BIO2 has been aligned with the NIS2 Directive, particularly the cybersecurity risk-management controls set out in Article 21. The Dutch implementation of the NIS2 Directive is the Cybersecurity Act, known as the Cyberbeveiligingswet or Cbw.
• Whereas BIO1 was based on mandatory self-regulation, the application of BIO2 is enshrined in law. For the Government sector, BIO2 further specifies the duty of care through a ministerial regulation. Government organizations covered by this regulation are required to apply the standards and BIO2 controls specified in it to secure their network and information systems. For government organizations and aspects of information security that fall outside the scope of the Cbw, as well as for exempted measures, BIO2 continues to apply as mandatory self-regulation.
• The former Part 3, the BIO Addendum containing specific mandatory requirements for each layer of government, has been discontinued.

BIO2 requires government organizations to:

• apply ISO 27001 when establishing, implementing, maintaining and continually improving an Information Security Management System, or ISMS;
• use ISO 27002 and the mandatory government controls from BIO2 when selecting and defining appropriate information security controls;
• demonstrate the design, implementation and operating effectiveness of these controls.

The ISMS must comply with ISO 27001. Certification to this standard is not mandatory under BIO2, but an independent assessment can provide assurance that the relevant requirements have been implemented effectively.

An organization complies with BIO2 when it can demonstrate that all applicable requirements have been implemented and operate effectively. This means that:

• an effective ISMS has been established in accordance with ISO 27001;
• information security is managed using a risk-based approach, including the performance and regular review of risk assessments;
• ISO 27002 and the mandatory BIO2 government controls have been applied when selecting appropriate controls;
• the controls address people, organizational processes, technology and physical security;
• the controls have been embedded at governance, tactical and operational levels;
• the organization can demonstrate the design, implementation and operating effectiveness of the controls.

Suppliers are not necessarily subject to BIO2 in the same way as government organizations. However, suppliers that provide products or services to government organizations may be required to meet relevant BIO2 requirements. The specific requirements depend on the risks involved, the nature of the products or services and the supplier’s access to sensitive information or information systems.

Controls 5.20 to 5.24, 8.05.01 and 8.24.05 address requirements relating to suppliers and supply chain security.

The government organization remains responsible for assessing and managing the risks associated with outsourced or procured products and services. Relevant BIO2 requirements should therefore be included in procurement requirements and contractual agreements