BIO2 for suppliers to Dutch government bodies, 17 measures, each paired with the record that answers it.
A municipality or another government client puts BIO2 on its suppliers, directly or through the GIBIT contract. BIO2 asks organizations to show the design, existence and operation of their measures, and operation is what a record shows. Below are 17 measures that touch access, changes, restores and logs, by number and paraphrased, including where Opafra answers them only in part or not at all.
Suppliers to municipalities and other government bodies.
BIO is binding on Dutch government bodies. A 2026 municipal gazette notice names BIO 2.0 among the binding frameworks and says the Cyberbeveiligingswet makes the BIO mandatory for government bodies, municipalities included.
The GIBIT is a contract and not a questionnaire. Article 29.1 requires the supplier to conform to the municipal ICT quality standards, and those say the ICT service must let the municipality meet the BIO. That is how the BIO reaches the supplier.
BIO2 says an organization stays responsible for the risks of outsourced services, and that BIO obligations go into the purchase requirements for suppliers. Organizations show the design, existence and operation of their measures. Operation is what a run and an access review show.
BIO2, version 1.3 definitief of 9 January 2026.
We read BIO2 for the parts named here. A measure is numbered as the ISO/IEC 27002:2022 control plus a sequence number, so 5.18.02 is the second measure under 5.18. Measures are cited by number and paraphrased, because the BIO incorporates NEN text that is protected by copyright. None of these 17 measures is greyed out in BIO2: all fall within the scope of the Cyberbeveiligingswet.
A record answers 9 measures. For work that goes through Opafra.
The answer is a record Opafra writes, for work that goes through Opafra.
9 yes, 6 partly, 2 no
- 5.17.01: multi-factor authentication
- Is multi-factor authentication in place, at least for accounts with admin rights and for services reachable from the internet? Signing in to Opafra uses multi-factor authentication, and SSH access uses per-person certificates that last five minutes.
- 5.18.01: accounts with special rights
- Is the creation and change of accounts with special rights monitored, and is an unauthorised change an incident? Every change to a role or a grant is in the audit log, with who made it and when.
- 5.18.02: yearly review of access rights
- Are all issued access rights reviewed at least once a year? The signed-off access review per environment: everyone with access, the decision for each person, the reviewer and the date.
- 8.02.01: quarterly review of special privileges
- Are assigned or used special privileges assessed in design, existence and operation at least every quarter? The access review on a quarterly interval, with the grants that were actually used.
- 8.05.01: suppliers on the network
- Do external suppliers get network access only after a prior risk assessment that sets conditions and duration, and is it recorded how rights were granted? A grant with an end time carries a reason, a named approver and a window. The access record is the register of what was granted.
- 8.13.04: testing the restore procedure
- Is the restore procedure tested at least yearly, or after a major change? The scheduled restore test records the result and the time the restore took.
- 8.15.01: what a log line holds
- Does a log line hold at least the action, the object, the result, the origin, the actor and the timestamp? The audit log keeps the action, the resource, the outcome, the IP address, the actor and the timestamp.
- 8.18.02: system utilities
- Is the use of system utilities logged and kept for at least six months? Every run and its commands per host are logged. Nothing is deleted automatically.
- 8.31.02: testing before production
- Are significant production changes tested first, with exceptions only after the prior approval of the process owner? The dry run per host comes before the run, and the approval is bound to the revision that runs.
The record answers 6 measures in part. The rest sits elsewhere.
The record is a part of the answer. The rest is a policy, a document or a system that Opafra does not see.
- 8.32.01: change management
- Does change management cover recording changes with test results, a risk assessment with a rollback plan, and the approval procedure? The change record shows the dry run and the approval. The risk assessment and the rollback plan are text your team writes into the plan, and reverting what a run did on a server is not built.
- 5.20.03: independent review of the supplier
- Does the supplier show every year, through an independent third-party review, that it meets the requirements in design, existence and operation? The records are the evidence of operation. The independent review itself is the auditor's.
- 5.20.04: validating reports and external audit
- Does the organization validate the supplier's reports itself, and does the contract allow an external audit? The client's auditor gets free read-only access, and the exports. The validation and the contract term sit with the client.
- 5.22.01: yearly assessment of the supplier
- Does the process owner assess the supplier every year on the evidence supplied? The exports feed that assessment. The assessment itself is the client's.
- 8.08.01: vulnerabilities within a week
- Are warnings about high-risk vulnerabilities mitigated within a week? Patch runs are recorded with their deadline, and with the reason a server was skipped. Opafra does not scan for vulnerabilities.
- 8.15.05: changes to log data
- Are improper changes or deletion of log data reported as an incident? The database refuses a change or a deletion of an audit log line. Reporting an attempt is your team's process.
Opafra does not answer 2 measures. They are listed too.
These are the measures where the honest answer is no, or where the answer is a document and not a record.
- 8.16.03: detection and response
- Is the environment watched with a detection and response solution? No. That is a SIEM's job. The audit log can be exported as CSV or NDJSON and fetched through the API.
- 5.21.04: the supplier's own supply chain
- Does the supplier report changes in its own supply chain during the contract? No. That is a contract duty and not a record Opafra writes.
Evidence for a measure, not a verdict.
A yes or a partly applies to work that goes through Opafra. It says nothing about systems that do not, and it is evidence for an answer, not a statement that anyone meets a measure. Opafra supplies no certificate and no third-party statement: your own stays necessary.
Answer the BIO2 questions with records.
Name the questionnaire your government client uses. You get a demo and your price in writing within one business day, with no call.