Audits & reviews this year
January
-
2 Risk reviews · 3 – 30 Jan expand collapse
-
2 Supplier reviews · 4 – 24 Jan expand collapse
- Test Continuity test: Ransomware recovery plan · Next occurrence · SCH-018
- Review Colocation provider failure plan · Continuity plan review · BCP-005
- Review Only two engineers can operate the storage layer of the hosting platform · Business issue review · BIS-003
- Review Dutch Data Protection Authority · Interested party review · IPY-002
- Review Obtain ISO 27001:2022 certification · Objective review · OBJ-001
February
-
6 Risk reviews · 1 – 19 Feb expand collapse
- Review Personal data in service desk tickets is handled carelessly · Risk review · RSK-013
- Review Incident reporting duties under the Cbw are not met · Risk review · RSK-021
- Review Late patching of customer endpoints · Risk review · RSK-012
- Review Departing employee keeps access to customer systems · Risk review · RSK-011
- Review SLA penalties after repeated incidents at one customer · Risk review · RSK-015
- Review One engineer holds the knowledge of a customer platform · Risk review · RSK-010
-
3 Supplier reviews · 3 – 28 Feb expand collapse
- Review Bram Oosterhuis · Asset review · PER-040 · Bram Oosterhuis
- Review Rijksinspectie Digitale Infrastructuur · Interested party review · IPY-003
March
-
8 Risk reviews · 1 – 31 Mar expand collapse
- Review Stage 2 audit finds a major nonconformity · Risk review · RSK-016
- Review Failure of a colocation provider · Risk review · RSK-008
- Review Unauthorised access to the privileged credential vault · Risk review · RSK-007
- Review Misconfigured customer firewall exposes an internal service · Risk review · RSK-006
- Review A sub-processor changes without notice to customers · Risk review · RSK-017
- Review Phishing of service desk staff leading to access to a customer tenant · Risk review · RSK-005
- Review Privileged credential theft from an engineer laptop · Risk review · RSK-004
- Review Unmanaged devices on the office network · Risk review · RSK-019
- Review Marloes Brinkman · Asset review · PER-004 · Marloes Brinkman
-
2 Supplier reviews · 5 – 25 Mar expand collapse
- Review Key person unavailability plan · Continuity plan review · BCP-004
- Review Staff and contractors · Interested party review · IPY-004
April
May
- Review Shareholders and the Advisory Board · Interested party review · IPY-005
-
3 Asset reviews · 4 – 24 May expand collapse
- Review Fortinet · Supplier review · SUP-006
- Review Security Awareness and Training Procedure · Procedure review · PRO-011
- Review Utrecht office loss plan · Continuity plan review · BCP-003
June
-
6 Policy reviews · 3 – 23 Jun expand collapse
- Review Acceptable Use Policy · Policy review · POL-002
- Review Secure Development and Change Policy · Policy review · POL-011
- Review Physical and Environmental Security Policy · Policy review · POL-012
- Review Risk Management Policy · Policy review · POL-004
- Review Access Control Policy · Policy review · POL-003
- Review Information Classification and Retention Policy · Policy review · POL-009
- Review Hanneke Rutten · Asset review · PER-039 · Hanneke Rutten
-
2 Supplier reviews · 3 – 23 Jun expand collapse
- Review Both colocation contracts end within two years · Business issue review · BIS-004
-
2 Procedure reviews · 3 – 23 Jun expand collapse
- Review Suppliers · Interested party review · IPY-006
July
-
5 Policy reviews · 3 – 28 Jul expand collapse
- Review Human Resources Security Policy · Policy review · POL-013
- Review Remote Working and Mobile Devices Policy · Policy review · POL-014
- Review Incident Response Policy · Policy review · POL-005
- Review Business Continuity and Disaster Recovery Policy · Policy review · POL-006
- Review Supplier Security Policy · Policy review · POL-007
-
2 Supplier reviews · 3 – 13 Jul expand collapse
-
5 Procedure reviews · 8 – 28 Jul expand collapse
- Review Joiner, Mover and Leaver Procedure · Procedure review · PRO-002
- Review Internal Audit and Management Review Procedure · Procedure review · PRO-010
- Review Data Subject Request Handling Procedure · Procedure review · PRO-009
- Review Incident Handling Procedure · Procedure review · PRO-003
- Review Supplier Onboarding and Review Procedure · Procedure review · PRO-008
- Review Dimitri Volkov · Asset review · PER-028 · Dimitri Volkov
- Review Norland Certification · Interested party review · IPY-007
- Test Continuity test: Data centre loss plan · Next occurrence · SCH-017
- Review The Cyberbeveiligingswet applies to managed service providers · Business issue review · BIS-002
August
- Review ISMS scope · Scope review
- Review Offer an immutable backup option · Opportunity review · OPP-004
- Review Ransomware recovery plan · Continuity plan review · BCP-002
- Review Cryptography Policy · Policy review · POL-010
-
2 Procedure reviews · 7 – 22 Aug expand collapse
- Review Premiums for cyber insurance are rising · Business issue review · BIS-007
- Review Managed service industry association · Interested party review · IPY-008
September
-
2 Policy reviews · 1 – 16 Sep expand collapse
-
2 Opportunity reviews · 1 – 16 Sep expand collapse
- Review Sam de Vries · Asset review · PER-001 · Sam de Vries
-
3 Supplier reviews · 16 – 26 Sep expand collapse
- Review Personal Data Breach Notification Procedure · Procedure review · PRO-004
October
-
2 Opportunity reviews · 1 – 11 Oct expand collapse
- Review Data centre loss plan · Continuity plan review · BCP-001
-
124 Requirement reviews · 62 done · 31 Oct expand collapse
- Done Understanding the organisation and its context · Requirement review · 4.1
- Review Understanding the organisation and its context · Requirement review · 4.1
- Done Understanding the needs and expectations of interested parties · Requirement review · 4.2
- Review Understanding the needs and expectations of interested parties · Requirement review · 4.2
- Done Determining the scope of the information security management system · Requirement review · 4.3
- Review Determining the scope of the information security management system · Requirement review · 4.3
- Done Information security management system · Requirement review · 4.4
- Review Information security management system · Requirement review · 4.4
- Done Leadership and commitment · Requirement review · 5.1
- Review Leadership and commitment · Requirement review · 5.1
- Done Policy · Requirement review · 5.2
- Review Policy · Requirement review · 5.2
- Done Organisational roles, responsibilities and authorities · Requirement review · 5.3
- Review Organisational roles, responsibilities and authorities · Requirement review · 5.3
- Done Actions to address risks and opportunities - general · Requirement review · 6.1.1
- Review Actions to address risks and opportunities - general · Requirement review · 6.1.1
- Done Information security risk assessment · Requirement review · 6.1.2
- Review Information security risk assessment · Requirement review · 6.1.2
- Done Information security risk treatment · Requirement review · 6.1.3
- Review Information security risk treatment · Requirement review · 6.1.3
- Done Information security objectives and planning to achieve them · Requirement review · 6.2
- Review Information security objectives and planning to achieve them · Requirement review · 6.2
- Done Planning of changes · Requirement review · 6.3
- Review Planning of changes · Requirement review · 6.3
- Done Resources · Requirement review · 7.1
- Review Resources · Requirement review · 7.1
- Done Competence · Requirement review · 7.2
- Review Competence · Requirement review · 7.2
- Done Awareness · Requirement review · 7.3
- Review Awareness · Requirement review · 7.3
- Done Communication · Requirement review · 7.4
- Review Communication · Requirement review · 7.4
- Done Documented information - general · Requirement review · 7.5.1
- Review Documented information - general · Requirement review · 7.5.1
- Done Creating and updating documented information · Requirement review · 7.5.2
- Review Creating and updating documented information · Requirement review · 7.5.2
- Done Control of documented information · Requirement review · 7.5.3
- Review Control of documented information · Requirement review · 7.5.3
- Done Operational planning and control · Requirement review · 8.1
- Review Operational planning and control · Requirement review · 8.1
- Done Information security risk assessment (operational) · Requirement review · 8.2
- Review Information security risk assessment (operational) · Requirement review · 8.2
- Done Information security risk treatment (operational) · Requirement review · 8.3
- Review Information security risk treatment (operational) · Requirement review · 8.3
- Done Monitoring, measurement, analysis and evaluation · Requirement review · 9.1
- Review Monitoring, measurement, analysis and evaluation · Requirement review · 9.1
- Done Internal audit - general · Requirement review · 9.2.1
- Review Internal audit - general · Requirement review · 9.2.1
- Done Internal audit programme · Requirement review · 9.2.2
- Review Internal audit programme · Requirement review · 9.2.2
- Done Management review - general · Requirement review · 9.3.1
- Review Management review - general · Requirement review · 9.3.1
- Done Management review inputs · Requirement review · 9.3.2
- Review Management review inputs · Requirement review · 9.3.2
- Done Management review results · Requirement review · 9.3.3
- Review Management review results · Requirement review · 9.3.3
- Done Continual improvement · Requirement review · 10.1
- Review Continual improvement · Requirement review · 10.1
- Done Nonconformity and corrective action · Requirement review · 10.2
- Review Nonconformity and corrective action · Requirement review · 10.2
- Done Lawfulness, fairness and transparency · Requirement review · Art. 5(1)(a)
- Review Lawfulness, fairness and transparency · Requirement review · Art. 5(1)(a)
- Done Purpose limitation · Requirement review · Art. 5(1)(b)
- Review Purpose limitation · Requirement review · Art. 5(1)(b)
- Done Data minimisation · Requirement review · Art. 5(1)(c)
- Review Data minimisation · Requirement review · Art. 5(1)(c)
- Done Accuracy · Requirement review · Art. 5(1)(d)
- Review Accuracy · Requirement review · Art. 5(1)(d)
- Done Storage limitation · Requirement review · Art. 5(1)(e)
- Review Storage limitation · Requirement review · Art. 5(1)(e)
- Done Integrity and confidentiality · Requirement review · Art. 5(1)(f)
- Review Integrity and confidentiality · Requirement review · Art. 5(1)(f)
- Done Lawfulness of processing · Requirement review · Art. 6
- Review Lawfulness of processing · Requirement review · Art. 6
- Done Information to be provided to data subjects · Requirement review · Art. 13-14
- Review Information to be provided to data subjects · Requirement review · Art. 13-14
- Done Transparent communication and exercising rights · Requirement review · Art. 12
- Review Transparent communication and exercising rights · Requirement review · Art. 12
- Done Right of access · Requirement review · Art. 15
- Review Right of access · Requirement review · Art. 15
- Done Right to rectification · Requirement review · Art. 16
- Review Right to rectification · Requirement review · Art. 16
- Done Right to erasure ('right to be forgotten') · Requirement review · Art. 17
- Review Right to erasure ('right to be forgotten') · Requirement review · Art. 17
- Done Right to restriction of processing · Requirement review · Art. 18
- Review Right to restriction of processing · Requirement review · Art. 18
- Done Notify recipients of rectification, erasure, or restriction · Requirement review · Art. 19
- Review Notify recipients of rectification, erasure, or restriction · Requirement review · Art. 19
- Done Right to data portability · Requirement review · Art. 20
- Review Right to data portability · Requirement review · Art. 20
- Done Right to object · Requirement review · Art. 21
- Review Right to object · Requirement review · Art. 21
- Done Responsibility of the controller (accountability) · Requirement review · Art. 24
- Review Responsibility of the controller (accountability) · Requirement review · Art. 24
- Done Data protection by design and by default · Requirement review · Art. 25
- Review Data protection by design and by default · Requirement review · Art. 25
- Done Processor contracts · Requirement review · Art. 28
- Review Processor contracts · Requirement review · Art. 28
- Done Records of processing activities · Requirement review · Art. 30
- Review Records of processing activities · Requirement review · Art. 30
- Done Security of processing · Requirement review · Art. 32
- Review Security of processing · Requirement review · Art. 32
- Done Notification of a personal data breach to the supervisory authority · Requirement review · Art. 33
- Review Notification of a personal data breach to the supervisory authority · Requirement review · Art. 33
- Done Communication of a personal data breach to the data subject · Requirement review · Art. 34
- Review Communication of a personal data breach to the data subject · Requirement review · Art. 34
- Done Duty of care · Requirement review · Cyberbeveiligingswet art. 21
- Review Duty of care · Requirement review · Cyberbeveiligingswet art. 21
- Done Board approval and training · Requirement review · Cyberbeveiligingswet art. 24
- Review Board approval and training · Requirement review · Cyberbeveiligingswet art. 24
- Done Duty to report significant incidents · Requirement review · Cyberbeveiligingswet art. 25
- Review Duty to report significant incidents · Requirement review · Cyberbeveiligingswet art. 25
- Done Early warning within 24 hours · Requirement review · Cyberbeveiligingswet art. 26
- Review Early warning within 24 hours · Requirement review · Cyberbeveiligingswet art. 26
- Done Notification within 72 hours · Requirement review · Cyberbeveiligingswet art. 27
- Review Notification within 72 hours · Requirement review · Cyberbeveiligingswet art. 27
- Done Interim report · Requirement review · Cyberbeveiligingswet art. 28
- Review Interim report · Requirement review · Cyberbeveiligingswet art. 28
- Done Progress report and final report · Requirement review · Cyberbeveiligingswet art. 29
- Review Progress report and final report · Requirement review · Cyberbeveiligingswet art. 29
- Done Informing the recipients of your services · Requirement review · Cyberbeveiligingswet art. 30
- Review Informing the recipients of your services · Requirement review · Cyberbeveiligingswet art. 30
- Done Registration in the national register · Requirement review · Cyberbeveiligingswet art. 44
- Review Registration in the national register · Requirement review · Cyberbeveiligingswet art. 44
- Review Nine customers migrated off the retired legacy platform need post-migration checks · Business issue review · BIS-006
- Review Physical Access and Visitor Management Procedure · Procedure review · PRO-012
November
Nothing due
December
Nothing due