BIO · Baseline Informatiebeveiliging Overheid
BIO for Dutch government organisations.
The BIO is the information security baseline for Dutch government organisations, built on ISO 27001 and ISO 27002. With Basenorm you manage the BIO on the same control library as your ISO 27001, and suppliers to government show how they meet it.
Hosted in the Netherlands. Your data stays in the EU.In brief
- Type
- Government baselineFor central government, municipalities, provinces and water authorities
- Basis
- ISO 27001 and ISO 27002With government-specific requirements
- Suppliers
- Through contractsGovernment often requires suppliers to meet the BIO
- Approach
- Risk-basedMeasures follow from your risk assessment
01 / What the BIO asks
What the BIO
asks of you.
The BIO follows the structure of ISO 27001 and ISO 27002 and adds requirements for government information.
- 1A management system
An ISMS based on ISO 27001, with clear responsibilities.
- 2Risk management
A risk assessment that determines which measures you take.
- 3Controls
The controls from ISO 27002, with government-specific requirements.
- 4Accountability
Report on your information security, for example through ENSIA for municipalities.
- 5Suppliers
Agreements with suppliers about how they meet the BIO.
- 6Continuous improvement
Internal audits, management review and improvement actions.
02 / With your ISMS
the BIO on what you already have.
| Topic | Your ISO 27001 ISMS | What the BIO adds |
|---|---|---|
| Management system | Clauses 4 to 10 of ISO 27001 | Government roles and accountability |
| Controls | Annex A controls | Government-specific requirements per control |
| Accountability | Internal audit and management review | Reporting through government accountability cycles |
| Suppliers | Supplier relationship controls | BIO requirements in contracts with suppliers |
Because the BIO is built on ISO 27001 and ISO 27002, an ISMS is the natural base. The government-specific requirements are added per control.
03 / The assessment
BASELINE INFORMATIEBEVEILIGING OVERHEIDHow the BIO
is accounted for.
Government organisations account for their information security through their own cycles. Suppliers show compliance in line with their contracts.
Read about ISO 27001Own accountability. Each layer of government reports in its own way, such as ENSIA for municipalities.
Contractual evidence. Suppliers show how they meet the BIO, often with an ISO 27001 certificate or an assurance report.
ISO 27001 and ISO 27002. The BIO follows their structure, so controls can be shared.
The BIO is the information security baseline adopted by the Dutch government layers.
04 / In Basenorm
How Basenorm supports you.
05 / Questions
Questions about
the BIO.
Who must comply with the BIO?
Dutch government organisations: central government, municipalities, provinces and water authorities. Suppliers often have to meet the BIO through their contracts.
How does the BIO relate to ISO 27001?
The BIO is built on ISO 27001 and ISO 27002 and adds government-specific requirements. An ISMS is therefore a natural base.
Does an ISO 27001 certificate prove BIO compliance?
Not on its own. It shows a working ISMS, but the government-specific requirements need to be demonstrated as well.
Is Basenorm suitable for government data?
Basenorm is based and hosted in the Netherlands, and your data stays in the EU. Ask our team about the requirements for your organisation.
Book a demo
Manage the BIO on your ISO 27001.
In a demo we look at your organisation, your controls and the government-specific requirements.
- Which ISO 27001 controls count for the BIO.
- How you organise accountability.
- How you manage supplier requirements.
Hosted in the Netherlands. Your data stays in the EU.