BIO (the Dutch government's information security baseline)

Secure transition to cloud-first government services

Historically, the customer provided on-premises services to various public institutions. However, demand for flexible and scalable cloud services grew rapidly, driven by both the need to innovate and the desire to increase operational efficiency. Use cases ranged from test environments for AI workloads to running government applications that do not process sensitive data but do require high availability.

The client saw a clear opportunity here: to offer cloud services as a broker between Microsoft Azure and government organizations. In doing so, they handle all the complex work—such as network configuration, access management, security, and compliance. The goal was to deliver a secure, ready-to-use cloud environment that public institutions could rely on from day one.

Security and compliance complexity as a barrier

Government agencies can’t just spin up a cloud environment overnight. Strict regulations, especially the BIO framework (the Baseline Information Security for Government, a standard based on ISO 27001), require careful implementation of security controls, logging, and identity governance. Most clients lacked the expertise or time to handle this internally.

The customer needed a solution that would be:

Fully BIO-compliant
Secure by default
Easily replicable across organizations

The technical foundation was partially in place, but it lacked the depth and automation required for operational deployment. Support was needed to build a secure-by-design, policy-driven platform ready for large-scale use within the government.

Chief Technology Officer

"By working with SUE, we accelerated years of architectural work into a secure, compliant cloud platform we can offer with confidence. BIO compliance, identity governance, and policy enforcement are now built into the foundation, not added as an afterthought. This partnership enables us to innovate faster, while we scale our services with far less operational risk."

The solution

A BIO-compliant cloud platform on Azure Landing Zones

Together with SUE, the client developed a cloud platform on Microsoft Azure Landing Zones, using the Enterprise Scale architecture as a blueprint. The result is a repeatable model for public organizations: secure environments that are ready for immediate use, without requiring in-depth knowledge of Azure or security.

The Result

All environments are set up in accordance with Dutch government standards for information security.
Security baked in
Sentinel, Defender for Cloud, Conditional Access, and Privileged Identity Management ensure enterprise-grade protection.
Speed to deploy
New cloud environments are provisioned automatically using Bicep and PowerShell.
Lower overhead
Clients only interact with the "landing zone", while all underlying infrastructure and security layers are managed by the customer.
Scalable foundation
The architecture supports future expansion, policy updates, and onboarding of additional public sector customers.

What SUE delivered

When SUE joined the project, a basic Enterprise Landing Zone framework was already in place. From that point on, we continued to build on it and added the layers that make all the difference: security, automation, and compliance.

Each component was delivered as reusable code, enabling the client to quickly set up secure environments for new customers without manual steps or customization for each organization. In addition, we ensured that the entire platform evolves in line with Azure best practices. Over time, the codebase has been modernized (for example, the transition from PowerShell to Bicep), ensuring long-term maintainability. Enterprise Policy as Code: a fully automated policy framework that ensures resources are provisioned securely and consistently.

Azure Policies: enforcing what resources can and cannot be deployed, based on government-approved standards and BIO-compliant.
Sentinel logging and alerting: for real-time monitoring and incident response.
Defender for Cloud: Microsoft's integrated threat protection across all Microsoft Azure subscriptions.
Privileged Identity Management (PIM): to restrict and audit administrative access, with just-in-time elevation and approval workflows.
Conditional Access & Entra ID: enforcing MFA, geo-restrictions, and access conditions to prevent unauthorized usage.

Faster innovation

The bigger picture

This project served as a strategic catalyst for digital government. With SUE’s support, the client can now offer a compliant and secure cloud foundation that lowers the barrier to innovation within the public sector. Government organizations can adopt the cloud with confidence, knowing that their environments are secure, compliant, and professionally managed from the ground up. For the client, this means faster onboarding of new customers, reduced risks, and a clear path to scalable growth within a highly regulated environment.

To learn how SUE secures cloud environments, visit the Cloud Security page.