BIO2 for suppliers to Dutch government: what changes and what you will be asked

BIO2 is the information security framework for the whole of Dutch government. It was adopted on 23 September 2025, version 1.3 has been in the Government Gazette (Staatscourant) since 5 March 2026, and since the Dutch Cybersecurity Act (Cyberbeveiligingswet) took effect on 15 August 2026, applying it is a legal requirement for public sector bodies. The framework builds on ISO 27001 and ISO 27002:2022. For an IT supplier that already runs an ISO 27001 ISMS, BIO2 is therefore mostly a familiar language with a few public sector accents.

What BIO2 is

BIO stands for Baseline Informatiebeveiliging Overheid, the baseline for information security in government. It is the shared framework for central government, municipalities, provinces and water authorities. BIO2 replaces BIO 1.04 and differs from it in three ways:

• ISMS required. Public bodies must run a working information security management system based on ISO 27001 (published in the Netherlands as NEN-EN-ISO/IEC 27001:2023). A certificate is not required.
• New control structure. The controls follow the structure of ISO 27002:2022, with government measures on top that apply specifically to the public sector.
• Risk based. The three baseline security levels (BBNs) of the old BIO have been dropped. Public bodies use a risk analysis to decide which additional measures they need.

Timeline and status

Version 1.3 marks three government measures as falling outside the scope of the Act. Bodies outside the Cybersecurity Act, such as Defence and the police, continue to apply the BIO as binding self-regulation. The Dutch Digital Infrastructure Inspectorate (RDI) supervises government as a sector under the Act.

How BIO2 relates to the Cybersecurity Act

The Dutch Cybersecurity Act sets a duty of care, which is worked out per sector. For the public sector, the ministerial regulation refers to BIO2. BIO2 is therefore how a municipality or ministry shows that it meets the duty of care. For companies in other sectors BIO2 plays no role; they follow the requirements of the Cybersecurity Decree.

What BIO2 asks of suppliers

BIO2 is aimed at public bodies, not at suppliers. However, according to the BIO2 guidance, suppliers do have to meet BIO requirements, depending on the risk, the type of service and access to sensitive information. The public body stays responsible for the risks of what it outsources or buys, and therefore passes requirements on to the supplier.

This happens mainly through the supplier controls, numbered 5.19 to 5.23 in ISO 27002:2022. The government measures attached to them ask, among other things, that:

• security requirements are part of the tender;
• those requirements are in the contract and the supplier demonstrates that it meets them;
• the requirements apply in full to the supplier's own subcontractors;
• the public body periodically assesses whether the supplier keeps to the agreements;
• there is a policy for selecting and managing cloud services.

What you will see as a supplier

For a SaaS provider, hosting company or software business supplying municipalities or central government, BIO2 arrives in four ways:

1. In the tender. Contracting authorities use the Inkoopeisen Cybersecurity Overheid (ICO), a set of procurement requirements from the CIP that builds on the BIO. The selected requirements are sent as an annex with the tender documents.
2. As a selection criterion. A contracting authority can ask for an ISO 27001 certificate or an ISAE 3402 report. According to PIANOo, the Dutch public procurement expertise centre, such a certificate does not replace checking the full set of requirements, so expect a questionnaire or a statement of compliance as well.
3. In the contract. Terms on security measures, incident notification, independent third-party assessment and passing requirements on to your own suppliers.
4. In the annual cycle. The customer periodically checks whether you keep to the agreements, for example using your audit report or a current Statement of Applicability.

What an ISO 27001 supplier still needs to do

Because BIO2 builds on the same standards, you do not need to set anything up again. It does pay to check:

• whether the scope of your certificate includes the service the public sector customer buys;
• which government measures come back in contracts and whether your controls cover them;
• how quickly you notify the customer of incidents, since it has 24 hours itself under the Cybersecurity Act;
• how you pass requirements on to your cloud platform and other subcontractors.

A supplier that links each government measure to an existing Annex A control can answer a BIO2 questionnaire without setting up a second administration.