# Baseline Informatiebeveiliging Overheid 2 (Dutch Government Information Security Baseline)

Framework id: `bio2`. Government Baseline. Publisher: Dutch Ministry of the Interior and Kingdom Relations (BZK). Version: 1.2 (2025). Region: Netherlands. Mapping licence: CC BY-SA 4.0.
Source text: https://www.bio-overheid.nl

Each line is a clause, the NIST SP 800-53 controls OSA maps to it, and OSA's estimate of how far those controls cover it.
Clause titles and coverage figures are OSA's own summaries and estimates. No line-by-line check against the source text is recorded for this framework, so quote the source, not this card.

## Clauses (93, average coverage 83%)
- 5.1 Policies for information security (BIO2): PL-01, PM-01, AC-01, AT-01, AU-01, CA-01, CM-01, CP-01, IA-01, IR-01, MA-01, MP-01, PE-01, PS-01, RA-01, SA-01, SC-01, SI-01, PT-01, SR-01 (88%)
- 5.2 Information security roles and responsibilities (BIO2): PM-02, PS-01, PS-02, PL-01, PS-09 (85%)
- 5.3 Segregation of duties (BIO2): AC-05 (87%)
- 5.4 Management responsibilities (BIO2): PM-02, PM-13, PS-07, AT-01, PM-29 (72%)
- 5.5 Contact with authorities (BIO2): IR-06, PM-15 (75%)
- 5.6 Contact with special interest groups (BIO2): PM-15, PM-16 (82%)
- 5.7 Threat intelligence (BIO2): PM-16, RA-03, RA-05, SI-05, RA-10, RA-07 (90%)
- 5.8 Information security in project management (BIO2): SA-03, SA-04, SA-08, PM-07 (78%)
- 5.9 Inventory of information and other associated assets (BIO2): CM-08, PM-05, CM-12, CM-13 (90%)
- 5.10 Acceptable use of information and other associated assets (BIO2): PL-04, AC-20, MP-07 (83%)
- 5.11 Return of assets (BIO2): PS-04, PS-05 (88%)
- 5.12 Classification of information (BIO2): RA-02, AC-16 (82%)
- 5.13 Labelling of information (BIO2): MP-03, AC-16, RA-02 (77%)
- 5.14 Information transfer (BIO2): SC-07, SC-08, SC-12, AC-04, AC-17, AC-20, MP-05, SC-46 (83%)
- 5.15 Access control (BIO2): AC-01, AC-02, AC-03, AC-06, AC-07, AC-08, AC-10, AC-11, AC-12, AC-14, AC-17, AC-21, AC-24 (93%)
- 5.16 Identity management (BIO2): IA-02, IA-04, IA-05, IA-08, IA-12 (90%)
- 5.17 Authentication information (BIO2): IA-05, IA-06, IA-07, IA-11 (90%)
- 5.18 Access rights (BIO2): AC-02, AC-06, AC-25 (93%)
- 5.19 Information security in supplier relationships (BIO2): SA-04, SA-09, SR-01, SR-02, SR-03, SR-05 (80%)
- 5.20 Addressing information security within supplier agreements (BIO2): SA-04, SA-09, SR-03 (80%)
- 5.21 Managing information security in the ICT supply chain (BIO2): SR-01, SR-02, SR-03, SR-05, SR-06, SR-09, SR-10, SR-11 (87%)
- 5.22 Monitoring, review and change management of supplier services (BIO2): SA-09, SR-06, CA-07 (72%)
- 5.23 Information security for use of cloud services (BIO2): SA-09, AC-20, SC-07, SA-04 (63%)
- 5.24 Information security incident management planning and preparation (BIO2): IR-01, IR-02, IR-03, IR-04, IR-07, IR-08 (90%)
- 5.25 Assessment and decision on information security events (BIO2): IR-04, IR-05, IR-06, SI-04 (87%)
- 5.26 Response to information security incidents (BIO2): IR-04, IR-05, IR-06, IR-07, IR-09 (90%)
- 5.27 Learning from information security incidents (BIO2): IR-03, IR-04 (83%)
- 5.28 Collection of evidence (BIO2): IR-04, AU-03, AU-06, AU-09, AU-11 (83%)
- 5.29 Information security during disruption (BIO2): CP-01, CP-02, CP-03, CP-04, CP-05, CP-06, CP-07, CP-08, CP-09, CP-10, CP-11, CP-12, CP-13 (88%)
- 5.30 ICT readiness for business continuity (BIO2): CP-02, CP-04, CP-07, CP-08, CP-09, CP-10 (83%)
- 5.31 Legal, statutory, regulatory and contractual requirements (BIO2): PL-04, PM-01, SA-04, PM-08 (52%)
- 5.32 Intellectual property rights (BIO2): no control mapped (13%)
- 5.33 Protection of records (BIO2): AU-11, SI-12, AU-09 (68%)
- 5.34 Privacy and protection of PII (BIO2): PT-01, PT-02, PT-03, PT-04, PT-05, PT-06, PT-07, PT-08, PM-25, PM-26, PM-27, PM-28, SI-18, RA-08 (85%)
- 5.35 Independent review of information security (BIO2): CA-02, CA-07, PM-06 (73%)
- 5.36 Compliance with policies, rules and standards (BIO2): CA-02, AU-06, PM-06, CA-07 (74%)
- 5.37 Documented operating procedures (BIO2): PL-02, SA-05, CM-01, CM-02, CM-03, CM-04, CM-05, CM-06, CM-07, CM-08, CM-09, CM-10, CM-11 (70%)
- 6.1 Screening (BIO2): PS-03 (88%)
- 6.2 Terms and conditions of employment (BIO2): PS-06, PL-04, PS-07, PS-09 (85%)
- 6.3 Information security awareness, education and training (BIO2): AT-02, AT-03, AT-04, PM-13, PM-14, AT-06 (92%)
- 6.4 Disciplinary process (BIO2): PS-08 (73%)
- 6.5 Responsibilities after termination or change of employment (BIO2): PS-04, PS-05, PS-06 (88%)
- 6.6 Confidentiality or non-disclosure agreements (BIO2): PS-06, SA-09 (78%)
- 6.7 Remote working (BIO2): AC-17, PE-17, SC-28 (82%)
- 6.8 Information security event reporting (BIO2): IR-06, IR-07, IR-01 (85%)
- 7.1 Physical security perimeters (BIO2): PE-03, PE-04 (88%)
- 7.2 Physical entry (BIO2): PE-02, PE-03, PE-06, PE-08, PE-07 (93%)
- 7.3 Securing offices, rooms and facilities (BIO2): PE-03, PE-05, PE-18 (83%)
- 7.4 Physical security monitoring (BIO2): PE-06, PE-08 (88%)
- 7.5 Protecting against physical and environmental threats (BIO2): PE-09, PE-10, PE-11, PE-12, PE-13, PE-14, PE-15, PE-21, PE-23 (93%)
- 7.6 Working in secure areas (BIO2): PE-02, PE-03, PE-07 (78%)
- 7.7 Clear desk and clear screen (BIO2): AC-11, MP-04, PE-05 (83%)
- 7.8 Equipment siting and protection (BIO2): PE-14, PE-18, PE-01, PE-23 (78%)
- 7.9 Security of assets off-premises (BIO2): AC-17, MP-05, SC-28, AC-19 (78%)
- 7.10 Storage media (BIO2): MP-01, MP-02, MP-03, MP-04, MP-05, MP-06, MP-07, MP-08 (93%)
- 7.11 Supporting utilities (BIO2): PE-09, PE-10, PE-11, PE-12 (88%)
- 7.12 Cabling security (BIO2): PE-04, PE-09 (78%)
- 7.13 Equipment maintenance (BIO2): MA-01, MA-02, MA-03, MA-04, MA-05, MA-06, MA-07 (93%)
- 7.14 Secure disposal or re-use of equipment (BIO2): MP-06, MP-08 (88%)
- 8.1 User endpoint devices (BIO2): AC-19, CM-07, SC-28, CM-08, SC-41 (80%)
- 8.2 Privileged access rights (BIO2): AC-06, AC-02, AC-05 (93%)
- 8.3 Information access restriction (BIO2): AC-03, AC-04, AC-06, AC-24 (93%)
- 8.4 Access to source code (BIO2): CM-05, AC-03, SA-10 (83%)
- 8.5 Secure authentication (BIO2): IA-02, IA-05, IA-08, IA-11 (90%)
- 8.6 Capacity management (BIO2): AU-04, CP-02, SC-05, SA-04 (63%)
- 8.7 Protection against malware (BIO2): SI-03, SI-08, SC-44 (93%)
- 8.8 Management of technical vulnerabilities (BIO2): RA-05, SI-02, SI-05 (93%)
- 8.9 Configuration management (BIO2): CM-02, CM-03, CM-04, CM-05, CM-06, CM-07, CM-08, CM-09, CM-14 (93%)
- 8.10 Information deletion (BIO2): MP-06, SI-12 (72%)
- 8.11 Data masking (BIO2): SI-19, PT-06, PT-07, SC-28, SI-20 (76%)
- 8.12 Data leakage prevention (BIO2): AC-04, PE-19, SC-07, SI-04, SC-31 (80%)
- 8.13 Information backup (BIO2): CP-09, CP-06 (93%)
- 8.14 Redundancy of information processing facilities (BIO2): CP-06, CP-07, CP-08, SC-36 (88%)
- 8.15 Logging (BIO2): AU-02, AU-03, AU-04, AU-05, AU-06, AU-07, AU-08, AU-09, AU-11, AU-12 (93%)
- 8.16 Monitoring activities (BIO2): SI-04, AU-06, CA-07, IR-04 (93%)
- 8.17 Clock synchronization (BIO2): AU-08, SC-45 (93%)
- 8.18 Use of privileged utility programs (BIO2): CM-07, CM-11, AC-06 (78%)
- 8.19 Installation of software on operational systems (BIO2): CM-05, CM-07, CM-11, SA-22, CM-14 (90%)
- 8.20 Networks security (BIO2): SC-07, SC-08, AC-04, CA-09 (90%)
- 8.21 Security of network services (BIO2): SC-07, SC-08, SA-09 (83%)
- 8.22 Segregation of networks (BIO2): SC-07, SC-32 (93%)
- 8.23 Web filtering (BIO2): SC-07, SI-03, AC-04 (68%)
- 8.24 Use of cryptography (BIO2): SC-12, SC-13, SC-28 (88%)
- 8.25 Secure development life cycle (BIO2): SA-03, SA-08, SA-10, SA-11, SA-15, SA-17 (93%)
- 8.26 Application security requirements (BIO2): SA-04, SA-08, SA-11 (88%)
- 8.27 Secure system architecture and engineering principles (BIO2): SA-08, SA-17, SC-07, SC-32, PL-08 (88%)
- 8.28 Secure coding (BIO2): SA-11, SA-15, SA-16 (83%)
- 8.29 Security testing in development and acceptance (BIO2): SA-11, CA-02, SA-04 (88%)
- 8.30 Outsourced development (BIO2): SA-04, SA-09, SA-10, SA-11, SA-21 (85%)
- 8.31 Separation of development, test and production environments (BIO2): CM-04, SA-11, SC-32, CM-02 (83%)
- 8.32 Change management (BIO2): CM-03, CM-04, CM-05, SA-10 (93%)
- 8.33 Test information (BIO2): SA-11, SA-15 (62%)
- 8.34 Protection of information systems during audit testing (BIO2): CA-02, AU-06, CA-08 (73%)

## More
- A pattern's controls with their clauses in this framework: /api/v1/patterns/{id}/crosswalk?framework=bio2
- Control-to-clause mappings as JSON: /api/v1/frameworks/bio2?fields=mappings&per_page=100
- Rationale and gaps for each clause, as JSON: https://raw.githubusercontent.com/opensecurityarchitecture/osa-data/main/data/framework-coverage/bio2.json
- Page for people: /frameworks/bio2/