Frameworks · BIO2
The Baseline Informatiebeveiliging Overheid 2 is the information security framework for Dutch central government, municipalities, provinces and water authorities, built on ISO 27001 and ISO 27002. Since the Cybersecurity Act it is no longer self-regulation for public bodies under that act but a legal obligation. In short: implement the government measures and demonstrate their design, implementation and operating effectiveness.
What it requires
You run a working information security management system per ISO 27001:2023 and work risk-driven: carry out risk assessments, keep them current and record what you do and do not apply.
You apply the ISO 27002:2022 controls according to risk, but the government measures in BIO2 are a mandatory minimum. You implement them regardless of your own risk assessment, from access rights to patch management and hardening.
For every measure you demonstrate design, implementation and operating effectiveness. BIO2 names self-assessments, audits and penetration tests for that; all of them require measurable systems, not policy documents.
How you make it demonstrable
Easy2audit measures your systems and accounts against the technical controls of the government measures from part 2 of BIO2 under chapter 8 of ISO 27002:2022, the technological controls, and the ISO 27002 controls they give substance to, and scores the same scan against the other frameworks as well.
In Easy2audit, BIO2 follows the structure of ISO 27002:2022: organisational (5), people (6), physical (7) and technological (8), with the Dutch measure names from the baseline. Per measure, from 5.15 access control to 8.22 network segregation, you see the measured settings and which systems deviate.
demo environment · sample scores · a selection, the application covers the full framework
Also measured
also available: NIST benchmarks · ISA 315 reporting for the financial statement audit