What is the BIO?

The BIO, also known as Baseline Information Security Government, is the specific standard that defines information security for government agencies. It is a coherent framework that builds on previous baselines such as BIG, BIR, IBI, and BIWA, and is structured according to ISO 27001- and 27002 standards.

Why comply with the BIO?

The BIO is aimed at improving information security at all levels of government. This is very important because communication between entrepreneurs, citizens and governments is increasingly taking place digitally, including sensitive and confidential information. The BIO not only applies to the government agencies themselves, but government suppliers are also increasingly being required to comply with the BIO.

‍

The BIO has the following benefits:

‍

• One clear line thanks to a standardized standards framework
• Competitive advantage in tendering for organizations that work with governments
• Facilitates inter-agency cooperation
• Promotes risk awareness and knowledge sharing

BIO protection levels

The BIO has three levels of protection, the so-called Baseline Protection Levels (BBN). The weight of the technical and organizational measures to be taken must be tailored to the risk level of a process or system.

When a process is established at BBN Level 2, both BBN1 and BBN2 measures must be implemented. In addition, from the highest basic security level (BBN3), relevant requirements of, among others, the NATO Convention for the Security of Information and the National Service for Special Information Information (VIR-BI) Information Security Decree must also be met. Which BBN level is necessary or desired is determined by means of a BBN test.

BIO in relation to ISO 27001

The structure of the BIO is similar to the ISO 27001 Addendum, where the requirements of the ISO 27001 addendum have been further tightened with BIO-specific requirements. The requirements become stricter the higher the previously mentioned BBN risk level. The basic chapters 4 through 10 of the ISO 27001 standard, which set requirements for an organization's Plan-Do-Check-Act process, are not part of the BIO.

We can help

Do you want to ensure that your organization complies with the Government Information Security Baseline (BIO)? Our team of experts is ready to help accompany whether unburdening when implementing the BIO standard.