ENSIA is the annual process through which Dutch municipalities account for their information security. In a single round, a council reports on its compliance with the BIO, the Dutch government's security baseline, and on its connections to national systems such as DigiD, Suwinet and the BRP population register, backed by one IT audit where an audit is mandatory.
Most councils treat it as a questionnaire with a deadline and hand it to their information security officer. That gets the boxes ticked. It rarely tells the council how secure it actually is.
What ENSIA covers
The acronym stands for Eenduidige Normatiek Single Information Audit, roughly "uniform standards, single information audit". Municipalities and two ministries, Interior (BZK) and Social Affairs (SZW), set it up in 2017 so that councils would supply information once and commission one IT audit, rather than reporting separately to each supervising body. Provinces, water authorities and parts of central government now use it too. The Association of Netherlands Municipalities (VNG) publishes the rules for each year; for 2026 they are in the ENSIA accountability framework note for 2026.
For the 2026 reporting year, the scope runs from information security under the BIO to the DigiD login service and Suwinet, the network councils use to exchange benefits and employment data. It also takes in the BRP, travel documents and three geographic base registers (BAG for addresses and buildings, BGT for large-scale topography and BRO for subsurface data), where the focus is on data quality and integrity. The VNG note still bases the BIO questionnaire on version 1.04 for 2026. Councils can also opt into a separate benchmarking questionnaire, Waar Staat Je Gemeente.
Four dates that shape the ENSIA year
1 July: self-assessment opens
The platform opened for self-assessment on 1 July 2026, and this year it is a new platform. Councils that hand the questions to the relevant process owners over the summer leave themselves the autumn to gather evidence.
31 December: questionnaires close
The self-assessment has to be finished by 31 December, after which the questionnaires are locked. The same date is the point at which the IT auditor assesses the design and existence of the DigiD and Suwinet controls. A control that is not in place on New Year's Eve does not count.
January to April: audit and sign-off
DigiD and Suwinet require an audit by an IT auditor registered with NOREA, the Dutch professional body for IT auditors. From 2026 the only accepted method is 3000D. For Suwinet, councils must demonstrate seven named controls. Other parts of ENSIA can be audited too, but that is optional.
Over the same months the municipal executive (the college of mayor and aldermen) adopts the accountability statement and reviews the management reports on BAG, BGT and BRO. Book that meeting early. An audit report that lands in mid-April leaves very little slack.
30 April: submission
By 30 April 2027 the DigiD, Suwinet, BAG, BGT and BRO statements must be in ENSIA, with the audit report attached. BRP and travel documents go through a separate quality monitor by the same date. The executive then reports to the council in confidence, and the annual report gains a sub-section on information security under operational management. Approved annual accounts go to the province by 15 July.
How the Cybersecurity Act changes the picture
The Netherlands' NIS2 law, the Cyberbeveiligingswet, has applied since 15 August 2026. According to the VNG's guidance on the act, municipalities are classed as essential entities and the Dutch Authority for Digital Infrastructure (RDI) supervises them. Councils can use their ENSIA reporting to show how far they meet the act's duty of care, though the RDI is still working out how it will use that information. Every member of the executive must complete mandatory training within two years of the act taking effect.
The newer baseline, BIO2, now has a legal footing as well. For organisations within scope, a large part of it is anchored in the government sector's cybersecurity regulation as the way to meet the duty of care, and BIO2 version 1.3 remains the applicable baseline.
My advice is to build your ENSIA file as if the RDI will read it. Every answer needs evidence and an owner who can explain it. An answer only the security officer understands will not survive an inspection for long.
The people you need
I hold a simple view on this: the people who run the processes should supply the answers, and the security officer should coordinate. In practice that splits the work like this:
- The information security officer or CISO runs the process, allocates the questions, keeps the timetable and challenges the answers. For more on the role, see what an information security officer does.
- Process owners answer for their own areas: civil affairs for the BRP and travel documents, the social services team for Suwinet, whichever department offers services through DigiD, and the people who maintain BAG, BGT and BRO.
- Application management and contract management chase supplier statements and assurance reports so they arrive in time. The VNG note puts that responsibility on the council.
- A NOREA-registered IT auditor carries out the mandatory DigiD and Suwinet audit as an independent third line. I set out how the lines fit together in my piece on the three lines of defence model.
- The executive signs off, and the council holds it to account.
The split matters because a security officer who fills in everything is assessing controls someone else operates. The process owner learns nothing, and when the auditor asks for evidence it is the process owner who has to produce it anyway. That is how a council ends up spending days in March reconstructing what was entered in September.
When to bring in interim support
Extra capacity tends to pay off when the work stalls for lack of people or know-how. Perhaps the security officer post falls vacant in the autumn, or most of the self-assessment is still open in November. Or this is the first year your DigiD and Suwinet audits follow 3000D and nobody in-house has done one.
Hiring at a Dutch council usually goes through a tender or framework agreement, which takes weeks. If you need someone in October, start the request in September. I explain how those procurement routes work in hiring cybersecurity contractors in Dutch government.
We supply interim security officers, CISOs and GRC specialists with public sector experience. You can see the profiles on our pages for GRC and compliance specialists, CISOs and security officers and cybersecurity for government. If your ENSIA timetable is slipping or the security officer seat is empty, call or email me.
