Audits & reviews this year
January
- Done Dell Technologies · Supplier review · SUP-004
- Done Colocation provider failure plan · Continuity plan review · BCP-005
- Done Only two engineers can operate the storage layer of the hosting platform · Business issue review · BIS-003
- Done Dutch Data Protection Authority · Interested party review · IPY-002
February
March
-
2 Supplier reviews · 2 done · 5 – 25 Mar expand collapse
- Done Key person unavailability plan · Continuity plan review · BCP-004
- Done Removable Media Policy · Policy review · POL-015
- Done Staff and contractors · Interested party review · IPY-004
April
May
- Done Shareholders and the Advisory Board · Interested party review · IPY-005
-
2 Supplier reviews · 2 done · 4 – 24 May expand collapse
- Done Security Awareness and Training Procedure · Procedure review · PRO-011
-
3 Risk reviews · 3 done · 14 – 26 May expand collapse
- Done Utrecht office loss plan · Continuity plan review · BCP-003
June
-
4 Risk reviews · 4 done · 1 – 25 Jun expand collapse
-
6 Policy reviews · 6 done · 3 – 23 Jun expand collapse
- Done Acceptable Use Policy · Policy review · POL-002
- Done Secure Development and Change Policy · Policy review · POL-011
- Done Physical and Environmental Security Policy · Policy review · POL-012
- Done Risk Management Policy · Policy review · POL-004
- Done Access Control Policy · Policy review · POL-003
- Done Information Classification and Retention Policy · Policy review · POL-009
-
2 Supplier reviews · 2 done · 3 – 23 Jun expand collapse
- Done Both colocation contracts end within two years · Business issue review · BIS-004
-
2 Procedure reviews · 2 done · 3 – 23 Jun expand collapse
- Done Suppliers · Interested party review · IPY-006
- Done Offer customers a SOC 2 report · Objective review · OBJ-007
July
-
5 Policy reviews · 5 done · 3 – 28 Jul expand collapse
- Done Human Resources Security Policy · Policy review · POL-013
- Done Remote Working and Mobile Devices Policy · Policy review · POL-014
- Done Incident Response Policy · Policy review · POL-005
- Done Business Continuity and Disaster Recovery Policy · Policy review · POL-006
- Done Supplier Security Policy · Policy review · POL-007
-
3 Supplier reviews · 3 done · 3 – 28 Jul expand collapse
- Done Theft or loss of a field engineer laptop · Risk review · RSK-018
-
5 Procedure reviews · 5 done · 8 – 28 Jul expand collapse
- Done Joiner, Mover and Leaver Procedure · Procedure review · PRO-002
- Done Internal Audit and Management Review Procedure · Procedure review · PRO-010
- Done Data Subject Request Handling Procedure · Procedure review · PRO-009
- Done Incident Handling Procedure · Procedure review · PRO-003
- Done Supplier Onboarding and Review Procedure · Procedure review · PRO-008
- Done Norland Certification · Interested party review · IPY-007
- Done The Cyberbeveiligingswet applies to managed service providers · Business issue review · BIS-002
August
- Done ISMS scope · Scope review
- Done Offer an immutable backup option · Opportunity review · OPP-004
- Done Ransomware recovery plan · Continuity plan review · BCP-002
-
8 Risk reviews · 8 done · 3 – 29 Aug expand collapse
- Done A personal data breach is not reported within 72 hours · Risk review · RSK-014
- Done Personal data in service desk tickets is handled carelessly · Risk review · RSK-013
- Done Incident reporting duties under the Cbw are not met · Risk review · RSK-021
- Done Late patching of customer endpoints · Risk review · RSK-012
- Done Departing employee keeps access to customer systems · Risk review · RSK-011
- Done SLA penalties after repeated incidents at one customer · Risk review · RSK-015
- Done One engineer holds the knowledge of a customer platform · Risk review · RSK-010
- Done Power or cooling failure in a data centre · Risk review · RSK-009
- Done Cryptography Policy · Policy review · POL-010
-
3 Supplier reviews · 3 done · 7 – 22 Aug expand collapse
-
2 Procedure reviews · 2 done · 7 – 22 Aug expand collapse
-
3 Objective reviews · 3 done · 12 – 27 Aug expand collapse
- Done Premiums for cyber insurance are rising · Business issue review · BIS-007
- Done Managed service industry association · Interested party review · IPY-008
September
-
2 Policy reviews · 2 done · 1 – 16 Sep expand collapse
-
2 Opportunity reviews · 2 done · 1 – 16 Sep expand collapse
-
3 Supplier reviews · 3 done · 1 – 21 Sep expand collapse
-
7 Risk reviews · 7 done · 2 – 28 Sep expand collapse
- Done Stage 2 audit finds a major nonconformity · Risk review · RSK-016
- Done Failure of a colocation provider · Risk review · RSK-008
- Done Unauthorised access to the privileged credential vault · Risk review · RSK-007
- Done Misconfigured customer firewall exposes an internal service · Risk review · RSK-006
- Done A sub-processor changes without notice to customers · Risk review · RSK-017
- Done Phishing of service desk staff leading to access to a customer tenant · Risk review · RSK-005
- Done Privileged credential theft from an engineer laptop · Risk review · RSK-004
-
2 Objective reviews · 2 done · 11 – 26 Sep expand collapse
- Done Personal Data Breach Notification Procedure · Procedure review · PRO-004
October
-
2 Opportunity reviews · 2 done · 1 – 11 Oct expand collapse
-
4 Risk reviews · 4 done · 2 – 16 Oct expand collapse
-
6 KPI measurements · 6 done · 4 – 28 Oct expand collapse
- Done Supplier reviews completed on schedule (%) · KPI measurement · KPI-006
- Done Open vulnerabilities older than 30 days · KPI measurement · KPI-005
- Done Backup restore tests passed (%) · KPI measurement · KPI-004
- Done Phishing simulation click rate (%) · KPI measurement · KPI-003
- Done Security awareness training completion (%) · KPI measurement · KPI-002
- Done Mean time to patch critical vulnerabilities (days) · KPI measurement · KPI-001
- Done Data centre loss plan · Continuity plan review · BCP-001
- Done Obtain ISO 27001:2022 certification · Objective review · OBJ-001
- Review Hans Overbeek · Asset review · PER-020 · Hans Overbeek (overdue)
- Review Loonwerk Payroll Services · Supplier review · SUP-017 (overdue)
- Training Phishing recognition and reporting · Training assignment · TRN-002 · 5 people (overdue)
November
-
6 KPI measurements · 3 – 27 Nov expand collapse
- Measurement Supplier reviews completed on schedule (%) · KPI measurement · KPI-006
- Measurement Open vulnerabilities older than 30 days · KPI measurement · KPI-005
- Measurement Backup restore tests passed (%) · KPI measurement · KPI-004
- Measurement Phishing simulation click rate (%) · KPI measurement · KPI-003
- Measurement Security awareness training completion (%) · KPI measurement · KPI-002
- Measurement Mean time to patch critical vulnerabilities (days) · KPI measurement · KPI-001
-
2 Objective reviews · 10 – 25 Nov expand collapse
-
3 Training assignments · 12 – 20 Nov expand collapse
-
2 Risk reviews · 16 – 28 Nov expand collapse
-
2 Supplier reviews · 20 – 30 Nov expand collapse
- Meeting Monthly ISMS meeting · Next occurrence · SCH-013
- Review Customers · Interested party review · IPY-001
December
-
2 Risk reviews · 4 – 10 Dec expand collapse
-
6 Asset reviews · 5 – 15 Dec expand collapse
- Review Roos van Beek · Asset review · PER-027 · Roos van Beek
- Review Charlotte Veldhuis · Asset review · PER-034 · Charlotte Veldhuis
- Review Lotte van Dijk · Asset review · PER-006 · Lotte van Dijk
- Review Joris Kamphuis · Asset review · PER-032 · Joris Kamphuis
- Review Marit Koster · Asset review · PER-021 · Marit Koster
- Review Gerrit Smeenk · Asset review · PER-014 · Gerrit Smeenk
- Training Secure administration of customer systems · Training assignment · TRN-005 · 1 people
-
2 Objective reviews · 10 – 25 Dec expand collapse