ENSIA and ISO 27001 for municipalities

ENSIA (Eenduidige Normatiek Single Information Audit, the Dutch accountability framework for information security) is how Dutch municipalities account for information security every year. The municipality completes self-assessments based on the BIO (Baseline Informatiebeveiliging Overheid, the Dutch government baseline for information security). An IT auditor examines the connections to DigiD and Suwinet, and the executive board reports to the municipal council and the national supervisory bodies. ISO 27001 is not required for this. However, a municipality that has set up its security as an ISO 27001 management system already has the foundation for ENSIA in place.

ENSIA was created in 2017 on the initiative of the municipalities and the ministries of BZK and SZW. VNG Realisatie  (the association of Dutch municipalities’ implementation body) manages the framework, and the questionnaires are on the ENSIA platform . The BIO itself builds on ISO 27001 and ISO 27002. You can read how those two relate on BIO2 and ISO 27001.

ENSIA at a glance

The figures for accountability year 2026 come from the ENSIA 2026 accountability framework note  by VNG Realisatie.

How does the ENSIA cycle work?

The ENSIA year has four phases. The deadlines for accountability year 2026 are listed below.

How does ENSIA relate to ISO 27001?

Every year, ENSIA asks to what extent the municipality complies with the BIO. ISO 27001 describes how you set up information security as an ongoing process, with risk analysis, controls, internal audits and management review. The BIO requires a management system based on ISO 27001, but not a certificate.

For example, a municipality reports in ENSIA that it carries out an annual restore test of its backups. With a working ISMS, that test is in the annual plan, the test report is in document management, and follow-up on any failures is recorded. The self-assessment then becomes a matter of referring to those records. Without an ISMS, the coordinator has to look for the evidence again every year.

ENSIA and the move to the BIO2

The BIO2 replaces BIO 1.04 and is based on the 2022 versions of ISO 27001 and ISO 27002. The current version is BIO2 v1.3 from January 2026. According to the ENSIA note, the BIO2 takes legal effect together with the Cyberbeveiligingswet (Dutch Cybersecurity Act). You can find the content and the date on BIO2 and ISO 27001.

For accountability year 2026, the ENSIA note still names BIO version 1.04 as the framework. The note does not say when the ENSIA questionnaire will move to the BIO2. Keep an eye on the ENSIA page of VNG  for that. In the meantime, prepare by mapping your statement of applicability against the BIO2 government measures.

What must suppliers of municipalities deliver for ENSIA?

Municipalities remain responsible for work they outsource, including work carried out by their suppliers’ suppliers. The ENSIA note says municipalities must make sure that accountability reports and assurance reports from chain suppliers are ready in time for the audits.

If you supply software or hosting for a DigiD connection or for Suwinet, the municipality will therefore ask for an assurance report covering your part. This is usually a report under the 3000 standard. The difference from an ISAE 3402 report is explained on ISAE 3000 vs ISAE 3402. Make sure the report is available before the municipalities’ audits, well before 30 April.

What does the auditor look for in the ENSIA audit?

For DigiD and Suwinet, the IT auditor tests the design and existence of the controls as at 31 December. In other words: is the control well designed, and does it really exist on that date?

• Approved documents, such as policies, procedures and hardening guidelines.
• Evidence from practice, such as scan reports, penetration test reports and logging.
• Supplier reports for the part that falls outside the municipality.
• A self-assessment that matches what the auditor finds in practice.

Common mistakes with ENSIA and ISO 27001

• Seeing ENSIA as an annual form to fill in. Without an ongoing process, you look for the same evidence again every year.
• Requesting supplier reports too late. Put the date in the contract.
• Thinking an ISO 27001 certificate replaces ENSIA. Accountability to the council and national government remains mandatory.
• Moving to the BIO2 questions too early. Account for the framework that was set for that year.

Frequently asked questions about ENSIA

What does ENSIA stand for?

ENSIA stands for Eenduidige Normatiek Single Information Audit. The idea is that a municipality collects information once and has an IT audit done once, and that all its supervisors take their accountability from that single source.

Is the ENSIA audit the same as an ISO 27001 audit?

No. In ENSIA, an IT auditor tests the DigiD and Suwinet connections against their own frameworks. In ISO 27001, a certification body tests your entire management system. The evidence can, however, be largely the same.

What is the difference between 3000A and 3000D in ENSIA?

With 3000A, the auditor tests a statement from the executive board. With 3000D, the auditor tests directly against the standards. From 2026, municipalities account for DigiD and Suwinet under 3000D. You can read more about these variants on ISAE 3000 vs ISAE 3402.

More information

• BIO2 and ISO 27001: what the government baseline adds
• NIS2 and ISO 27001: the Cybersecurity Act behind the BIO2
• Internal audit: the basis for a reliable self-assessment
• Supplier management: agreements with chain suppliers