ISO 27001 internal audit

Sam de Vries and Joris Kamphuis audited the ISMS over three days. They sampled the Access Control Policy, the Supplier Security Policy, and the continuity Policy, followed leavers and access rights reviews through the service desk records, and checked how the colocation arrangements are supervised.

The audit raised seven Findings. Access rights reviews were skipped for two quarters and leavers' accounts are disabled later than the 24-hour target, both Major. The rest are Minor Findings and one Opportunity. The management review picked up the results as an input.