Skip to main content
Glossary termPublished inNormenkader IBP

Volwassenheidsniveau

Also known as maturity level, volwassenheidsniveau 3, Normenkader IBP maturity level

What is a "volwassenheidsniveau" in the Normenkader IBP?

A volwassenheidsniveau is the maturity level, from 1 to 5, at which a school board meets one norm of the Normenkader IBP. Each norm describes the measures that belong to each level. Level 3, at which documented procedures are applied consistently and shown to work, is the minimum the sector aims for.

Defined in / by

Last updated: 14 October 2026.

The five levels

LevelNameIn short

1

Ad hoc

No structured approach, little or no documentation, problems solved as they arise

2

Herhaalbaar

Basic measures in place, but procedures applied informally

3

Bepaald

Documented procedures applied consistently; the board can show the measures were carried out, tested and work

4

Beheerst

Measures actively monitored, with periodic internal and external evaluation

5

Continu verbeteren

A proactive approach, built into the school's education strategy and daily practice

A score per norm, not per school

The level is set norm by norm. A board can be at level 3 on access control and at level 1 on business continuity at the same time, and the Normenkader asks for level 3 on every one of its 94 norms, 69 for information security and 25 for privacy. An average hides exactly the norms that matter: the IBP in beeld survey of March 2026 found the sector at an average of 1.7, with system development and business continuity management lowest at 1.3.

Levels build on each other. Kennisnet states that the measures at level 4 come on top of those at level 3, and those at level 5 on top of level 4. A board cannot skip a level by buying a tool that belongs higher up.

The deadline attached to the level comes from government policy, not from the framework. The State Secretary for Education wrote on 5 November 2025 that school boards must actually meet the norms in 2030, and the letter names level 3 as the target. There is one tension worth knowing. Kennisnet's description of level 3 includes measures that are "getest en effectief", tested and effective. The 2026 survey measured how measures are designed, from boards' own assessments. A board that scored itself at 3 on design has not yet shown the part of level 3 that asks for proof.

Questions and answers

Which volwassenheidsniveau must Dutch school boards reach under the Normenkader IBP?

Level 3 on every norm. The State Secretary for Education's letter of 5 November 2025 sets 2030 as the year school boards must actually meet the norms, with level 3 as the target level. Kennisnet calls level 3 the minimum the sector aims for and invites boards that are further along to work on levels 4 and 5.

Is the volwassenheidsniveau one score for the whole school board?

No. Each of the 94 norms of the Normenkader IBP has its own five levels, so a board has a level per norm. Surveys report averages, but the target is level 3 on every norm.

Sources

Regulations

  • Normenkader Informatiebeveiliging en Privacy (Normenkader IBP)

    The Normenkader IBP is the Dutch framework of 69 information security and 25 privacy norms for primary, secondary and special education. Each school board must know where it stands by 1 January 2027 and meet maturity level 3 on every norm in 2030. It is a policy agreement, not an act.

    Next
    Every board knows its position against the Normenkader through a self-evaluation, and has a plan to meet all norms