ISMS monthly meeting 10

Agenda: the lessons from the breach at the backup repository, and the inputs for the management review.

Discussion: an administrator account of a former engineer was used on a customer's backup repository. Awareness came four hours after detection and the report to the Dutch data protection authority went out two days later, within 72 hours. The offboarding checklist did not cover customer systems. The Incident is closed.

Decision: offboarding now checks every customer system, and a monthly report lists administrator accounts without a current employee. Sam de Vries collects the audit results, Findings, Incidents, and Risks as inputs for the management review.