ISO 27001 certification in the Netherlands and Europe: the Cyberbeveiligingswet, BIO2, NEN 7510 and RvA accreditation

Why Dutch and European organisations pursue ISO/IEC 27001

Much of the demand in the Netherlands comes from law that asks for security without prescribing a certificate. The Cyberbeveiligingswet transposes the NIS2 Directive and replaced the earlier Wbni. The government's Digital Government site puts its reach at about 8,000 Dutch organisations, which must take appropriate measures under a duty of care, register, and report significant incidents to their CSIRT and their supervisor. The detail sits in the implementing decree, the Cyberbeveiligingsbesluit. What NIS2 asks across Europe is covered on the NIS2 hub; the Dutch point is that the Cbw now applies, so boards need evidence that the measures exist and work.

Banks, insurers, investment firms and their ICT suppliers answer to DORA, Regulation (EU) 2022/2554, applicable since 17 January 2025; see the DORA hub. Any organisation processing personal data answers to the GDPR's requirement for security appropriate to the risk; see the GDPR hub. None of these laws makes ISO/IEC 27001 compulsory, and a certificate evidences parts of each, never the whole. Customer demand does the rest: German, Belgian and Nordic buyers routinely put the certificate on supplier questionnaires.

Dutch sector frameworks built on the standard

BIO2 for government

The BIO is the basic information security framework for every tier of Dutch government: central government, municipalities, provinces and water authorities. BIO2 version 1.3, dated 9 January 2026, was aligned with the Cbw's ministerial regulation. The government states that BIO2 is based on the Dutch editions of ISO/IEC 27001 and 27002, and that where a control is required on the basis of risk, government bodies must at least apply the government-specific BIO2 measures. For a supplier to a municipality or ministry, an ISO/IEC 27001 ISMS with a Statement of Applicability mapped to those measures answers the client's questions in one place.

NEN 7510 for healthcare

NEN 7510-1 sets the management system requirements and functions as the healthcare counterpart of ISO/IEC 27001; NEN 7510-2 combines ISO/IEC 27002 with ISO/IEC 27799. The 2024 edition, published in December 2024, is aligned with the current ISO/IEC 27001 and 27002. Through the Besluit elektronische gegevensverwerking door zorgaanbieders, providers must comply demonstrably; NEN states that certification is not legally required but is a reliable way to show compliance. NEN 7512 and NEN 7513 add secure data exchange and logging for patient records. One ISMS can be built to satisfy both standards, and the scope decides which certificate you hold.

Accreditation and checking a certificate in the Netherlands

The Dutch government designated the Raad voor Accreditatie (RvA) as the national accreditation body in 2010, under European Regulation 765/2008. It accredits certification bodies, among others, and publishes a public register of accreditations, suspensions and withdrawals. Under that Regulation each EU country has one national accreditation body, and EA maintains the agreement through which member accreditations are accepted across Europe. A Dutch organisation may therefore use a body accredited by the RvA, by Germany's DAkkS or by another EA member, provided its accreditation covers ISO/IEC 27001.

International recognition has passed to the Global ACI arrangement since 1 January 2026. Confirm the current status of the accreditation body behind your certificate on its own site and on the Global ACI list. The verification guide covers the full check.

Local practice that changes the project

Records in Dutch. Policies and records are often in Dutch, with English for group or client documents. Both are acceptable; confirm the certification body can assign auditors who read them.

Group and cross-border scopes. Dutch entities of international groups, and Dutch firms with sites in Germany or Belgium, must decide early whether one certificate covers several countries. That choice, and the NIS2 registration duty in each country, shapes the scope.

Mapping once. Build one risk register and Statement of Applicability, then map it to the Cbw duty of care, BIO2 or NEN 7510 as they apply.

How Sterling works in the Netherlands

Sterling supports Dutch and European clients from its Enschede office, on site and remotely, backed by an international practice of 8,100+ client engagements in 60+ countries since 2003. Sterling does not certify: an independent, accredited certification body audits you and decides.

ISO/IEC 27001 in the Netherlands: questions buyers ask