BIO2 for suppliers (2026)
BIO2 for suppliers (2026) lists what BIO2 (Baseline Informatiebeveiliging Overheid 2) v1.3 makes a customer demand of its suppliers, written from the supplier's side: what you show, accept, or agree with a customer that is bound by BIO2. It holds the government measures 5.20.03 to 5.20.06 that every supplier meets, and the optional 5.21.02 to 5.21.04 for a supplier with subcontractors and 8.30.01 for a supplier that develops software for its customer. Adopt BIO2 too for the controls your service has to meet, such as multi-factor authentication, logging, and patching; this Framework does not repeat them. The body text in this catalog consists of plain-language summaries authored for ISMS, not the verbatim text of BIO2. Customers needing the authoritative baseline should reference the official BIO2 page at https://www.bio-overheid.nl/bio2/bio-producten/baseline-informatiebeveiliging-overheid-2-bio2/.
Requirement bodies below are plain-language summaries authored by Compliance. For the verbatim text of the standard, reference the publication from your national standards body (NEN, BSI, ANSI, ...).
Organizational (7)
Show your customer each year, through examinations by independent third parties, that you meet the security requirements of the contract in design, existence, and operation. The examinations cover the contracted service and how you manage your own suppliers.
Accept that your customer examines your service and your reports itself, and keep an external audit open to it as a possibility in the contract.
Be open with your customer about vulnerabilities in your service and about information security incidents, data breaches included, so that the customer can respond in time.
Agree an exit strategy with your customer and make it a fixed part of the contract, so that the customer can leave your service in a controlled way.
Give your customer insight into your chain of subcontractors and the risks in it before the contract is signed. Decide this in when you use subcontractors for the service, and exclude it with a reason when you do not.
Apply the security requirements of your customer in full down your subcontractor chain, and explain with reasons every requirement you leave out there. Decide this in when you use subcontractors for the service, and exclude it with a reason when you do not.
During the contract, tell your customer about changes in your subcontractor chain and the risks they bring, and at least about vulnerabilities and incidents that can affect the service. Decide this in when you use subcontractors for the service, and exclude it with a reason when you do not.
Technological (1)
Apply your customer's own system-development controls in full when you develop software for the customer, together with any extra controls the arrangement needs. Decide this in when you develop software for the customer, and exclude it with a reason when you do not.