Frameworks

Name

Adopted

Description

EU GDPR (2016)

Adopted

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1-88 — eur-lex.europa.eu/eli/reg/2016/679/oj. Directly applicable EU law since 25 May 2018 to any controller or processor handling personal data of people in the EU, regardless of establishment. This catalog is modelled at EU level only — member-state implementing laws (e.g. the Dutch Uitvoeringswet AVG) are out of scope, and UK GDPR — a distinct instrument since Brexit — is modelled separately as the sibling `uk-gdpr-2021` catalog; an organisation operating in both jurisdictions adopts both. Institutional matters (supervisory authorities, penalties, cooperation and consistency mechanisms, final provisions) are not modelled as Requirements; see the Regulation directly for those. Bodies in this catalog are plain-language summaries authored for this product, restating each obligation in terms a non-lawyer can act on — not verbatim statute text. There is no unified GDPR 'certificate'; coverage here is a working record of compliance, not an accreditation.

ISO 27001:2022

Adopted

ISO/IEC 27001:2022 reference control set (Annex A). 93 controls grouped into four themes: Organizational, People, Physical, Technological. The body text in this catalog consists of plain-language summaries authored for ISMS, not the verbatim text of the standard. Customers needing the authoritative control text should reference ISO/IEC 27002:2022 from their national standards body (NEN in NL, BSI in UK, ANSI in US, etc.).

NIS2

Adopted

Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024, OJ L, 2024/2690, 18.10.2024 — eur-lex.europa.eu/eli/reg_impl/2024/2690/oj — which sets the technical and methodological requirements of the cybersecurity risk-management measures of Article 21(2) of Directive (EU) 2022/2555 (NIS2) for eleven entity types: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. The 13 Requirements are the 13 sections of the Regulation's annex, and they bind only those eleven types; each one is optional, so an Account of another type decides them out. Other entities under NIS2 owe their duties through national law: the national duties live in the country Sub-frameworks, and a Sub-framework is a Framework for one country that follows NIS2 and is adopted together with NIS2, by the countries the Account lists. The Regulation's articles on significant incidents (Articles 3 to 14) are not modelled as Requirements; see the Regulation directly for them. Bodies in this catalog are plain-language summaries authored for this product, restating each obligation in terms a non-lawyer can act on — not verbatim law. There is no NIS2 'certificate'; coverage here is a working record of compliance, not an accreditation. This product is not endorsed by the European Union, the European Commission, or any government.

Countries: Netherlands · Change

NIS2 Netherlands (Cbw, 2026)

Adopted

Cyberbeveiligingswet (Cbw, BWBR0052872, https://wetten.overheid.nl/BWBR0052872) and Cyberbeveiligingsbesluit (BWBR0052875, https://wetten.overheid.nl/BWBR0052875) on wetten.overheid.nl, in one catalog, as in force since 15 August 2026: the Dutch law that carries Directive (EU) 2022/2555 (NIS2). The Cbw sets the duty of care, the board's approval and training, the reporting of significant incidents and registration; the Besluit sets the measures (arts. 6 to 18) that elaborate the duty of care. The measures of arts. 6 to 18 are optional because the Besluit does not apply them to the eleven entity types of Commission Implementing Regulation (EU) 2024/2690 (art. 4), which have their measures in the NIS2 Framework instead; an entity that is only partly one of those types keeps both sets. The rules that elaborate a duty are cited from that duty and are not catalogs of their own: the Besluit's arts. 20 to 25 and 27, the Cyberbeveiligingsregeling sector overheid (BWBR0052963, https://wetten.overheid.nl/BWBR0052963), and the Cyberbeveiligingsregeling IenW (BWBR0052878, https://wetten.overheid.nl/BWBR0052878), which covers waterschappen and sectors such as transport and drinking water. Government bodies meet the Besluit's measures through ISO 27001 and the BIO2 government measures, under the Cyberbeveiligingsregeling sector overheid; adopting BIO2 beside this Framework turns BIO2 coverage into Coverage proposals. This is the Netherlands Sub-framework of NIS2: it is adopted with NIS2 by Accounts that list the Netherlands in Countries. Bodies in this catalog are plain-language summaries authored for this product, not verbatim law; the Dutch companion carries the official text. There is no NIS2 'certificate'; coverage here is a working record of compliance, not an accreditation. This product is not endorsed by the Dutch government, the European Union, or any government.

BIO2 (2026)

BIO2 (Baseline Informatiebeveiliging Overheid 2) v1.3 management-system clauses, ISO 27002-aligned Part 2 controls, and Part 2 government measures. The body text in this catalog consists of plain-language summaries authored for ISMS, not the verbatim text of BIO2 or ISO/IEC 27001/27002. Customers needing the authoritative baseline should reference the official BIO2 page at https://www.bio-overheid.nl/bio2/bio-producten/baseline-informatiebeveiliging-overheid-2-bio2/.

BIO2 for suppliers (2026)

BIO2 for suppliers (2026) lists what BIO2 (Baseline Informatiebeveiliging Overheid 2) v1.3 makes a customer demand of its suppliers, written from the supplier's side: what you show, accept, or agree with a customer that is bound by BIO2. It holds the government measures 5.20.03 to 5.20.06 that every supplier meets, and the optional 5.21.02 to 5.21.04 for a supplier with subcontractors and 8.30.01 for a supplier that develops software for its customer. Adopt BIO2 too for the controls your service has to meet, such as multi-factor authentication, logging, and patching; this Framework does not repeat them. The body text in this catalog consists of plain-language summaries authored for ISMS, not the verbatim text of BIO2. Customers needing the authoritative baseline should reference the official BIO2 page at https://www.bio-overheid.nl/bio2/bio-producten/baseline-informatiebeveiliging-overheid-2-bio2/.

Cyber Essentials (2025)

NCSC-backed UK scheme (delivered by IASME) covering 5 mandatory technical control themes, self-assessed via a marked questionnaire with board-level sign-off. Cyber Essentials Plus adds independent technical testing on top of the same 5 themes and is represented here as the two optional requirements below — adopt both together, since Plus is assessed as a single pass/fail outcome by an independent tester, not requirement-by-requirement; adopting only one does not correspond to any real certification state. Bodies in this catalog are plain-language summaries authored for this product, not verbatim text from NCSC's published 'Cyber Essentials: Requirements for IT Infrastructure v3.2, April 2025'. Customers needing the authoritative requirement text should reference that document directly via ncsc.gov.uk.

Cyber Essentials (2026)

NCSC-backed UK scheme (delivered by IASME) following 'Cyber Essentials: Requirements for IT Infrastructure v3.3, April 2026'. It covers 5 mandatory technical control themes, self-assessed via a marked questionnaire with board-level sign-off. Cloud services that host the organisation's data or services must be in scope and cannot be excluded from it. Cyber Essentials Plus adds independent technical testing on top of the same 5 themes and is represented here as the two optional requirements below — adopt both together, since Plus is assessed as a single pass/fail outcome by an independent tester, not requirement-by-requirement; adopting only one does not correspond to any real certification state. Bodies in this catalog are plain-language summaries authored for this product, not verbatim text from NCSC's published document. Customers needing the authoritative requirement text should reference that document directly via ncsc.gov.uk.

Dutch Arbo (1998)

Employer duties under the Dutch Working Conditions Act (Arbeidsomstandighedenwet, BWBR0010346) and the Working Conditions Decree (Arbobesluit, BWBR0008498) on wetten.nl (https://wetten.overheid.nl/BWBR0010346 and https://wetten.overheid.nl/BWBR0008498). The Working Conditions Regulation (Arboregeling, BWBR0008587, https://wetten.overheid.nl/BWBR0008587) is the detail layer — limits, methods, and forms — cited from a duty when that duty depends on one. It is not a third catalog. Bodies are English paraphrases for this product, not the statute.

EU AI Act (2024)

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), OJ L, 2024/1689, 12.7.2024 — eur-lex.europa.eu/eli/reg/2024/1689/oj, as amended by Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), OJ L, 2026/1744 — eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202601744. Applies in phases: prohibited practices and AI literacy since 2 February 2025, with two further prohibitions (intimate images without consent, child sexual abuse material) from 2 December 2026; obligations for general-purpose AI (GPAI) models since 2 August 2025; transparency obligations since 2 August 2026; high-risk AI system obligations from 2 December 2027 for the systems listed in Annex III and from 2 August 2028 for AI embedded in already-regulated products (Annex I). This catalog is authored as of October 2026 — the requirements below reflect obligations that are, or are becoming, applicable by that date, plus the high-risk obligations of December 2027 and August 2028 included now as optional so you can prepare ahead of time. Institutional matters (governance bodies, penalties, conformity-assessment procedure detail, final provisions) are not modelled as Requirements. Bodies are plain-language summaries authored for this product, not verbatim statute text.

ISO 14001:2015

ISO 14001:2015 environmental management system requirements, clauses 4 through 10. Every clause is a mandatory management-system requirement that always applies; this framework has no scope-excludable or Annex A-style controls, so its Statement of Applicability is empty. The body text consists of plain-language summaries authored for this product, not the verbatim text of the standard; customers needing the authoritative requirement text should reference ISO 14001:2015 from their national standards body.

ISO 14001:2026

ISO 14001:2026 environmental management system requirements, clauses 4 through 10. Every clause is a mandatory management-system requirement that always applies; this framework has no scope-excludable or Annex A-style controls, so its Statement of Applicability is empty. This 2026 edition adopts the updated Harmonized Structure and folds in the 2024 climate-change amendment (clauses 4.1 and 4.2), adds a new 'Planning of changes' clause (6.3), separates risks and opportunities (6.1.4) from planning of action (6.1.5), and subdivides management review (9.3.1-9.3.3). The body text consists of plain-language summaries authored for this product, not the verbatim text of the standard; customers needing the authoritative requirement text should reference ISO 14001:2026 from their national standards body.

ISO 42001:2023

ISO/IEC 42001:2023 artificial intelligence management system. Includes the mandatory management-system clauses 4 through 10, plus the Annex A reference controls for responsible development and use of AI, which are subject to the applicability decision recorded in the Statement of Applicability. The body text consists of plain-language summaries authored for this product, not the verbatim text of the standard; customers needing the authoritative text should reference ISO/IEC 42001:2023 from their national standards body.

ISO 9001:2015

ISO 9001:2015 quality management system requirements, clauses 4 through 10. Most clauses are mandatory management-system requirements that always apply; design and development (8.3.1 to 8.3.6) may be excluded from scope where the organisation does not carry it out. The body text consists of plain-language summaries authored for this product, not the verbatim text of the standard; customers needing the authoritative requirement text should reference ISO 9001:2015 from their national standards body.

ISO 9001:2026

ISO 9001:2026 quality management system requirements, clauses 4 through 10. Most clauses are mandatory management-system requirements that always apply; design and development (8.3.1 to 8.3.6) may be excluded from scope where the organisation does not carry it out. This 2026 edition follows the updated Harmonized Structure and folds in the 2024 climate-change amendment, splits risks and opportunities into 6.1.1-6.1.3, gives internal audit subclauses 9.2.1-9.2.2 titles, merges continual improvement into 10.1, and adds quality culture and ethical behaviour to leadership and awareness. The body text consists of plain-language summaries authored for this product, not the verbatim text of the standard; customers needing the authoritative requirement text should reference ISO 9001:2026 from their national standards body.

NIS2 for suppliers

NIS2 for suppliers lists what Annex 5 of Commission Implementing Regulation (EU) 2024/2690 makes a customer demand of its suppliers and service providers, written from the supplier's side: what you show, meet, or allow when your customer is bound by that Regulation. Its Requirements apply only to suppliers of the eleven entity types the Regulation covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. Each Requirement is optional, so a supplier whose customers are not of those types decides them out. Adopt NIS2 too for the measures your own service has to meet; this Framework does not repeat them. National duties follow from the country Sub-frameworks, which are adopted with this Framework for the countries you list. The body text in this catalog consists of plain-language summaries authored for ISMS, not the verbatim text of the Regulation. Customers needing the authoritative text should reference the official Regulation at https://eur-lex.europa.eu/eli/reg_impl/2024/2690/oj.

Countries: Netherlands · Change

NIS2 Netherlands for suppliers (Cbw, 2026)

NIS2 Netherlands for suppliers (Cbw, 2026) lists what the Cyberbeveiligingswet (Cbw, BWBR0052872, https://wetten.overheid.nl/BWBR0052872) and the Cyberbeveiligingsbesluit (BWBR0052875, https://wetten.overheid.nl/BWBR0052875) make a customer demand of its suppliers and service providers, written from the supplier's side: what you give, meet, or apply when your customer is bound by the Dutch law that carries Directive (EU) 2022/2555 (NIS2). It holds Cbw art. 21 and Cbb art. 10, which every supplier meets, and Cbb art. 11, which is optional and applies to a supplier that develops or maintains the customer's network and information systems. This is the Netherlands Sub-framework of NIS2 for suppliers: it is adopted with NIS2 for suppliers by Accounts that list the Netherlands in Countries. Adopt NIS2 Netherlands (Cbw, 2026) too for the measures your own service has to meet; this Framework does not repeat them. The body text in this catalog consists of plain-language summaries authored for ISMS, not the verbatim text of the law. Customers needing the authoritative text should reference wetten.overheid.nl at the links above. This product is not endorsed by the Dutch government, the European Union, or any government.

SOC 2 (TSC 2017, rev 2022)

AICPA Trust Services Criteria (2017, revised 2022). 61 criteria across five categories: Common Criteria (security baseline, mandatory in every SOC 2 report) plus the optional Availability, Confidentiality, Processing Integrity, and Privacy categories. Bodies in this catalog are ISMS-authored paraphrases of the published points-of-focus, not verbatim AICPA text. Customers needing the authoritative criteria text should reference the AICPA TSP Section 100 publication directly.

UK GDPR (2021)

The UK General Data Protection Regulation — the retained EU Regulation (EU) 2016/679, which became standalone UK domestic law at the end of the Brexit transition period on 31 December 2020/1 January 2021 (legislation.gov.uk/eur/2016/679) — read together with the Data Protection Act 2018 (DPA 2018, legislation.gov.uk/ukpga/2018/12), which supplies UK-specific detail (e.g. Schedule 1 special-category conditions, s.9 age of consent). Both are amended by the Data (Use and Access) Act 2025 (DUAA, legislation.gov.uk/ukpga/2025/18); this catalog was verified against legislation.gov.uk on 22 October 2026 and folds in the DUAA changes commenced by that date (recognised legitimate interests, the reworked automated-decision-making regime, DSAR search-effort and timing changes, and the controller complaint-handling duty), with any change not yet in force stated as prose rather than presented as binding. Applies to any controller or processor handling personal data of people in the UK, regardless of establishment, for general processing — the DPA 2018 law-enforcement (Part 3) and intelligence-services (Part 4) regimes are separate legal regimes and are not modelled here. The Information Commission is the supervisory authority throughout; it replaced the Information Commissioner's Office (the Commissioner and his Office) on 30 September 2026 (DUAA s.118(4); S.I. 2026/1015, reg. 2(b)). This catalog is modelled at UK level only and is a distinct instrument from EU GDPR — see the sibling `eu-gdpr-2016` catalog for EU-level processing; an organisation operating in both jurisdictions adopts both. National variants such as the Dutch Uitvoeringswet AVG remain out of scope. Institutional matters (the Information Commission's constitution, penalties, cooperation mechanisms, final provisions) are not modelled as Requirements; see the Regulation and DPA 2018 directly for those. Bodies in this catalog are plain-language summaries authored for this product, restating each obligation in terms a non-lawyer can act on — not verbatim statute text. There is no unified UK GDPR 'certificate'; coverage here is a working record of compliance, not an accreditation.

Frameworks

Are you sure?

Leave this page?