Expertise · Framework
BIO2
The information-security baseline for Dutch government — the successor to the BIO, aligned to ISO 27001/27002 and more strongly risk-based.
What it is, and why it matters.
BIO2.0 (Baseline Informatiebeveiliging Overheid) is the common information-security framework for Dutch government bodies — central government, municipalities, provinces, and water authorities. The updated 2.0 version aligns more closely with the latest ISO 27001/27002 and takes a more explicitly risk-based approach than its predecessor. For public-sector organisations — and the suppliers that serve them — meeting the BIO is effectively mandatory.
Who it affects.
Dutch government organisations (Rijk, gemeenten, provincies, waterschappen) and the suppliers and service providers that work with them.
Key dates
Defined on 23 September 2025 by the Overheidsbreed Beleidsoverleg Digitale Overheid (OBDO).
What it involves.
Risk-based selection of controls aligned to ISO 27002
Governance and management accountability for information security
Implementation of organisational and technical controls
ENSIA self-assessment and audit reporting (where applicable)
Continuous improvement
Sits under:
Compliance
BIO2 within your managed office.
BIO2.0 sits under Compliance and overlaps heavily with ISO 27001 — we run them together so a single management system satisfies both. It connects to Governance and Risk as part of your wider program.
How we help.
00
Scoping & gap analysis
Where you stand against the BIO baseline today.
00
Risk-based control selection
The controls appropriate to your risk profile.
00
Control implementation
Organisational controls implemented; technical ones orchestrated.
00
ENSIA reporting support
Help with the self-assessment and audit reporting.
00
Aligned to ISO 27001
Run together so you don't do the work twice.
00
Ongoing maintenance
Kept current as your managed office.
Related expertise.
ISO 27001
The international standard for information security management. We design, implement, and run the ISMS — and take you to certification and beyond.
NIS2
The EU's updated cybersecurity directive expanded scope across 18 sectors, strict incident reporting, supply-chain security, and personal accountability for management.
Information Security Governance
Directing and overseeing security: the structures, roles, accountability, and policy that make it a managed discipline rather than something that happens ad hoc.
TRUSTED BY ORGANISATIONS ACROSS EUROPE
