IBD PLC (2026)

Contract with your customer under the GIBIT (the municipal purchasing conditions for IT contracts), sign a processing agreement (verwerkersovereenkomst) whenever you process personal data for the customer, and put the security agreements you make with the customer in writing.

Keep a software bill of materials (SBOM) for the service, give it to your customer free of charge, and make it available at once to the customer or its CSIRT (computer security incident response team) when an incident calls for it.

Keep a list of your subprocessors and cloud chains available to your customer, be able to show where the data is processed, and give notice when a subprocessor changes.

Use unique accounts and strong passwords. Keep logs for at least one year, in a form that can be exported and is protected against change and deletion. Require multi-factor authentication on admin accounts and on the accounts of internet-facing services (BIO2 5.17.01).

Screen your own staff and the third parties you hire when they have access to the customer's systems or data, with a VOG (certificate of conduct, Verklaring Omtrent het Gedrag) or an equivalent check.

Run a Coordinated Vulnerability Disclosure policy with a fixed, reachable point where vulnerabilities can be reported to you.

Run a documented patch process. Mitigate a vulnerability that is both likely to be misused and expected to do high damage as soon as possible and within a week. Scan for vulnerabilities at least once a year, and test internet-facing systems continuously where possible, at every new release or major update, and at least once a year. Keep a system with unmitigated high-risk findings out of production, and follow the advisories of the NCSC (BIO2 8.08.01 to 8.08.05).

Report a security incident to your customer's CISO within 24 hours of finding it. Report a data breach without delay, so that the customer can meet the 72-hour term of the AVG (the Dutch name for the GDPR).

At exit, return the customer's data in a structured, open format, and confirm in writing that the remaining copies are destroyed.

Make the internet-facing systems that deliver the service meet the Forum Standaardisatie standards, such as DNSSEC, HTTPS, and STARTTLS, as tested by internet.nl. Use at least OV certificates for web and API traffic with sensitive data, and consider mutual TLS for API links (BIO2 5.14.01 and 5.14.02).

Keep a backup policy that protects against ransomware and covers backup integrity. Set the RPO and RTO from a risk assessment, store backups apart from production, and test a restore at least once a year or after a major change (BIO2 8.13.01 to 8.13.04).

Accept in the contract that your customer may have an external audit validate your reports (BIO2 5.20.04).

Base your security measures on a norm you can demonstrate, such as an ISO 27001 certificate or an equivalent. At Assurance level 1, a CYRA-IT self-declaration at level Basic and maturity 2 also counts, when you back it with evidence and a management statement that your customer assesses.

Take part in your customer's review of the base-set agreements every two years, or every year when the criticality of the service is medium or high.

Applies when a customer sets Assurance level 2 or higher. Hold an ISO 27001 certificate that is at most three years old and whose scope covers the contracted service. For a SaaS service, a yearly third-party statement (TPM) or an ISO 27001 certificate under GIBIT article 38 is enough. A CYRA-IT self-declaration does not count at this level.

Applies when a customer sets Assurance level 2 or higher. Require phishing-resistant authentication, such as FIDO2 or passkeys or an equivalent, for admin accounts and multi-factor authentication for end users, and grant elevated rights only just in time.

Applies when a customer sets Assurance level 2 or higher. Encrypt data at rest and in transit, and be able to show how your network is segmented.

Applies when a customer sets Assurance level 2 or higher. Have a business continuity plan and a disaster recovery plan, and test them. Keep to an RTO of at most 24 hours and an availability of at least 99.5% a year.

Applies when a customer sets Assurance level 2 or higher. Accept an audit by your customer once a year, also when there is no specific cause.

Applies when a customer sets Assurance level 2 or higher. Be able to show your customer insight into your chain of subprocessors, and pass the customer's security requirements on to those subprocessors.

Applies when a customer sets Assurance level 2 or higher. Notify your customer of a change in the ownership or control of your organisation.

Applies when a customer sets Assurance level 3. Assurance level 3 includes every Assurance level 2 Requirement. In addition to your ISO 27001 certificate, deliver a third-party statement (TPM) to your customer.

Applies when a customer sets Assurance level 3. Assurance level 3 includes every Assurance level 2 Requirement. Keep a worked-out exit plan that includes data migration and the export of configuration, and test it from time to time, by simulation or for real.

Applies when a customer sets Assurance level 3. Assurance level 3 includes every Assurance level 2 Requirement. Put the source code of the service and your encryption keys in escrow for your customer.

Applies when a customer sets Assurance level 3. Assurance level 3 includes every Assurance level 2 Requirement. Keep all processing inside the European Economic Area (EEA), including backups, disaster recovery copies, management, maintenance, and key management.

Applies when a customer sets Assurance level 3. Assurance level 3 includes every Assurance level 2 Requirement. Notify your customer of a change in ownership or control 90 days ahead, and give the customer the right to an extra risk assessment or to end the contract free of charge.

Applies when a customer sets Assurance level 3. Assurance level 3 includes every Assurance level 2 Requirement. Monitor the service around the clock with a security operations centre (SOC), and integrate your SIEM with your customer's environment.

Applies when a customer sets Assurance level 3. Assurance level 3 includes every Assurance level 2 Requirement. Have an independent whitebox penetration test of the application and its infrastructure done every year by a party that holds the CCV Pentesten mark.

Applies when a customer sets Assurance level 3. Assurance level 3 includes every Assurance level 2 Requirement. Meet an RTO of at most 4 hours, delivered from geographically redundant data centres, with an availability of at least 99.9% a year.

Applies when a customer sets Assurance level 3. Assurance level 3 includes every Assurance level 2 Requirement. Accept an audit by your customer every quarter, also when there is no specific cause.