Zoning and secured zones under VIRBI 2025

What VIRBI 2025 is and who it applies to

The Besluit voorschrift informatiebeveiliging rijksdienst bijzondere informatie 2025, VIRBI 2025 for short, was adopted on 21 August 2025 and published in the Staatscourant of 8 September 2025. It enters into force the day after publication and repeals VIRBI 2013. In practice: from 9 September 2025 the new decree applies. VIRBI 2025, articles 12 and 13

It applies to the Rijksdienst, Dutch central government, and that scope stands in the very first substantive provision. VIRBI 2025, article 2(1)

There was a six-month transitional arrangement for existing classified information that fully met the measures under VIRBI 2013, in so far as the annex to the new decree added requirements on top. That period has since expired. VIRBI 2025, article 11

The four classifications

The decree distinguishes four levels, each with its own damage criterion. The official spelling and abbreviations are set in article 4(2). They differ from what is used in practice, and it pays to copy them into a file verbatim.

• Staatsgeheim ZEER GEHEIM (Stg.ZG) where disclosure to unauthorised persons could cause very serious damage to one of the vital interests of the Netherlands and the Dutch state, or of its allies.
• Staatsgeheim GEHEIM (Stg.G) for serious damage to those same interests.
• Staatsgeheim CONFIDENTIEEL (Stg.C) for damage to those same interests.
• Departementaal VERTROUWELIJK (Dep.V) for damage to the interests of one or more ministries or of allies of the Dutch state.

The difference between the three state-secret levels therefore lies not in the kind of interest but in the severity of the damage; Dep.V differs in that it concerns departmental rather than vital interests. VIRBI 2025, article 4(2)

What VIRBI says about zoning, and what it does not

The zoning rule sits in table 5 of the annex and consists of two lines. Dep.V information is structurally processed, handled and discussed in at least Zone 2 and incidentally in Zone 1. Special information, meaning the state-secret part, is structurally processed, handled and discussed in at least an extra secured work area.

The decree itself adds the most important practical consequence: structurally processing Dep.V information in a Zone 1 is a deviation requiring a formal exception. An organisation-specific tightening is permitted, and for home working the departmental policy determines what is allowed. By “discussed” the decree means any meeting in which special information comes up. VIRBI 2025, annex, table 5

And then the provision that causes the most confusion. VIRBI does not define Zone 1, Zone 2 or the extra secured work area itself. For all three the table refers to the Normenkader Beveiliging Rijkskantoren (NkBR), the standards framework for securing government offices, each time with the addition “or a space considered equivalent”. Anyone looking for the zone definitions in the decree will not find them there.

A footnote to that reference adds that the NkBR does not apply to every central government building. That explains why the equivalence clause is there, and it means the zone label has no independent content without the underlying framework or a substantiated equivalent. The framework itself is not part of the publication.

The minimum requirements per classification

Table 5.1 of the annex holds the minimum requirements for the physical security of locations and buildings, arranged per classification. Below are rows C to X, with the letters from the decree so that every line can be traced back. A bullet means the decree makes the measure mandatory at that level; at row C the decree refers Dep.V to the BIO rather than prescribing the measure itself.

Two things stand out on reading this table. The first is the jump between Dep.V and Stg.C: nine of these measures only come into play at state-secret level, among them detection outside office hours, keeping personal electronics out, TEMPEST and the technical examination. The second is that the requirements applying at all four levels are almost all organisational: register visitors, concentrate information, store it, keep track of keys. For those four a refurbishment delivers nothing; they are made good every day, or they are not.

The annex is otherwise risk-based, but these tables fix a minimum level. Departures from it must be reasoned in the risk analysis and offset with mitigating measures.

Rows J and K, on technical examination at commissioning and on change, are worked out separately in the Dutch national TSCM/EVO policy advice. Row I on TEMPEST is worked out in TEMPEST and compromising emanations.

Who decides and who advises

Responsibility runs through the line. The secretary-general adopts the departmental security policy, and that policy describes how prior accreditation for processing special information is granted. The departmental security officer holds the coordinating and supervisory role, including the coherent approach to classified information and the investigation following compromise. VIRBI 2025, article 3

For specialist questions the route leads to the AIVD’s Unit Weerbaarheid, which prescribes and supplies the communications security regulations. For TEMPEST, a footnote to the table refers to the National TEMPEST Authority. The NBIV only enters the picture once a Special Contract is involved; that is the industrial-security side and not the departmental line.

What happens when the information leaves central government

The conclusion that VIRBI then stops mattering is drawn too quickly. The decree provides the opposite: where special information is taken outside central government, other than under a statutory duty of disclosure, the security requirements in the decree and the supervision of them remain fully in force. VIRBI 2025, article 7(1)

The correct reading is therefore twofold. The decree addresses central government and imposes no independent obligation on a company. But the security requirements travel with the information, and it is for the government party to secure that. In a procurement that happens through the contract, and where there is a Special Contract, through the ABRO.

For information obtained under a treaty or international agreement, onward transfer to external parties takes place only with the prior consent of the country or organisation of origin. VIRBI 2025, article 7(2)

A zone and a compartment are not the same thing

Both systems protect information through a controlled physical environment, with access rules, delay and detection, acoustic and visual screening and specialist electronic measures. The similarity is functional. The concepts are not.

That has practical consequences. A supplier offering to “build a Zone 2” for an ABRO assignment is using a term from the wrong system. Conversely, a compartment at TBB 3 says nothing about whether a room within central government can be designated an extra secured work area. How a compartment is used and managed in practice is set out in TBB rooms; the relationship between the ABRO and the Dutch Cybersecurity Act is covered in what ABRO and the Cbw require.

The international layer

Information obtained under a treaty or international agreement retains the classification assigned to it and is protected at the corresponding national security level. Where that treaty contains divergent provisions, those are applied. VIRBI 2025, article 2(3)

That is a precedence rule, not a translation table. NATO and the EU use their own classifications of secured spaces and their own accreditation chains, and the TEMPEST zoning in the NATO documents is again something other than the access zones VIRBI refers to, even though both use the word zone. An equivalence between a VIRBI zone and an international space category follows from neither system, and cannot be substantiated from public sources either.

What is public and what you have to request

• Public. VIRBI 2025 is published in full in the Staatscourant and on wetten.overheid.nl, including the annex with table 5 and table 5.1. The ABRO 2026 is likewise published in full.
• On request. The communications security regulations, including VBV 32000 for TEMPEST, are available from the Unit Weerbaarheid. In a Special Contract the instructions run via the NBIV.
• Not established in these sources. The NkBR itself, with the definitions behind Zone 1, Zone 2 and the extra secured work area, was not found as a public primary source. Anyone needing those definitions ends up with their own departmental security officer or the owner of the framework.

For a procurement or design file that last point is not a detail. A requirement referring to “Zone 2 in accordance with the NkBR” only becomes testable once it is settled which version of that framework is meant, or, for a space considered equivalent, on what that equivalence rests and who established it.