The Normenkader Informatiebeveiliging en Privacy (IBP) is the shared Dutch standard for digitally safe education. It was drawn up by the Ministry of Education (OCW), the PO-Raad, the VO-raad, SIVON and Kennisnet. The framework contains 69 standards for information security and 25 standards for privacy.
The framework applies to school boards in primary, secondary and special education. By 1 January 2027 at the latest, a self-assessment tells you where you stand and you have an action plan. By 2030 at the latest, all schools meet maturity level 3 on every standard.
Measure:
Record how your school handles information security and privacy, with clear roles and responsibilities. The school board remains ultimately responsible, including for outsourced services.
Measure:
Use a self-assessment to map the maturity level you are at for each standard. Then draw up a plan to reach level 3 on all standards.
Measure:
Run an organisation-wide awareness programme that makes staff aware of their role in information security. For example with Arda's cyber security awareness e-learning. That is how they learn to recognise risks.
Measure:
Give staff and pupils access only to the systems and data they need. Revoke rights promptly when someone changes role or leaves.
Measure:
Record how you recognise, handle and report security incidents and data breaches. A data breach that poses a risk to those involved must be reported to the Dutch Data Protection Authority within 72 hours.
Measure:
Make agreements with suppliers about information security and privacy, for example in a data processing agreement. Also check whether they keep to those agreements.
Standard HR.06, information security awareness, describes what is expected of a school at each maturity level. The Arda platform is built to match.
Level 3
Arda offers one programme for all staff, with dedicated modules and short films about situations that really happen in education.
Level 4
As an administrator you see exactly how many participants have completed which components. Progress reports are easy to share with the board.
Level 5
With the Phishing Inbox, staff practise with realistic emails. You see how their behaviour develops and adjust your programme based on the results.
Practical
Connect Arda to your Active Directory and log in with single sign-on. During busy periods or school holidays you simply pause the programme.
Do you want to demonstrably raise awareness across your school board? Arda helps staff recognise digital risks, so they become the strongest link in your school's security.
The privacy standards implement the obligations of the GDPR. For information security there is no comparable legal obligation yet. The Ministry of Education does expect school boards to have insight into their digital security by 1 January 2027 and to reach maturity level 3 on all standards by 2030 at the latest.
Standard HR.06 asks for an awareness programme that makes users, such as staff, pupils and suppliers, aware of their responsibility for information security. At level 3 this programme is part of the information security plan and is carried out organisation-wide.
No. The framework is intended for primary, secondary and special education and for inclusive education partnerships. Vocational and higher education use the SURFaudit assessment framework. Arda also supports vocational colleges, universities of applied sciences and universities with awareness for staff and students.
Aware employees who know how to keep cybercriminals out.
50% more reports of suspicious emails by employees.
Less stress about reputational damage and recovery costs after an incident.
