BIO-compliant integration development
The Baseline Informatiebeveiliging Overheid (BIO) is the information security framework for municipalities, provinces, water authorities and central government. An integration between two systems is exactly where data leaves the organisation, and therefore where an auditor looks. Appfront builds integrations that comply with the BIO: encrypted, with access per integration, with logging that stands up to an audit, and with the supporting evidence you need for your accountability reporting.
What is an integration under the BIO?
The BIO is the shared information security framework for the Dutch government. The new version, BIO2, is structured around the international standards ISO 27001 and ISO 27002, with measures that apply across the whole of government. The BIO is on the list of standards that public bodies must apply, unless they explain why they do not.
An integration is where much of the BIO comes together. Who may use the integration, how is the data protected in transit, is what has been exchanged recorded, and is only the necessary data shared? Integrations that were once built quickly, with a shared password and no logging, are the first to stand out in an audit.
We build integrations where those questions have been answered up front. For each integration we record which measures apply and how they have been implemented, so that you can show what has been done when you report. Which measures apply to your situation depends on your risk assessment, and we carry that out together with your information security officer.
Secured in transit
Encrypted and shielded per integration.
Demonstrable
Logging that stands up to an audit.
Substantiated
Documented per measure.
How we build your integration in line with the BIO
We start with the integration itself: which systems talk to each other, which data passes between them, how sensitive it is, and who needs access. Then, together with your information security officer, we determine which BIO measures apply and how we implement them. Next we build the integration, with encryption, access per system, logging and monitoring. At delivery you receive supporting evidence for each measure for your accountability reporting. After that we maintain the integration, renew certificates on time, and adapt it when the BIO or your systems change.
Systems, data and sensitivity.
Together with your information security officer.
Encrypted, restricted, logged.
Evidence, monitoring and maintenance.
What a BIO-compliant integration does in practice
The components below appear in almost every integration built in line with the BIO. Which measures you need follows from your risk assessment.
Encryption
In transit and at rest.
Access per integration
Only those who need it.
Logging
Who, what and when.
Monitoring
Discrepancies flagged.
Key management
Certificates renewed on time.
Substantiation
Documented per measure.
Who we build BIO-compliant integrations for
This approach is intended for public sector organisations that are building or accounting for integrations, and for suppliers who deliver to them.
Municipalities
Many integrations. Accountability matters.
Provinces and water boards
Own systems and chains. Oversight matters.
Implementing organisations
Sensitive data. Access matters.
Suppliers
Supplying to the government.
Technology and integrations
This page is about integrations between systems. If you are looking for the application itself, see our page on BIO-compliant software; for case-oriented working, our page on the ZGW API integration; and for residents logging in, our page on the DigiD integration. You can read about our way of working on building software.
Why choose Appfront for your BIO-compliant integration?
Integrations with shared passwords, no logging and more data than necessary are a finding in an audit and a risk in an incident. That is what we build against: secured in transit, demonstrable proof of what was exchanged, and each measure backed by a rationale.
No findings
Measures pre-filled.
Lower risk
Only what is needed.
Quick to account for
Rationale ready.
Security and privacy in an integration under the BIO
An integration under the BIO by definition processes data that needs protection, sometimes special category personal data. We share only the data that is needed, encrypt it in transit and at rest, restrict access per integration, and log every message.
The integration runs in a European data centre or in your organisation's own environment. We record the processing in a data processing agreement, and you receive the rationale you need for your own accountability.
Frequently asked questions about an integration under the BIO
Questions government organisations ask before getting started.
The Baseline Informatiebeveiliging Overheid (Dutch Government Information Security Baseline) is the information security framework for municipalities, provinces, water authorities and central government. The new version, BIO2, is structured according to ISO 27001 and ISO 27002, with measures that apply across the whole of government.
Because with an integration, data leaves or enters the organisation. Who has access, how is the data protected in transit, and can you trace what was exchanged: these are the questions an auditor asks about integrations.
Our page on BIO-compliant software is about the application itself: how it is built, managed and secured. This page is about the integrations between systems. They go hand in hand, and we often build them together.
There is no certificate per integration for the BIO. You account for how you have implemented the measures yourself. For each integration, we provide a rationale: which measures apply, how they have been implemented, and where this can be seen.
Yes. We start with an inventory of your integrations and identify where shared passwords, missing logging or excessive data are present. We then improve the integrations where the greatest risk lies, without interrupting the exchange.
You do, together with your information security officer, based on your risk assessment. We contribute our thinking and implement the measures in the integration. This keeps responsibility where it belongs, and the technology in order.
Monitoring flags unusual use, such as abnormal volumes or times, and reports it. Because every request is logged with who, what and when, you can trace what happened after an incident.
Integrations that pass a BIO audit?
Tell us which systems need to talk to each other and which data is exchanged. We will show you which measures apply and what the integration will look like.