BIO2 in a small municipality: how to do the gap analysis

Your municipal secretary or director asks how things stand with BIO2. You have a BIO self-evaluation, a list of measures and an ENSIA accountability report. What is missing is an overview of what BIO2 asks differently from the BIO you know. You make that overview with a gap analysis.

In this piece you read where BIO2 stands now, what changes and how to do a gap analysis in five steps, even if you do it as the only information security officer alongside your regular work. The ten measures that are often left undone in practice are in our BIO checklist for municipalities. This piece is about the transition.

Where does BIO2 stand now?

The dates in a row:

• 23 September 2025: the government-wide policy consultation on the digital government (Overheidsbreed Beleidsoverleg Digitale Overheid) adopts BIO2. For central government, the provinces and the water authorities it applies directly; for municipalities it is a guideline (digitaleoverheid.nl).
• 5 March 2026: BIO2 version 1.3 is published in the Government Gazette (Staatscourant), as the successor to BIO 1.04. For municipalities, BIO 1.04 formally remained in force until the Cybersecurity Act came into effect (VNG, 9 March 2026).
• 15 August 2026: the Cybersecurity Act comes into force (rijksoverheid.nl). Since then, applying the ISO standards and the government measures from BIO2 is a legal obligation for government organisations that fall under the law, with a few exceptions (see step 2) (digitaleoverheid.nl, updated 24 September 2026).
• The aim is to release a next version of BIO2 at the end of 2027 (same source).

Municipalities fall under the law. For a joint arrangement (gemeenschappelijke regeling), you determine case by case whether it meets the criteria for public authorities (digitaleoverheid.nl).

What changes from the BIO to BIO2?

BIO2 is based on NEN-EN-ISO/IEC 27001:2023 and NEN-EN-ISO/IEC 27002:2022, the Dutch editions of the international standards (digitaleoverheid.nl). In practice, this is mainly what changes for you (VNG):

• The three baseline security levels (BBNs) are dropped. They are replaced by an approach based on risks.
• An information security management system (ISMS) in line with ISO 27001 becomes mandatory.
• The arrangement of the measures follows the new structure of ISO 27002. Your numbering from BIO 1.04 therefore no longer matches.

The government measures from BIO2 are the minimum. You apply the other measures from ISO 27002 based on your own risks, and where the risks call for it, you add measures. A number of government measures have been adjusted: some have been relaxed where possible, others have been made stricter by the effect of NIS2 through the Cybersecurity Act (digitaleoverheid.nl).

BIO2 and NIS2: what do you gain from it?

The VNG writes that BIO2 aligns with the NIS2 directive and makes the duty of care from the Cybersecurity Act concrete. That is why a gap analysis against BIO2 is also a good first measurement of your duty of care. That is our reading and not a statement by a supervisory authority. How we set out NIS2 and BIO is on our compliance page.

Step 1: determine the scope

ISO 27001 requires you to determine the scope of your management system. Write down which parts of the organisation, processes, systems and locations fall within it and who the owner is.

If you are a joint arrangement, start with the question of whether you fall under the law yourself. If you meet the criteria, you fall under the law independently and the participating municipalities are not responsible for your compliance. In both cases, make agreements with them about risks, incidents and continuity.

Step 2: compare your measures with BIO2

Download BIO2 version 1.3 from digitaleoverheid.nl, also as Excel, and compare your current BIO measures with it. Put each measure in one of four groups: unchanged, adjusted, new or dropped. This is a first rough sort, not an audit.

Which measures are legally mandatory is determined by the ministerial regulation under the Cybersecurity Act. Exempted are controls 5.32 and 5.34 and government measures 5.32.01, 5.33.01 and 5.34.01; control 5.33 itself is legally mandatory. For parts outside the law, such as information on paper, BIO2 continues to apply as mandatory self-regulation. Government measures outside the scope of the law are marked in BIO2 (digitaleoverheid.nl).

Step 3: replace the BBN level with a risk analysis

Your BBN classification was a quick route to a package of measures. BIO2 requires you to apply ISO 27002 in a risk-driven way. Choose your most important processes, for example civil affairs, the social domain and the financial administration.

Describe per process what can go wrong and what that costs. From that follows which measures you need on top of the minimum of the government measures.

Step 4: look at the management system itself

A list of measures does not make a management system. An ISMS is a system to establish, implement, maintain and continually improve information security. Go through those four verbs: has the policy been adopted, does each part have an owner, and who checks whether the measures work and what happens with the findings?

Step 5: sort the gaps and make a plan

Put each gap in a table with an owner, a deadline and a priority. Start with gaps in the government measures, because they are the minimum, and with the measures that have been made stricter. Keep the table, the date and the choices you made. That is your evidence, and your board can take a decision on it.

What you can do tomorrow

1. Get BIO2 version 1.3 from digitaleoverheid.nl, including the Excel version.
2. Look up your latest BIO self-evaluation and your list of measures and see which version they follow.
3. Plan two hours with a system owner for steps 1 and 2.
4. Put the scope on paper and present it to your board.

Where Noveu fits

In BIO and BIO2 in brief you can read about the frameworks and the technical measures of Noveu. On the compliance page you can find the measures per topic, and on our page for the public sector you can read how Noveu sets up a workplace for government organisations.