Your Dutch government customer refers to BIO2. What do you provide?
BIO2 is the Baseline Informatiebeveiliging Overheid: the information security framework for Dutch central government, municipalities, provinces and water authorities. It builds on ISO 27001 and 27002. As a supplier you are not in scope of BIO2 yourself, but your customer must also manage risks at its suppliers. That is why you receive questions about your controls. Answer with evidence, and never write that you are “BIO compliant”.
If you sell software or IT services to a Dutch government organisation, you will come across BIO2: in the tender, in the contract or in a questionnaire. What does the customer actually ask of you?
What BIO2 is
The Baseline Informatiebeveiliging Overheid (BIO) is the shared information security framework for Dutch government. The second version, BIO2, is based on ISO/IEC 27001 and 27002 and turns standards into measures that all government tiers must comply with (Government Gazette 2026, 7416, in Dutch).
Version 1.3 was published in the Government Gazette on 5 March 2026 and applies to central government, municipalities, provinces and water authorities. The Dutch Cybersecurity Act (Cyberbeveiligingswet) is its basis. A next version is planned around the end of 2027 (NL Digital Government, March 2026).
Why you receive questions as a supplier
BIO2 applies to the government organisation, not to you. But BIO2 also requires the organisation to manage risks at its suppliers. In ISO 27002:2022 these are the controls on supplier relationships: security in supplier relationships, agreements in the contract, the ICT supply chain, monitoring the service and the use of cloud services. Those requirements reach you as a questionnaire, a tender annex or a contract clause.
What you may receive
| Topic | Typical question | Evidence that helps |
|---|---|---|
| Framework | Do you have ISO 27001, and is this service in scope? | Certificate with scope, statement of applicability |
| Access | How do you control access to our data, with MFA? | Access policy, screenshot of the setting |
| Location and cloud | Where is the data stored, and which cloud services do you use? | List of sub-processors and locations |
| Vulnerabilities | How quickly do you fix critical vulnerabilities? | Patch policy, summary of the latest pentest |
| Incidents | How quickly do you report an incident to us? | Incident procedure, contract terms |
| Continuity | How often do you test restoring from backup? | Report of the latest restore test |
How to approach it
- Ask which controls apply to your service. BIO2 is risk-based. Not every control applies to every supplier. Ask which information you process and which risk the customer attaches to it.
- Map it to ISO 27001. If you have ISO 27001, much overlaps. Show which controls you cover and within which scope.
- Answer per control with evidence. A document, a setting or a report. See also the evidence ladder.
- Be honest about gaps. An open item with a plan and a date is stronger than a “yes” that later turns out to be wrong.
- Check the contract. What you promise in the questionnaire must match the contract and the data processing agreement.
What not to write
- “We are BIO compliant” or “BIO certified”. BIO2 is a framework for government, not a certificate for suppliers.
- “All our data is stored in the Netherlands” when a sub-processor is located elsewhere.
How Holdvero helps
With Questionnaire Rescue we answer your government customer’s questionnaire based on your own documentation, with a source for every answer and honest open items. Holdvero does not provide certification, audits or legal advice. More about Dutch customers on the Netherlands page.
Frequently asked questions
Do I have to comply with BIO2 as a supplier?
BIO2 applies to government organisations. Your customer can impose requirements on you that follow from BIO2, through the tender or the contract. You then show how you meet those requirements.
Is ISO 27001 enough?
ISO 27001 often covers a large part, because BIO2 is based on it. Do check that your service is within the scope of your certificate, and ask whether the customer expects additional government measures.
Which version of BIO2 applies?
On 13 October 2026 that is version 1.3, published in the Government Gazette on 5 March 2026. A next version is planned around the end of 2027.
Does this also apply to municipalities?
Yes. Version 1.3 applies to central government, municipalities, provinces and water authorities. Municipalities often add GIBIT, the IT procurement terms of the Association of Netherlands Municipalities (VNG).
Received a government questionnaire?
Within 1 working day you'll hear the price and when you get it back. You only pay after agreeing the price.
Get a fixed price