Netherlands — BIO2: Government Baseline Becoming a Statutory Obligation

The Dutch Baseline Informatiebeveiliging Overheid — BIO — is in a transition that matters for anyone selling cloud services to the Dutch government. BIO2 v1.3 (dated 9 January 2026) was published in the Staatscourant on 5 March 2026 and supersedes both BIO v1.04zv (the legacy BIO1) and BIO2 v1.2 in central-government digital communication. The Cyberbeveiligingswet (Cbw) — the Dutch NIS2 transposition — has been in force since 15 August 2026, having passed the Tweede Kamer on 15 April 2026 and the Eerste Kamer on 7 July 2026. Municipal applicability of BIO2 was settled with it, through the ministerial Cyberbeveiligingsregeling sector overheid. This article walks through what BIO2 actually requires, how the cloud sub-framework works, and how a hyperscaler typically demonstrates BIO compliance.

The system at a glance

The framework is the Baseline Informatiebeveiliging Overheid (BIO) — Baseline Information Security for Government. As of 5 March 2026, BIO2 v1.3 (dated 9 January 2026) is the operative version. It supersedes both BIO v1.04zv (the legacy BIO1) and BIO2 v1.2 (which was adopted by OBDO on 23 September 2025) in central-government digital communication. v1.3 contains “limited modifications” tied to the forthcoming ministerial Cybersecurity Regulation under the Cbw. Next BIO2 version planned for end of 2027.

Municipal applicability is being aligned to BIO2 via the forthcoming ministerial Cybersecurity Regulation for the Government Sector under the Cbw, rather than via a separate continuation of BIO v1.04zv. The legacy BIO1 set is being retired across all government layers as the Cbw secondary regulation crystallises.

A separate document — the BIO Thema-uitwerking Clouddiensten — provides cloud-specific elaboration. It was originally published alongside BIO v1.04zv and continues to be the cloud-specific overlay under BIO2 v1.3. The expectation is for the Thema-uitwerking to be re-issued in alignment with BIO2 v1.3 once the forthcoming ministerial Cybersecurity Regulation under the Cbw is published; in the meantime, existing EY CertifyPoint attestations for hyperscalers remain the operative evidence. This is the framework cloud providers actually engage with.

The framework is coordinated by the Ministerie van Binnenlandse Zaken en Koninkrijksrelaties (BZK) — Ministry of the Interior and Kingdom Relations — through an inter-ministerial working group. Operational partners include:

• NCSC (Nationaal Cyber Security Centrum).
• CIP (Centrum Informatiebeveiliging en Privacybescherming).
• IBD (Informatiebeveiligingsdienst voor gemeenten) — for municipalities.
• RDI (Rijksinspectie Digitale Infrastructuur) — the supervisory authority.
• Auditdienst Rijk (ADR) — the central audit service.

The working version of BIO2 is maintained openly on GitHub at https://minbzk.github.io/Baseline-Informatiebeveiliging-Overheid/. Public GitHub-based development of a national security baseline is unusual; it reflects the Dutch government’s emphasis on transparency and stakeholder participation.

Legislative basis

BIO2’s statutory position is in late-stage transition:

• Cyberbeveiligingswet (Cbw) — the Dutch NIS2 transposition. Approved by the Tweede Kamer on 15 April 2026, by the Eerste Kamer on 7 July, and in force since 15 August 2026, replacing the Wbni. When the act enters into force, BIO2 becomes a statutory obligation for in-scope entities via the ministerial Cybersecurity Regulation under the Cbw.
• That ended the self-regulation period. The Cyberbeveiligingsregeling sector overheid, published in the Staatscourant on 7 August 2026 and in force alongside the Cbw from 15 August, makes BIO2 a statutory obligation and requires ISO 27001/27002 — across all four layers, municipalities included. Government bodies also acquired an NCSC registration duty from the same date. Before that, BIO2 applied to central government, provinces, and water authorities as “verplichtende zelfregulering” — mandatory self-regulation — under a decision by the Overheidsbreed Beleidsoverleg Digitale Overheid on 23 September 2025.
• BIO v1.04zv has been superseded by BIO2 v1.3 as of 5 March 2026 in central-government digital communication. Municipal applicability is being aligned through the ministerial regulation rather than a continuing parallel BIO1 regime.

The transition produces some operational ambiguity: BIO2 is “mandatory” today in a self-regulation sense; it will be “mandatory” in a statutory sense once the Cbw takes effect; the practical implications for non-compliance shift along that transition.

Scope of obligation

BIO covers four layers of Dutch public administration:

• Central government (Rijk) — ministries, departments, central agencies.
• Provinces — twelve provincial governments.
• Municipalities — approximately 342 municipalities.
• Water authorities (waterschappen) — twenty-one water boards.

Implicitly, BIO also covers ZBOs — autonomous administrative authorities — and joint arrangements (gemeenschappelijke regelingen) that are not formally within Cbw scope but are practically held to BIO discipline.

The cloud sub-framework — BIO Thema-uitwerking Clouddiensten — defines what cloud providers must demonstrate to support BIO-compliant consumers. It is voluntary for the provider (no provider must hold it) but operationally necessary for cloud providers serving the Dutch public sector.

Classification model — BIO2 abolished the BBNs

The three basisbeveiligingsniveaus are gone. This is the single biggest change in BIO2 and the one most likely to trip up material written against BIO 1.04. In the framework’s own words, “de drie basisbeveiligingsniveaus (BBN’s) uit de vorige versie van de BIO zijn vervallen”; VNG put it the same way when v1.3 was published — “vervalt het systeem van basisbeveiligingsniveaus (BBN’s) en maakt dat plaats voor een risicogebaseerde aanpak”.

What replaces them is not another set of levels. BIO2 asks an organisation to reach its own reasoned conclusion:

• Run a risk analysis rather than reading a level off a table.
• Apply the NEN-EN-ISO/IEC 27002 controls on a risk basis, implementing at minimum the BIO2 overheidsmaatregelen — the government-specific additions.
• Record what was selected, and why, in a Verklaring van Toepasselijkheid (statement of applicability).
• Operate an ISMS conforming to NEN-EN-ISO/IEC 27001, which BIO2 makes mandatory.

For a cloud provider the practical consequence is that there is no longer a level to be “approved for”. A Dutch public body will arrive with the output of its own risk analysis and ask which of its selected controls you can evidence. Answering that with a BBN tier is answering a question nobody is asking any more, and it signals the supplier is working from the old baseline.

The Baselinetoets BBN, the instrument used to determine a level, belongs to BIO 1.04 and goes with it.

Evaluation criteria

BIO2 is built on the Dutch national editions of ISO/IEC 27001 and 27002:

• NEN-EN-ISO/IEC 27001:2023 (Dutch edition) — ISMS.
• NEN-EN-ISO/IEC 27002:2022 (Dutch edition) — control set.

On top of the ISO baseline, BIO2 adds approximately 200 overheidsmaatregelen — government-specific measures — that elaborate ISO controls for public-sector context.

Sector-specific norms layer on top of BIO2 where applicable:

• NEN 7510 — healthcare information security.
• CSIR — operational-technology cybersecurity (Cyber Security Implementatie Richtlijn).
• IEC 62443 — industrial cybersecurity.

For cloud services, the BIO Thema-uitwerking Clouddiensten maps the BIO requirements to:

• CIS Controls.
• ISO/IEC 27017 (cloud-specific controls).

The Thema-uitwerking is the practical bridge that lets cloud providers demonstrate BIO compliance without holding a Dutch-specific certification.

The assessment process

BIO assessment follows a documented sequence:

1. Risk Self Assessment (RSA) — mandatory for the system owner. Determines applicability of BIO controls and selection of relevant measures.
2. Demonstration of design, existence, and effectiveness of controls — language drawn from NIS2 / Cbw expectations.
3. Independent testing — penetration testing, red teaming and external audits, scoped to the risks the organisation’s own analysis identified.
4. ENSIA — Eenduidige Normatiek Single Information Audit — the annual self-assessment process for municipalities, provinces, water authorities, and central organisations.

For cloud providers demonstrating Thema-uitwerking Clouddiensten compliance, the established pattern is via EY CertifyPoint as monitoring body. EY CertifyPoint issues certificates attesting that the cloud provider’s services meet the BIO cloud expectations. AWS, Microsoft, and Google use this route.

The ENSIA process is the operational rhythm for public-sector consumers. CSPs themselves typically run an annual EY CertifyPoint cycle.

Catalogue and recertification

Unlike Slovakia, Italy, or France, the Netherlands does not maintain a central public catalogue of approved cloud services. CSPs publish their own certifications and attestations:

• AWS Artifact for AWS certificates.
• Microsoft Trust Center for Microsoft attestations.
• Google Cloud Compliance Reports for Google.
• Mid-size and Dutch-native providers publish through their own trust centres.

Procurement teams in the Dutch public sector evaluate cloud providers individually, against the controls their own risk analysis selected and the Thema-uitwerking expectations.

Recertification cadence:

• Annual self-assessment (ENSIA) for public-sector consumers.
• External audits following a risk-based approach, typically every 1–3 years.
• EY CertifyPoint cycles for cloud providers are typically annual.

Sanctions and oversight

Before Cbw takes effect, BIO2 is mandatory self-regulation. Sanctions are reputational and political:

• Parliamentary oversight through the Tweede Kamer.
• Audit findings by the Algemene Rekenkamer (Court of Audit).
• ENSIA findings reported through the established governance channels.

After Cbw takes effect, statutory NIS2 sanctions apply:

• Up to €10 million or 2% of global turnover for essential entities.
• Lower thresholds for important entities.

The supervisory authority for digital infrastructure under Cbw is the Rijksinspectie Digitale Infrastructuur (RDI).

Sovereignty posture

BIO does not impose strict sovereignty requirements:

• No ownership caps on cloud providers.
• No headquartering requirement.
• No immunity-from-extraterritorial-law clause.

The strongest sovereignty-adjacent rule is the categorical exclusion of EU/NATO-classified information from public cloud — information marked Stg. CONFIDENTIEEL, SECRET or TOP SECRET under the EU/NATO scheme. Below that line, hyperscalers are accepted as providers. Note that this exclusion was historically expressed as “above BBN3”; with the BBNs withdrawn it stands on the classification of the information itself, which is where it always really sat.

The Dutch political position on EUCS sovereignty has been on the more permissive side of the debate. The Netherlands has resisted strict EUCS sovereignty rules at the EU level, consistent with the BIO posture of accepting hyperscalers below the classified-information threshold.

Multicloud factor

BIO2 is one of the more accommodating EU national frameworks for multinational CSPs:

• The NEN-EN-ISO/IEC 27001:2023 + 27002:2022 baseline aligns with international CSP control frameworks. Note the designation: 2023 is the Dutch and European adoption; ISO’s own edition of 27001 is 2022.
• The Thema-uitwerking Clouddiensten provides a focused audit scope rather than requiring full BIO2 implementation by the provider.
• The EY CertifyPoint route is well-established and reproducible.
• No catalogue listing process; certifications are published through the provider’s own trust centre.
• No sovereignty constraints below the classified-information threshold.

Hyperscalers operate BIO landing zones — pre-configured environments that demonstrate BIO control alignment for consumers. AWS has published BIO landing zone guidance; Microsoft and Google have equivalent material.

Closing checklist

• BIO2 v1.3 (dated 9 January 2026) was published in Staatscourant on 5 March 2026 and supersedes BIO v1.04zv and BIO2 v1.2 in central-government digital communication. Next BIO2 version planned end of 2027.
• The Cyberbeveiligingswet (Cbw) — Dutch NIS2 transposition — has been in force since 15 August 2026. It makes BIO2 a statutory obligation through the ministerial Cyberbeveiligingsregeling sector overheid, in force from the same date.
• No baseline levels: BIO2 withdrew BBN1–BBN3 in favour of a risk analysis, ISO 27002 controls applied on a risk basis plus the mandatory overheidsmaatregelen, and a Verklaring van Toepasselijkheid recording the choices. EU/NATO-classified information (CONFIDENTIEEL and above) remains categorically excluded from public cloud — not a controls question, a hard restriction.
• BIO2 builds on NEN-EN-ISO/IEC 27001:2023 and 27002:2022, adding approximately 200 government-specific measures. The cloud sub-framework (Thema-uitwerking Clouddiensten) maps to CIS Controls and ISO/IEC 27017.
• No central catalogue. CSPs publish certificates through their trust centres. EY CertifyPoint is the established monitoring body for the cloud sub-framework.
• Sanctions are reputational pre-Cbw; statutory NIS2 sanctions apply post-Cbw, with RDI as the digital infrastructure supervisor.
• Sovereignty posture is permissive. No ownership caps; no headquartering requirements. The Netherlands is politically on the more open side of the EUCS sovereignty debate.
• Publish a BIO landing zone reference alongside the Thema-uitwerking certificate. The landing zone is what makes the certificate consumable for Dutch government workloads.
• What to read next: ISO 27001/27002 for the international baseline BIO2 inherits from; NIS2 Supply Chain for the Cbw-aligned supply-chain obligations; EUCS Watch for the Dutch position in the EUCS debate.