BIO2 (2026)

Identify the internal and external issues that affect the organisation's ability to achieve the intended outcomes of its information security management system, and keep that understanding current.

Determine which parties are relevant to the ISMS, what their information security requirements are, and which of those requirements will be addressed through the management system.

Define and document the boundaries and applicability of the ISMS, taking account of the context, interested parties, interfaces, and dependencies with other organisations.

Establish, implement, maintain, and continually improve the ISMS, including the processes needed and their interactions, in line with this standard.

Top management must demonstrate active leadership for the ISMS: setting direction, ensuring resources, integrating security into business processes, and holding people accountable for results.

Top management must establish an information security policy that fits the organisation's purpose, sets objectives or a framework for them, commits to meeting requirements and to continual improvement, and is communicated and available.

Assign and communicate responsibility and authority for the ISMS, including who ensures it conforms to the standard and who reports on its performance to top management.

When planning the ISMS, consider the context and interested-party requirements to determine the risks and opportunities that must be addressed to assure intended outcomes, prevent undesired effects, and drive improvement.

Define and apply a repeatable risk assessment process with clear criteria, that identifies information security risks, their owners, and analyses and evaluates them to produce consistent, comparable results.

Define a risk treatment process that selects appropriate options and controls, compares them against Annex A, produces a Statement of Applicability, formulates a treatment plan, and obtains risk owner approval and acceptance of residual risk.

Set measurable information security objectives consistent with the policy, plan how to achieve them (what, resources, responsibility, timing, evaluation), and keep documented information about them.

When the organisation determines a need to change the ISMS, carry out those changes in a planned manner rather than ad hoc.

Determine and provide the resources needed to establish, implement, maintain, and continually improve the ISMS.

Determine the competence needed for people whose work affects information security performance, ensure they are competent through education, training, or experience, and retain evidence of it.

Ensure people doing work under the organisation's control are aware of the security policy, their contribution to the ISMS, and the implications of not conforming.

Determine the internal and external communications relevant to the ISMS: what to communicate, when, with whom, and how.

The ISMS must include the documented information required by the standard plus whatever the organisation deems necessary for its effectiveness.

When creating or updating documented information, ensure appropriate identification, format, and review and approval for suitability and adequacy.

Control documented information so it is available and suitable where needed and adequately protected, covering distribution, access, storage, version control, retention, and disposal, including documents of external origin.

Plan, implement, and control the processes needed to meet requirements and treat risks, keep documented information to give confidence processes ran as planned, and control planned and unintended changes.

Perform information security risk assessments at planned intervals and when significant changes occur, using the defined criteria, and retain the results as documented information.

Implement the risk treatment plan and retain documented information on the results of the treatment.

Determine what needs monitoring and measuring, by which methods, and when, so the ISMS's security performance and effectiveness can be evaluated, and retain the evidence.

Conduct internal audits at planned intervals to confirm the ISMS conforms to the organisation's own requirements and the standard, and that it is effectively implemented and maintained.

Plan, establish, and maintain an audit programme, defining criteria and scope, selecting objective auditors, and reporting results to relevant management, with documented evidence retained.

Top management must review the ISMS at planned intervals to ensure it remains suitable, adequate, and effective.

The management review must consider inputs such as prior action status, changes in context, interested-party needs, performance and audit results, feedback, risk assessment outcomes, and improvement opportunities.

The results of the management review must include decisions on continual improvement and any changes needed to the ISMS, and be retained as documented information.

Continually improve the suitability, adequacy, and effectiveness of the ISMS.

React to nonconformities, correct them, evaluate whether corrective action is needed to prevent recurrence, implement and review that action, and retain evidence of the nonconformity and the response.

Establish and maintain a documented information security policy, supported by topic-specific policies, that defines management direction and the organisation's approach to information security. Review periodically and after significant changes.

The organisation maintains an information security policy adopted by its administration. The policy covers strategic principles and preconditions (including alignment with overall security and information-management policy), how the information security function is organised, how line managers own chain, OT, privacy, and BCM responsibilities, the common reliability requirements that apply, how often the policy is reviewed, and how awareness is promoted. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Review the information security policy at least annually, aligned with governance and planning-and-control cycles and with external developments, and update it when needed. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Clearly define and assign who is responsible for which aspects of information security. Everyone with a stake should know what is expected of them and who to escalate to.

The board defines information security, privacy, OT, and BCM roles and responsibilities, including how those areas relate, with explicit attention to incident handling. Line managers and process owners who own assets also own the risks on those assets. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Appoint a CISO who may give independent advice and report on information security to the board and/or supervisory authority. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Split conflicting tasks across different people so no single person can both perform and conceal a fraud, error, or unauthorised action. Where organisation size makes this impractical, compensate with monitoring or review.

Management must actively require personnel and contractors to apply information security in line with policies and procedures, and must visibly support the security program.

Board members and employees regularly train to recognise and prevent cybersecurity risks and to respond to information security incidents. Board members also show they can judge how information security risks affect the organisation's services or products. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Maintain documented contacts with relevant authorities (law enforcement, regulators, national CERTs) so the organisation can engage them quickly when an incident or legal matter requires it.

Record which officials hold formal contacts with which agencies and regulators on information security, and refresh that overview at least annually. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Maintain contact with security communities, industry groups, and professional bodies to stay current on threats, defences, and best practices.

Collect and analyse information about current and emerging information security threats relevant to the organisation, and use what you learn to inform defences.

Build information security considerations into how projects are planned and run, so security requirements are addressed before delivery rather than retrofitted after.

For new information systems and for significant changes to existing ones, perform an explicit risk assessment using the organisation's established risk-management method so risks are identified and controlled and security requirements are set. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Maintain an inventory of information and information-processing assets, with each item having an identified owner accountable for it.

Keep an inventory of assets relevant to information processing, including OT, with the attributes needed for management and maintenance. Cover remote assets, cloud environments, and assets that regularly connect to the network but are not under the organisation's control. Verify completeness and accuracy on a cadence that matches how often things change. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Document and communicate rules for the acceptable use and handling of information and assets so users know what is and is not allowed.

Put the rules of conduct for using assets into contracts for external staff and volunteers, consistent with house rules or the internal code of conduct. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Ensure all employees have been formally made aware of the code of conduct for using assets. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Ensure personnel and external party users return all organisational assets in their possession on termination of employment, contract, or agreement.

Classify information by sensitivity and criticality so handling rules can apply consistently. The classification scheme should reflect legal, regulatory, and business needs.

Classify information in all information systems using an explicit risk assessment and a defined impact-classification method that is part of the established risk-management methodology. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Apply labels to information (digital or physical) so its classification is visible and the right handling rules are applied automatically.

Establish rules and controls for transferring information inside the organisation and to external parties, covering electronic, physical, and verbal transfer.

Keep internet-facing information systems and email communications compliant with the mandatory standards published by the Netherlands Standardisation Forum and under the Cybersecurity Act (Cbw). Monitor compliance with internet.nl measurements and configure components for strong security without breaking the service. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Use at least publicly trusted Organisation Validated (OV) certificates for public web traffic that carries sensitive data. For sensitive data in internal web traffic, use at least public OV certificates or private PKIoverheid certificates. A risk assessment, connection conditions, or law may require stronger certificates. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Advanced and/or qualified electronic signatures comply with the AdES Baseline Profiles on the Netherlands Standardisation Forum open-standards list. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Keep up-to-date records of all internet-facing information systems, web applications, IP addresses, and APIs. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Publish publicly accessible websites via the Government Register of Internet Domains and refresh that information at least every six months. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Define and enforce rules that govern who gets access to which information and other assets, based on business and security requirements.

Allow access to a trusted zone only from authenticated devices or from software running in a secure enclave. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Manage the full lifecycle of identities used by people and systems — creation, modification, removal — so each identity is tied to a real, accountable owner.

Operate a comprehensive formal registration and de-registration procedure for managing user identities. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Do not use group accounts unless the process owner motivates and records the exception and coordinates it with the CISO. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Manage authentication information (passwords, keys, tokens) securely throughout its lifecycle: allocation, storage, distribution, rotation, and revocation.

Apply MFA at least for primary logins to the digital workplace, accounts for internet-facing services, administrative accounts, and other cases where risk analysis calls for it. Use passwordless access (for example PIN plus hardware token or passkey) or password plus a second factor. Where MFA is impossible, take other mitigating measures with CISO involvement and process-owner approval. Prefer combining MFA with federation such as single sign-on and a stepping-stone where safe. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Provide all employees with a password manager or an equivalent solution. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Enforce password requirements automatically. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Provision, review, modify, and revoke access rights in line with the organisation's access control policy. Reviews should happen periodically and on role change.

Monitor creation of and changes to accounts with special privileges and respond when such an event is unexpected or unauthorised. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Review all issued access rights at least once a year. Use a risk assessment to decide whether a higher review frequency is needed for particular rights or environments. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Identify and document the information security risks associated with supplier relationships, and put processes in place to manage them.

When a request for proposal involves information or information systems, include information security requirements from the outset. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Capture the organisation's information security expectations in contracts with suppliers, scaled to the type of access and relationship involved.

Carry the security requirements from the request for proposal explicitly into (procurement) contracts with suppliers. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Explicitly exclude suppliers' general terms and conditions where they conflict, and record any additional terms that apply. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Require in the procurement contract that the supplier demonstrates design, existence, and operation of the required controls through assessments by independent third parties. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Independently investigate and validate reports the supplier provides about its security posture. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Agree that the supplier is transparent about vulnerabilities and information security incidents that affect the contracted services. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Before concluding a contract, assess whether dependency on a particular supplier creates unacceptable risk and address that risk. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Define and manage information security requirements specifically for the ICT supply chain (hardware, software, services) to address risks like tampered components and compromised vendors.

Before the contract is concluded, require the supplier to show the chain of subcontractors relevant to the service. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Ensure security requirements imposed on the supplier apply equally and fully down the subcontractor chain. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

During the contract, require the supplier to communicate changes in the subcontractor chain that affect security. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Include supply-chain security in the organisation's risk analysis and keep that analysis current for the contracted services. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Regularly monitor, review, and audit supplier security practices and service delivery; manage changes to supplier services so security posture is not degraded over time.

Using evidence from the supplier (see 5.20.03), the process owner annually reviews supplier compliance with information security requirements, follows up on deviations, and records the outcome. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Keep an up-to-date registration of suppliers and concluded contracts. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Establish processes for acquiring, using, managing, and exiting cloud services in line with the organisation's information security requirements.

Establish and apply a policy for inventorying, classifying, selecting, assuring, and overseeing use of cloud and similar external information services. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Plan and prepare for managing information security incidents — define roles, processes, communication paths, and decision-making authority before an incident occurs.

Give all internal and external employees access to a low-threshold desk where they can report (suspected) information security incidents. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Document the notification desk's tasks and responsibilities in an incident reporting procedure. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

The process owner is responsible for resolving information security incidents. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Each month the process owner reports on follow-up of information security incidents to the agreed governance forum. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

The information security incident procedure references the crisis-management procedure where escalation may be needed. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

The incident procedure states at least that information security incidents are reported to the CSIRT within the statutory time, that CSIRT notifications are received, assessed, and fed into risk treatment, and that PII principals are notified within the statutory time. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Design and publish a Coordinated Vulnerability Disclosure (CVD) procedure consistent with applicable Dutch government CVD guidance. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Assess reported information security events and decide whether each one should be classified as an incident, with documented criteria for that decision.

Respond to information security incidents according to documented procedures, with appropriate escalation, containment, communication, and recovery steps.

Handle information security incidents through the incident-management process, including when relevant incidents must be reported to the regulatory authorities named in law and regulations. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

After incidents, capture lessons learned and feed them back into policies, procedures, and controls to reduce the likelihood and impact of recurrence.

Assess information security incidents to find root causes and implement improvements that reduce recurrence. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Share incident analysis reports, including root causes and improvements, with parties that need them for learning and oversight. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Establish procedures for identifying, collecting, acquiring, and preserving evidence related to information security events in a way that is defensible in disciplinary or legal proceedings.

Define and apply a retention period for (suspected) information security incidents and for the information needed to investigate them, consistent with legal and business needs. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Plan how information security is maintained during disruption (outages, crises, recovery) so security does not lapse when the organisation is under stress.

Plan, implement, maintain, and test the ICT readiness needed to meet business continuity objectives and recovery time/point requirements.

Every year the process owner tests continuity plans for effectiveness, completeness, and currency. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

In the inventory for control 5.12, the process owner identifies critical systems using the established risk-management methodology and an explicit risk assessment, and updates that overview at least every three years. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Identify, document, and keep up to date the legal, statutory, regulatory, and contractual requirements relevant to information security, along with the organisation's approach to meeting them.

Implement procedures to ensure compliance with intellectual property rights — licensing, attribution, restrictions on use — for software and other protected material. Per the BIO2 FAQ, this control is excepted from Cyberbeveiligingswet (Cbw) legal duty and remains obligatory BIO self-regulation.

Protect records from loss, destruction, falsification, unauthorised access, and unauthorised release, in line with legal, regulatory, contractual, and business requirements. Per the BIO2 FAQ (which prevails over the v1.3 PDF marking), this control stays in Cyberbeveiligingswet (Cbw) scope and remains a legal duty under the Cyberbeveiligingsregeling sector Overheid.

The process owner records retention periods for all information and information systems in applicable selection lists (including under the Archiefwet). Per the BIO2 FAQ, this government measure is excepted from Cyberbeveiligingswet (Cbw) legal duty and remains obligatory BIO self-regulation. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Identify and meet privacy and personally identifiable information (PII) protection requirements applicable to the organisation, including those imposed by law and regulation. Per the BIO2 FAQ, this control is excepted from Cyberbeveiligingswet (Cbw) legal duty and remains obligatory BIO self-regulation.

Independently review the organisation's approach to managing information security and its implementation at planned intervals or after significant changes.

Maintain an established audit plan that decides each year which systems and processes are audited for information security. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Verify that information security is being implemented and operated in accordance with the organisation's policies, rules, and applicable standards.

Within the planning-and-control cycle and as part of PDCA, report on information security performance and on conformity with policy and with BIO2 measures. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Document operating procedures for information processing activities and make them available to those who need them, so consistent execution is possible across the team.

Perform background verification checks on candidates for employment proportional to the role's access to information and risk, in line with applicable law.

Maintain an established screening policy. On hire and on job change, a Certificate of Conduct (VOG) may be requested based on a risk assessment. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Employment contracts should state the employee's and the organisation's responsibilities for information security, so expectations are unambiguous from day one.

On hire or job change, ensure internal and external employees accept terms that cover information security responsibilities and sanctions. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Provide ongoing awareness, education, and training for all personnel (and relevant external parties) on the organisation's information security policies and their role in upholding them.

Make clear that employees, line managers, and board members share responsibility for protecting business information and information systems. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Ensure employees and contractors who use information systems and services have successfully completed the required awareness activities before or as they gain access. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Reinforce information security expectations on appointment, internal transfer, and in team meetings or performance reviews. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Cover behavioural aspects of secure mobile working in awareness programmes. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Establish a formal disciplinary process for personnel who have committed an information security breach, and communicate it so it acts as a deterrent.

Define and enforce information security responsibilities that remain in effect after termination or change of role, and make sure they are communicated at the relevant moments.

Use confidentiality or non-disclosure agreements that reflect the organisation's information protection needs, with personnel and relevant external parties, and review them periodically.

Implement security measures specific to remote working to protect information accessed, processed, or stored outside the organisation's premises.

Provide a clear mechanism for personnel to report observed or suspected information security events promptly, without friction or fear of blame.

Ensure all internal and external employees can show they have taken note of the procedure for reporting information security events and weaknesses. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Define and use physical security perimeters to protect areas containing information and information processing facilities.

Do not make critical information or information systems reachable through only one secure zone; use layered zoning. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Protect secure areas with appropriate entry controls so only authorised people can enter, with records of who went where and when.

When specific physical security risks arise, send warnings according to mutual agreements with the parties that need to act. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Design and apply physical security measures to offices, rooms, and facilities containing information and information processing assets.

Continuously monitor physical premises for unauthorised access using appropriate detection mechanisms — alarms, surveillance, intrusion detection.

Design and implement protection against physical and environmental threats — fire, flood, earthquake, civil unrest — proportional to the risk and the value of the assets at stake.

Define and apply security measures for working in secure areas, including supervision of personnel and control of equipment brought in or taken out.

Apply clear-desk and clear-screen rules to reduce the risk of unauthorised access to information left visible on desks or on unattended screens.

Where a chip-card token controls system access, the access lock engages automatically when the token is removed. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Site equipment so it is protected from environmental threats, opportunities for unauthorised observation, and physical interference.

Protect assets that are taken off-premises (laptops, devices, documents) with measures appropriate to the risks they face outside the secure perimeter.

Manage storage media (USB drives, tapes, disks, removable media) throughout their lifecycle — acquisition, use, transport, disposal — with classification-appropriate protection.

Removal instructions require that business-sensitive content has been irretrievably removed from reusable removable media that leave the organisation. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Check that all data on the medium were removed irretrievably and record that check. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Using couriers or forwarders to transport classified information meets predefined security requirements. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Protect information processing facilities from disruption caused by failures in supporting utilities — power, cooling, water, telecommunications.

Protect power, data, and telecommunications cabling against interception, interference, or physical damage.

Maintain equipment correctly to ensure continued availability and integrity of information, and protect information when equipment is being serviced (especially by external technicians).

Verify that sensitive data and licensed software has been removed or securely overwritten before equipment is disposed of, sold, or re-used.

Protect information stored on, processed by, or accessible from user endpoint devices (laptops, mobile devices, workstations) through configuration, policy, and centralised management.

Configure mobile equipment so business information is not stored on user devices unless an approved exception applies. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

When mobile equipment is used, at least: keep the device under patch management and hardening; use MDM or MAM; and have users sign a mobile-working agreement acknowledging mobile risks for every business-used mobile device. Check these three points periodically. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Restrict, review, and monitor the allocation and use of privileged access rights — those that grant broader permissions than ordinary users — so they are used only when necessary.

At least quarterly, assess assigned or exercised special privileges for necessity and correct use. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Restrict access to information and other assets in line with the access control policy, so people can only reach what they need for their role.

Safeguard physical and/or logical isolation of information of specific importance from other information. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Users may view and process information of specific importance only as needed for their tasks. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Restrict access to program source code, software libraries, and related artefacts to authorised personnel, and manage changes through documented processes.

Implement secure authentication technologies and procedures appropriate to the sensitivity of what is being protected, including multi-factor authentication where warranted.

Before granting network access to external suppliers, perform a risk assessment to set the conditions of that access. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Monitor and adjust resource usage so the required system performance, capacity, and availability are sustained as demand evolves.

Implement layered protection against malware — detection, prevention, recovery, and user awareness — to keep systems and information safe from malicious code.

Control and restrict downloads based on risk and need-to-use, supported by antimalware appropriate to the environment. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Inform users about risks of browsing behaviour and of clicking unknown links. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Keep antimalware and related recovery software up to date and backed by periodic updates from the vendor. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Run malware scans on servers, desktops, and gateways (including mail) and on other environments where risk requires it. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Identify, assess, and remediate technical vulnerabilities in systems and software in a timely way, with priority based on risk.

When both likelihood of abuse and expected damage of a vulnerability warning are high, treat remediation as urgent. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Base how mitigating measures are implemented on an explicit risk assessment. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Meanwhile, or if installation cannot be finished within a week, apply mitigating measures that reduce exposure. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Check information systems for technical compliance with security standards and for actual security configuration. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Where possible, run an obligatory automated penetration test on internet-facing information systems at every new release or major update. If high-risk findings cannot be mitigated otherwise, do not take the system into operation. Test all internet-facing systems for weaknesses at least annually. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Establish and maintain secure configurations for hardware, software, services, and networks, and manage changes to those configurations under formal control.

Delete information stored in systems, devices, and other media when it is no longer required, using methods appropriate to its classification.

Where appropriate, apply data masking techniques (anonymisation, pseudonymisation, tokenisation) to limit exposure of sensitive data — especially in non-production environments.

Apply measures to detect and prevent the unauthorised disclosure or exfiltration of sensitive information from systems, networks, and endpoints.

Maintain backups of information, software, and system images, and test restoration regularly to ensure recoverability after loss or corruption.

Maintain a backup policy that defines storage and protection requirements, with particular attention to protecting backups against ransomware and preserving backup integrity. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Determine maximum permissible data loss and maximum recovery time after an incident based on an explicit risk assessment. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Store backups so that a site-level incident does not also destroy the recoverable copies. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Test the recovery procedure at least annually and after major changes so it works under emergency conditions. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Implement redundancy in information processing facilities sufficient to meet availability requirements set by the business.

Produce, store, and protect logs of events, exceptions, faults, and security-relevant activity, and make sure they are useful for investigation later.

Each log entry records at least the action, the object affected, the result, the origin (device or network location), the actor (person or process), and a timestamp. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Log entries must not contain data that could themselves lead to a security breach. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Maintain a list of the log files that are generated. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Set retention for log files and SIEM data on the basis of risk, including scenarios where attackers stay undetected for a long time. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Treat improper modification or deletion of log data (or attempts) as an information security incident and report it quickly under the incident procedure tied to control 5.24. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Based on an explicit risk assessment, regularly verify that log files still exist unchanged during their retention period. An independent official, separate from operations, performs that verification. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Continuously monitor networks, systems, and applications for anomalous behaviour and potential security events, and act on what is detected.

Share new threats or attacks discovered under government measure 8.16.03 with the designated CERT within the applicable legal framework. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

SIEM and/or SOC monitoring processes include clear rules for when an incident is reported to the responsible managers. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Monitor the information-processing environment with a detection-and-response solution that can detect attacks and treat nonconformities adequately and in time. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Active network components include logging and log-monitoring functions so anomalous events can be detected and handled. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Synchronise the clocks of all information processing systems to a reliable time source so logs and events can be correlated accurately across systems.

Restrict and tightly control the use of utility programs that could override system or application controls, since they are a frequent vector for abuse.

Restrict system utilities to authorised staff and only for the tasks that require them. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Log use of system utilities and keep those logs available for investigation. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Implement procedures to control the installation of software on operational systems, including approval workflows and limits on who can install what.

Control the risk that users install software that has not been authorised. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Manage and control networks to protect the information in systems and applications connected to them.

Network components meet at least the confidentiality level of the network they belong to. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Separate access to network-component management interfaces from the user network as far as practicable. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Define and document the security mechanisms, service levels, and management requirements of all network services, whether provided internally or externally.

At connection points with external or untrusted zones, and because of network segmentation, take measures that flag and mitigate potential attacks that would harm availability of information provision. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Deploy detection tools that monitor and analyse data traffic to and from the trusted environment. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Pass on and share within government any new threats identified under 8.21.02, respecting applicable legal frameworks. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Encrypt data sent over wireless links such as Wi-Fi and over wired links outside the controlled area, except metadata needed to establish the transmission. Base encryption configuration on risk, required duration, and protection level. Prefer tools with a positive NBV/AIVD Resilience Unit deployment advice when available; otherwise select and configure another suitable method. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Segregate networks into separate groups (by service, user community, sensitivity) and control traffic between them with rules appropriate to each segment.

Give each segregated group its own security level matched to its trust requirements. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Manage access to external websites to reduce exposure to malicious content and unwanted services.

Define and implement rules for the effective use of cryptography, including cryptographic key management, for protecting information confidentiality, integrity, and authenticity.

The cryptography policy covers at least when cryptography is used, who implements it, who manages keys, how applied cryptography is recorded and where, which standards underpin cryptography and how they stay current, and how compliance is checked. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Include cryptographic controls in the business-asset inventory and record the information each control protects. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Base cryptographic strength on current NCSC and AIVD recommendations. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Agree backup certificates from an alternative supplier when the risk assessment shows dependence on a single certificate supplier is unacceptable. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Establish and apply rules for secure software and systems development across the entire development lifecycle, not just at security review gates.

Identify, specify, and approve information security requirements for new or modified applications before development or acquisition begins.

Establish, document, and apply secure architecture and engineering principles to the design and implementation of information systems.

Adopt, document, maintain, and apply architectural principles such as security by design and security by default for all activities in developing information systems. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Apply secure coding principles and standards during software development to reduce the introduction of vulnerabilities.

Include security testing in development and acceptance processes so vulnerabilities are caught before software reaches production.

Use structured methodologies for system acceptance testing, automate the tests where possible, and record the results in a report. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

When outsourcing software development, define and enforce the security requirements that apply to the development activity and its outputs, and verify they are met.

Apply internal system-development measures in full to outsourced development, with any extra controls the outsourcing arrangement requires. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Keep development, test, and production environments separated to reduce the risk of unauthorised access or unintended changes affecting production.

Do not test in production. Allow departures only with an approved exception that states compensating controls. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Always test significant changes to the production environment before they go live. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Subject changes to information processing facilities and systems to formal change management processes that control the risk of unintended consequences.

Change management at least administers changes including test-plan results, assesses potential consequences with a written rollback plan, and follows an approval procedure for changes. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Conduct change management using a generally accepted management framework suited to the organisation. This government measure is BIO2 Basishygiëne and is a Cyberbeveiligingswet (Cbw) legal duty for network and information systems. Exclude this government measure only when it does not apply to the organisation; do not exclude it merely because residual risk looks acceptable.

Select and protect test data carefully; avoid using real personal data in non-production environments unless adequately masked or otherwise protected.

Plan and agree audit tests of operational systems with management to minimise disruption to business processes during the test.