Overview
External audit · ISO 27001:2022, held
External audit · ISO 27001:2022, due
· in 42 day(s)
Overdue
- overdue by 18 day(s) Implement corrective action Corrective action Lotte van Dijk
- overdue by 12 day(s) Asset Review — Hans Overbeek Asset review Hans Overbeek
- overdue by 9 day(s) Review supplier: Loonwerk Payroll Services Supplier review Hanneke Rutten
- overdue by 6 day(s) Phishing recognition and reporting Training assignment 5 people
- overdue by 2 day(s) Send the Stage 1 follow-up evidence to the certification body Ad-hoc You
This week
- Prepare the notification to the Dutch data protection authority Ad-hoc Ilse Wiegman
- KPI-006 — Take measurement KPI measurement You
- Remediation Vulnerability remediation Mustafa Karaca
-
2 Policy awareness tasks expand collapse
- Physical Access and Visitor Management Procedure Procedure awareness 3 people
-
2 Root cause investigations expand collapse
- Reply to the certification body's Stage 1 report Ad-hoc You
- Update the supplier register with the new colocation contract Ad-hoc Vera Dijkstra
Next week
-
2 Policy approvals expand collapse
- Roll out the corrected template for ticket exports Ad-hoc Lotte van Dijk
- Prepare the Management Board update on the Stage 1 result Ad-hoc You
- KPI-005 — Take measurement KPI measurement You
- Add the DNS step to the data centre failover runbook Ad-hoc Hans Overbeek
- OBJ-005 — Review objective Objective review Nadia El Idrissi
-
2 Vulnerability remediations expand collapse
- Present the breach review to the Management Board Ad-hoc You
- Review who holds an access card for the Utrecht office and the data centres Ad-hoc Nobody
- Security awareness fundamentals Training assignment 4 people
- Review the open Findings with the Management Board Ad-hoc ISMS Manager
Week 46
·
-
2 KPI measurements expand collapse
- Make the Veeam repositories immutable in both data centre suites Risk treatment action Dimitri Volkov
- Prepare the registration with the Cbw national register Ad-hoc You
-
2 Training assignments expand collapse
- Security Awareness and Training Procedure Procedure awareness 5 people
- Review risk: Excessive administrator rights on internal systems Risk review Yara Visser
- Book the Cbw cyber risk session for the Management Board Ad-hoc Hanneke Rutten
- Next occurrence Next occurrence You
- Write the Cbw reporting steps into the incident process Ad-hoc You
Week 47
·
- Incident handling for the service desk Training assignment 1 person
- Review supplier: KPN Supplier review Hans Overbeek
- Check effectiveness of corrective action Effectiveness check Vera Dijkstra
- Prepare the Stage 2 audit evidence pack Ad-hoc You
- KPI-002 — Take measurement KPI measurement You
- Run a phishing simulation for the service desk Ad-hoc Thijs Bosman
- Require a second approval for software pushes to all customers Risk treatment action Esther Blom
- OBJ-004 — Review objective Objective review You
- Implement corrective action Corrective action Thijs Bosman
Week 48
·
- KPI-001 — Take measurement KPI measurement Hans Overbeek
- Review risk: Unpatched firmware on network equipment Risk review Hans Overbeek
- Plan the next Continuity test Ad-hoc You
- Review supplier: Meridian Cyber Insurance Supplier review Marloes Brinkman
-
2 Business issue reviews expand collapse
- IPY-001 — Review interested party Interested party review You
- Plan next year's internal audit programme Ad-hoc Internal Auditor
Week 49
·
- Secure administration of customer systems Training assignment 1 person
- Asset Review — Roos van Beek Asset review Roos van Beek
- Update the Statement of Applicability after Stage 2 feedback Ad-hoc You
- Enforce hardware keys for all engineer logins Risk treatment action Nadia El Idrissi
- OBJ-003 — Review objective Objective review Hans Overbeek
Week 50
·
Week 51
·