"Easy2audit has helped us for many years to set up and monitor our hardening efficiently in line with the BIO standard."
Johannes Grimmerink
DOWR · Deventer, Olst-Wijhe & Raalte
Government · municipalities
The Dutch Cybersecurity Act is in force and every municipality is an essential entity, whatever its size. Easy2audit measures your systems against BIO2 and NIS2 at the same time and delivers the evidence for board and regulator.
Measures against: BIO2 · NIS2 / Cbw · CIS · ISO 27001/27002
The law is in force
Since that date the Dutch Cybersecurity Act applies. Duty of care, duty to report and supervision, for every municipality, without a size threshold. Inter-municipal cooperation bodies (gemeenschappelijke regelingen) fall under it as soon as they qualify as a public body.
For public bodies the duty of care is implemented through BIO2. What you already had to do is now law, and can now be demonstrated: usable as technical substantiation in your accountability reporting, such as the ENSIA self-assessment.
Cbw · adopted 7 July 2026 · in force 15 August 2026
What changes
Appropriate measures are mandatory, and for public bodies implemented via BIO2 . Working BIO2-compliant is the basis; the duty of care remains risk-based.
Significant incidents must now be reported. The NCSC currently performs the CSIRT tasks; the IBD is the intended sectoral CSIRT and remains your point of contact.
The RDI provides external supervision. The board approves the measures and remains ultimately responsible, even when execution sits with IT.
One scan
The same scan scores your environment against both frameworks. No double measurement, no double administration.
How you make it demonstrable
Easy2audit measures your systems and accounts against the technical controls of the government measures from part 2 of BIO2 under chapter 8 of ISO 27002:2022, the technological controls, and the ISO 27002 controls they give substance to, and scores the same scan against the other frameworks as well.
In Easy2audit, BIO2 follows the structure of ISO 27002:2022: organisational (5), people (6), physical (7) and technological (8), with the Dutch measure names from the baseline. Per measure, from 5.15 access control to 8.22 network segregation, you see the measured settings and which systems deviate.
demo environment · sample scores · a selection, the application covers the full framework
Worksheet
Twelve questions about evidence that must come from your systems under BIO2 and the Dutch Cybersecurity Act. Tick what you can show right now, without first collecting exports or screenshots; whatever stays open is a gap that only surfaces at the next accountability round. In Dutch.
"Easy2audit has helped us for many years to set up and monitor our hardening efficiently in line with the BIO standard."
30 minutes · online · no obligations