BIO2 and ISO 27001: what is the difference?
The BIO2 (Baseline Informatiebeveiliging Overheid 2, the Dutch government baseline for information security version 2) is the framework for information security used by the Dutch government. It builds directly on ISO/IEC 27001 and ISO 27002 : you use ISO 27001 for the management system and the Annex A controls from ISO 27002, and the BIO2 adds mandatory government measures to them. The current version is BIO2 version 1.3 of 9 January 2026.
Since 15 August 2026, the BIO2 for essential entities in the government sector has been legally linked to the duty of care in the Cybersecurity Act (Cyberbeveiligingswet), the Dutch implementation of NIS2. This is stated in the frequently asked questions from BIO-overheid . For government organisations outside the law, the BIO2 remains binding self-regulation.
Short answer: ISO 27001 is an international standard that any organisation can be certified against. The BIO2 is the Dutch government framework that uses ISO 27001 and ISO 27002 as its basis and adds mandatory government measures. If you have ISO 27001 in order, you have the foundation for the BIO2, but you still need to check the government measures separately. There is no such thing as a BIO2 certificate, and the BIO2 does not require ISO 27001 certification.
BIO2 and ISO 27001 side by side
The table sets out the main differences. The facts about the BIO2 come from the BIO2 text and the explanation from Digitale Overheid (the Dutch digital government programme) .
| ISO 27001 | BIO2 | |
|---|---|---|
| What is it? | International standard for an information security management system (ISMS) | Dutch framework for the government |
| Created by | ISO and IEC, published in the Netherlands by NEN | Government, managed by an inter-administrative working group chaired by BZK |
| For whom | Any organisation | National government, municipalities, provinces and water boards |
| Mandatory? | No, but often required by customers | Yes, for the government: through the Cybersecurity Act or binding self-regulation |
| Basis | Own standard text with Annex A (93 controls) | NEN-EN-ISO/IEC 27001:2023 and NEN-EN-ISO/IEC 27002:2022 |
| Controls | You choose based on risk | You choose based on risk, plus mandatory government measures |
| Certification | Yes, by an accredited certification body | No. ISO 27001 certification is not mandatory, but according to the BIO2 it simplifies accountability |
| Statement of Applicability | Mandatory | Mandatory, with the government measures explicitly included |
What does the BIO2 add to ISO 27001?
The BIO2 fully adopts the risk-based ISMS of ISO 27001. What it adds are the government measures. These are numbered per ISO 27002 control, for example 5.17.01 or 8.13.03. They do not sit on top of the ISO controls, but partly fill them in as a mandatory minimum.
The big difference from ISO 27001 is that you cannot reason away government measures with a low risk score. The BIO2 text says they are always mandatory, unless they really cannot apply. With ISO 27001, you may exclude any control, as long as you justify it in your Statement of Applicability (SoA).
A few examples show how concrete the government measures are:
| ISO 27002 control | Government measure in BIO2 v1.3 (summarised) | Read more |
|---|---|---|
| 5.17 Authentication information | MFA at least for the digital workplace, internet-facing services and admin accounts; password manager for all employees | Password policy |
| 8.13 Information backup | Backup policy with attention to ransomware, defined maximum data loss and recovery time, restore test at least once a year | Backup policy |
| 8.15 Logging | A log entry contains at least action, object, result, origin, actor and timestamp | Logging and monitoring |
| 8.8 Management of technical vulnerabilities | If there is a high chance of misuse and high damage, measures within one week at the latest | Vulnerability management |
| 5.24 Incident management planning | Accessible reporting point and report to the CSIRT (computer security incident response team) within the legal deadline | Incident management |
Read the full text of each measure in the BIO2 itself. This table summarises it and does not replace it.
What has changed compared with the old BIO?
The BIO2 replaces BIO version 1.04zv from June 2020, which was still based on the ISO standards from 2017. According to BIO-overheid, these are the main changes:
- The BIO2 aligns with the ISO 27001 and 27002 versions from 2022, with the new structure of four themes and 93 controls.
- The three basic security levels (BBN) have been removed. Risk management is more central.
- Responsibilities are described more generally, not per control.
- The addendum with requirements per government layer (part 3) has been removed.
- The BIO2 aligns with the duty of care in the Cybersecurity Act.
The versions in brief: draft BIO2 v1.1 in April 2025, v1.2 in September 2025 and v1.3 in January 2026. A next version is expected in autumn 2027.
Is the BIO2 mandatory?
For the government, yes. For essential entities in the government sector, BIO2 v1.3 has been linked to the statutory duty of care since 15 August 2026, through the Cybersecurity Decree for the government sector (Cyberbeveiligingsregeling sector overheid). For other government organisations, or parts that fall outside the law, the BIO2 applies as binding self-regulation.
Some measures are excluded from the legal duty, namely 5.32 and 5.34 and the government measures 5.32.01, 5.33.01 and 5.34.01. For these, self-regulation still applies. BIO-overheid states that measure 5.33 is legally mandatory, even though BIO2 v1.3 said something different.
The Ministry of the Interior and Kingdom Relations (BZK) has made the ISO standards available free of charge to government organisations via NEN .
Must a supplier to the government comply with the BIO2?
Not automatically. BIO-overheid states that a supplier does not have to apply all the requirements of the BIO2, ISO 27001 and ISO 27002 as a matter of course, and does not automatically have to be certified. The government organisation decides for each service which requirements are needed and records them in the contract or procurement conditions.
In practice, many tenders do ask for an ISO 27001 certificate, supplemented with specific BIO2 requirements. A certificate shows that your ISMS works. It does not automatically mean you have implemented the government measures. So record in your Statement of Applicability which government measures you have adopted, so you can demonstrate this in a tender.
From ISO 27001 to BIO2: a practical approach
If you already have an ISO 27001 ISMS, the step to BIO2 is mainly a gap analysis of the government measures:
- Download the BIO2 in Excel from BIO-overheid and place the government measures next to your Statement of Applicability.
- Decide for each government measure whether you comply, partly comply or do not comply.
- Add the missing measures to your risk treatment plan.
- Add the government measures to your Statement of Applicability. Record deviations in an appendix titled “Exceptions to the SoA (VvT)”, as the BIO2 prescribes.
- Check them as part of your internal audit.
For the gap analysis, government organisations can use the BIO Self Assessment (BIO-SA). Municipalities also report on the BIO every year through ENSIA (the annual information security reporting cycle for municipalities). To see how that cycle works, read ENSIA and ISO 27001 for municipalities. If you are starting from zero, first follow the ISO 27001 step-by-step plan and a baseline measurement.
Do not rely on the old basic security levels. If you still use “BBN2” in documents or tender requirements, you are referring to BIO 1.04. These levels no longer exist in the BIO2.
Frequently asked questions about BIO2 and ISO 27001
Can I get certified against the BIO2?
No. The BIO2 is a framework of requirements, not a certification scheme. You can have your ISMS certified against ISO 27001. According to the BIO2, that makes accountability simpler.
What is the difference between the BIO2 and NIS2?
NIS2 is a European directive, implemented in the Netherlands in the Cybersecurity Act. It includes, among other things, the duty of care, the reporting obligation and requirements for board members. The BIO2 makes the duty of care concrete for the government, but does not replace the law.
Does the BIO2 also apply to paper information?
Yes. BIO-overheid states that the Cybersecurity Act only covers network and information systems, while the BIO2 covers information security in the broadest sense, including physical documents.
More information
- NIS2 and ISO 27001: the Cybersecurity Act to which the BIO2 is linked
- Annex A: the 93 controls on which the BIO2 builds
- ISO 27001 vs. ISO 27002: the two standards underlying the BIO2
- Statement of Applicability (SoA): where you record the government measures
- BIO2 version 1.3 (PDF) : the full text from BIO-overheid
- Digitale Overheid: Baseline Informatiebeveiliging Overheid