BIO checklist for municipalities: ten measures that often get left undone

The ENSIA year is under way and the questionnaire is coming. You know which questions you answer yes to with peace of mind, and at which ones you shift in your seat. This checklist is about that second group.

The Baseline Informatiebeveiliging Overheid (BIO) has applied since 2020 to all layers of government, from municipality to water authority. It replaced the BIG, the BIR and the BIWA and is based on ISO 27001 and 27002. Always use the current version; you can find it via digitaleoverheid.nl. Below are ten measures that turn out to be difficult, with for each point what you can do now. Where a deadline is our advice and not a standard, that is stated.

1. Policy that has really been adopted

An information security policy on paper is a start. It must also be up to date, adopted by the municipal executive and have an owner.

Action: look up the date of the last decision of the municipal executive on the policy. If it is older than a year, plan the revision. Make sure the role of CISO has been formally assigned.

2. Access rights that move with people

Who has access to which systems? Accounts of colleagues who have left quite often stay active, and rights are granted but rarely withdrawn.

Action: link joining and leaving to creating and closing accounts. Have system owners sign off their list of rights every quarter.

3. Encryption, internally too

Sensitive data should be stored and sent encrypted. The leak is often in internal connections and old file storage.

Action: use at least TLS 1.2 on all connections, internal ones too. Encrypt databases and backups. Record who manages the keys and how.

4. Logs that someone looks at

Most organisations do log. Looking at the logs in a structured way happens less often. The auditor always asks for that one log you just did not keep.

Action: bring the most important logs together in one place and decide what you look out for, such as failed sign-in attempts, new administrator rights and large exports. Record how long you keep logs and why. Our advice is at least twelve months, so that you can look back over a whole ENSIA year. That is advice, not a literal BIO requirement.

5. An incident plan that has been practised

A plan that has never been practised usually does not work at the moment it has to.

Action: practise at least once a year with a tabletop exercise. Also check the reporting routes. You report a data breach within 72 hours to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). Under the Cybersecurity Act, you also report a significant incident to the CSIRT that has been designated for your sector.

6. Backups you have restored

A backup that you have never restored is a hope, not a recovery plan.

Action: test every month whether you can really restore a backup. Record for each system how long it may be down and how much data you may lose, and test whether you achieve that.

7. Suppliers in view

A municipality works with dozens of suppliers and cloud services. The BIO requires that you know and manage their risks, and the Cybersecurity Act requires the same.

Action: keep a register of suppliers with access to municipal data. For each supplier, note which data, which country, under which law and which sub-processors. Include security requirements in contracts and data processing agreements. Such a register can stay short; for an example, look at our own list of sub-processors.

8. Patches with an agreed deadline

Unpatched systems are a well-known way in for attackers. The BIO requires a process to install security updates on time.

Action: agree deadlines per severity and measure whether you meet them. Our advice is critical patches within 48 hours and the rest within 30 days; that too is advice, not a literal BIO standard. Record exceptions and have the system owner sign off the residual risk.

9. Knowing which information is sensitive

What you have not classified, you cannot protect appropriately.

Action: use a simple scheme with a few levels and classify each system. Link the measures to each level, such as encryption or extra sign-in security.

10. Awareness that sticks

An annual e-learning is often clicked away. People remember what they experience themselves.

Action: combine a short annual training with phishing exercises throughout the year. Give administrators and directors a session of their own, because they run different risks.

ENSIA is the result of a whole year

Through ENSIA, municipalities account each year for the BIO and for systems such as DigiD, Suwinet and the base registers. The results go to the municipal council.

Good accountability does not start in November. Work through the ten points during the year and keep the evidence straight away. Then the questionnaire is a summary, not a search.

How Noveu sets up a workplace for municipalities, and how you start with a pilot, you can read on our page for the public sector.