For government agencies, thorough information security is of great importance. They are particularly responsible for protecting public data and play an exemplary role in doing so. The introduction of the BIO2 marks a major step in the development of information security within the government. BIO2 offers a risk-based approach with a standard framework that enables government agencies to comply with obligations arising from the Cybersecurity Act (hereafter CBW)..
In this article, we show what BIO2 can do and how governments can effectively prepare for this new standard.
Operationalization of the duty of care
In a previous articleikeWe explained how NIS2 translates into the CBW. BIO2 can be seen as an operationalization of the care obligation described in the CBW. By doing so, BIO2 provides a normative framework for governments to be able to organize their information security and to demonstrably meet the requirements of the CBW. The CBW therefore provides an abstract picture of what the care obligation means for organizations; BIO2 makes this picture concrete. In practice, this looks like the following:
CBW:
- Stated that the board is ultimately responsible for information security within an organization.
- Requires that authorities take appropriate and proportionate measures for information security.
BIO2: Does this concrete end responsibility by holding the board accountable for:
- Developing and approving an information security policy.
- Receiving periodic reports on information security.
- The assignment of roles such as the CISO and information owners.
In addition, BIO2 elaborates on the requirement for appropriate and proportionate measures by:
- Performing a risk analysis and classification.
- The implementation of a set of security measures based on ISO/IEC 27001:2022 and ISO/IEC 27002:2022.
Because these steps are explicitly defined and deviations must be justified, a supervisor can objectively determine whether a government organization is actually fulfilling its duty of care.
With the enactment of the Cybersecurity Act, the RDI will officially become the supervisor for government agencies on the interpretation of and compliance with the duty of care. In addition, incidents will have to be reported to the RDI.
Start ahead
The fact that the CBW and therefore BIO2 will only become legally mandatory upon the entry into force of the Cyber Security Act does not mean that it is advisable to wait with taking measures. It is essential for governments to keep up with the developments in information security. According to the CBW, they are considered a critical entity. A data breach would have major consequences for citizens and for trust in the public authority. Furthermore, a data breach could have major social and economic consequences, because services such as healthcare could be severely disrupted.
Preparation for BIO2
In an earlier article, we mentioned obtaining an ISO 27001 certificate as a good first step toward CBW compliance. While this is the case for most organizations covered by the CBW, it is different for governments. Even though ISO 27001 has clear common ground with BIO2, for governments obtaining this certification proves to be more complex in practice. This is due to the amount of processes and the different layers of governance that a proposal must pass through. Obtaining such a certificate can be done, but is not the most efficient way for most government agencies to take the first step toward BIO2.
A risk scan It is often more appropriate because it better aligns with the duty of care. A risk assessment maps out the risks and makes it clear what measures are needed. By doing so, a government agency meets the core question: ‘Are the measures taken appropriate to the risk?’ Based on a risk assessment, informed choices can be made about what needs to be done now and what can be put off. This leads to targeted advice on actual vulnerabilities, rather than an all-or-nothing approach like with ISO certification. In addition, a risk assessment helps prepare for RDI oversight by clarifying which risks have been identified, which measures are linked to them, and which administrative decisions have been made regarding them. This is essential for the RDI: it tests whether an agency knows its risks, takes logical measures, and documents these choices administratively.
Learn more about BIO2 Or a risk assessment? Our consultants are ready to help you!