BIO2 version 1.3 for all government levels

The Netherlands has updated its cybersecurity framework for all government levels with the publication of BIO2 version 1.3 in the official State Gazette on March 5, 2026. This baseline information security standard is crucial for central government, municipalities, provinces, and water boards, ensuring a unified approach to digital protection across public services. The update aims to strengthen the digital resilience of governmental operations against evolving cyber threats. This latest version supersedes previous iterations, including version 1.04 and 1.2, and repeals an older circular. The revisions primarily address inconsistencies and enhance clarity, aligning the BIO2 more closely with the Cyber Security Act (Cbw). Notably, three specific government measures have been exempted from Cbw obligations, as they fall outside the act's scope concerning network and information systems, yet remain subject to mandatory self-regulation. The update directly impacts how governmental bodies manage their information security, particularly those subject to the Cbw's ministerial regulation, which now references this State Gazette publication for BIO2 requirements. This ensures that critical infrastructure and sensitive data within the public sector receive enhanced protection aligned with national cybersecurity legislation. Further support and materials for implementing BIO2 version 1.3 are available on bio-overheid.nl, with a next version planned for release in late 2027 following a comprehensive evaluation.