SUE provides BIO2-compliant and sovereign cloud environments for the government

BIO2 is the new Government Information Security Baseline and has replaced BIO 1.04 as of September 23, 2025. It is based on ISO 27001 and ISO 27002 from 2022. The three fixed baseline security levels are being phased out: you select measures based on a risk analysis and supplement them with the government measures that apply to you.

BIO2 is legally linked to the Dutch Cybersecurity Act and thus fulfills the duty of care for government organizations.

Under BIO2, you demonstrate that measures have been designed, are in place, and are effective. Start with the risk analysis, as that determines which measures you need. In the cloud, the easiest way to provide this evidence is through the platform itself: a landing zone as code, policies that block or report anomalies, centralized logging as an audit trail, and encryption using your own keys.

This way, you don't have to keep track of separate documents for an audit. SUE built a BIO-compliant cloud environment for a government organization using this approach.

Yes, under certain conditions. A stricter government cloud policy has been in effect since July 3, 2026. If you use a public cloud service, you must first set out in a cloud strategy why you are using it, what risks it entails, and how you will mitigate those risks. Consider, for example, dependence on a single provider or on a provider governed by non-European law. An exit plan is mandatory for critical cloud services.

Source files from core registries such as the BRP and the BRK may not be stored in the public cloud, and the government advises against using the public cloud for email and documents. Existing services have four years to comply with the policy.

The Cybersecurity Act has been in effect since August 15, 2026, and applies to municipalities, provinces, water boards, and the national government. The governing body is explicitly responsible for managing cyber risks, and serious incidents must be reported. BIO2 is the standard used to fulfill the duty of care.

At the municipal level, the municipal council oversees operations, while the National Inspectorate for Digital Infrastructure oversees the entire government. The Information Security Service (IBD) assists municipalities in the event of incidents.

Haven is the VNG standard for platform-independent cloud hosting for municipalities, based on Kubernetes. An application running in one Haven environment will work in any other, whether it’s hosted by a hyperscaler, a Dutch provider, or in your own data center. Municipalities either adopt the standard or explain why they do not.

The Haven Compliancy Checker verifies that your cluster meets requirements such as a recent Kubernetes version, multiple availability zones, at least three control plane nodes and three worker nodes, RBAC, Linux hardening, ReadWriteMany storage, logging, and monitoring. SUE builds and manages Kubernetes platforms and configures them to pass these checks.