Compliance

This is the Compliance demo. Every visitor shares this company, and it resets every night.

What you change here, everyone sees until the next reset. Email, payments, and the AI models are switched off.

Start your own trial
  • EU GDPR (2016)
  • ISO 27001:2022
  • NIS2
  • NIS2 Netherlands (Cbw, 2026)

Nothing found that matches the search criteria.
Start your own trial
SV
Sam de Vries
sam.devries@tidewell-it.example
Legal

Proposed coverage

Covering artifact
Target requirement
Composition paths
Relation strength
OBJ-004 — Bring the Cbw measures to full coverage
5.1 Leadership and commitment
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 24 — Board approval and training Leadership and commitment Partial
Partial
PRO-011 — Security Awareness and Training Procedure
5.1 Leadership and commitment
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 24 — Board approval and training Leadership and commitment Partial
Partial
OPP-005 — Bundle Cbw readiness checks into the service desk offer
5.1 Leadership and commitment
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 24 — Board approval and training Leadership and commitment Partial
Partial
BIS-002 — The Cyberbeveiligingswet applies to managed service providers
5.2 Policy
  • NIS2 CIR 2024/2690 Annex 1 — Security policy and responsibilities Management system policy Equivalent
Equivalent
BIS-002 — The Cyberbeveiligingswet applies to managed service providers
5.3 Organisational roles, responsibilities and authorities
  • NIS2 CIR 2024/2690 Annex 1 — Security policy and responsibilities Roles, responsibilities and authorities Equivalent
Equivalent
BIS-002 — The Cyberbeveiligingswet applies to managed service providers
6.1.2 Information security risk assessment
  • NIS2 CIR 2024/2690 Annex 2 — Risk management, compliance monitoring and independent review Risk assessment Equivalent
Equivalent
IPY-003 — Rijksinspectie Digitale Infrastructuur
6.1.2 Information security risk assessment
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 7 — Risk management policy Risk assessment Equivalent
Equivalent
POL-001 — Information Security Policy
6.1.3 Information security risk treatment
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 21 — Duty of care Risk treatment Related
Related
RSK-021 — Incident reporting duties under the Cbw are not met
6.1.3 Information security risk treatment
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 21 — Duty of care Risk treatment Related
Related
OBJ-004 — Bring the Cbw measures to full coverage
6.1.3 Information security risk treatment
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 21 — Duty of care Risk treatment Related
Related
BIS-002 — The Cyberbeveiligingswet applies to managed service providers
6.1.3 Information security risk treatment
  • NIS2 CIR 2024/2690 Annex 2 — Risk management, compliance monitoring and independent review Risk treatment Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 21 — Duty of care Risk treatment Related
Equivalent
IPY-003 — Rijksinspectie Digitale Infrastructuur
6.1.3 Information security risk treatment
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 7 — Risk management policy Risk treatment Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 21 — Duty of care Risk treatment Related
Equivalent
POL-001 — Information Security Policy
7.2 Competence
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 24 — Board approval and training Competence Partial
Partial
OBJ-004 — Bring the Cbw measures to full coverage
7.2 Competence
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 24 — Board approval and training Competence Partial
Partial
OPP-005 — Bundle Cbw readiness checks into the service desk offer
7.2 Competence
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 24 — Board approval and training Competence Partial
Partial
POL-002 — Acceptable Use Policy
7.3 Awareness
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 12 — Cyber hygiene and training Awareness Equivalent
Equivalent
OBJ-005 — Bring the phishing click rate below 3 percent
7.3 Awareness
  • NIS2 CIR 2024/2690 Annex 8 — Awareness and security training Awareness Equivalent
Equivalent
BIS-002 — The Cyberbeveiligingswet applies to managed service providers
8.2 Information security risk assessment (operational)
  • NIS2 CIR 2024/2690 Annex 2 — Risk management, compliance monitoring and independent review Risk assessment Equivalent
Equivalent
IPY-003 — Rijksinspectie Digitale Infrastructuur
8.2 Information security risk assessment (operational)
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 7 — Risk management policy Risk assessment Equivalent
Equivalent
POL-001 — Information Security Policy
8.3 Information security risk treatment (operational)
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 21 — Duty of care Risk treatment Related
Related
RSK-021 — Incident reporting duties under the Cbw are not met
8.3 Information security risk treatment (operational)
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 21 — Duty of care Risk treatment Related
Related
OBJ-004 — Bring the Cbw measures to full coverage
8.3 Information security risk treatment (operational)
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 21 — Duty of care Risk treatment Related
Related
BIS-002 — The Cyberbeveiligingswet applies to managed service providers
8.3 Information security risk treatment (operational)
  • NIS2 CIR 2024/2690 Annex 2 — Risk management, compliance monitoring and independent review Risk treatment Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 21 — Duty of care Risk treatment Related
Equivalent
IPY-003 — Rijksinspectie Digitale Infrastructuur
8.3 Information security risk treatment (operational)
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 7 — Risk management policy Risk treatment Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 21 — Duty of care Risk treatment Related
Equivalent
BIS-002 — The Cyberbeveiligingswet applies to managed service providers
A.5.1 Policies for information security
  • NIS2 CIR 2024/2690 Annex 1 — Security policy and responsibilities Management system policy Partial
Partial
RSK-018 — Theft or loss of a field engineer laptop
A.5.11 Return of assets
  • NIS2 CIR 2024/2690 Annex 12 — Asset classification, handling and inventory Asset inventory Partial
Partial
IPY-003 — Rijksinspectie Digitale Infrastructuur
A.5.11 Return of assets
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 16 — Asset management Asset inventory Partial
Partial
POL-010 — Cryptography Policy
A.5.15 Access control
  • EU GDPR (2016) Art. 32 — Security of processing Access control Related
Related
POL-008 — Personal Data Protection Policy
A.5.15 Access control
  • EU GDPR (2016) Art. 5(1)(f) — Integrity and confidentiality Access control Related
Related
RSK-007 — Unauthorised access to the privileged credential vault
A.5.15 Access control
  • NIS2 CIR 2024/2690 Annex 11 — Access rights, privileged accounts and authentication Access control Equivalent
  • NIS2 CIR 2024/2690 Annex 11 — Access rights, privileged accounts and authentication Privileged and least-privilege access Related
Equivalent
RSK-026 — Excessive administrator rights on internal systems
A.5.15 Access control
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 15 — Access policy Access control Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 15 — Access policy Privileged and least-privilege access Related
Equivalent
RSK-014 — A personal data breach is not reported within 72 hours
A.5.15 Access control
  • EU GDPR (2016) Art. 32 — Security of processing Access control Related
Related
RSK-013 — Personal data in service desk tickets is handled carelessly
A.5.15 Access control
  • EU GDPR (2016) Art. 32 — Security of processing Access control Related
  • EU GDPR (2016) Art. 5(1)(f) — Integrity and confidentiality Access control Related
Related
RSK-007 — Unauthorised access to the privileged credential vault
A.5.16 Identity management
  • NIS2 CIR 2024/2690 Annex 11 — Access rights, privileged accounts and authentication Identity and authentication Equivalent
Equivalent
RSK-026 — Excessive administrator rights on internal systems
A.5.16 Identity management
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 15 — Access policy Identity and authentication Equivalent
Equivalent
RSK-026 — Excessive administrator rights on internal systems
A.5.17 Authentication information
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 15 — Access policy Identity and authentication Equivalent
Equivalent
PRO-001 — Access Request and Review Procedure
A.5.17 Authentication information
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 15 — Access policy Identity and authentication Equivalent
Equivalent
RSK-023 — Customer data is not removed when a contract ends
A.5.19 Information security in supplier relationships
  • EU GDPR (2016) Art. 28 — Processor contracts Supplier and third-party security Related
Related
IPY-006 — Suppliers
A.5.19 Information security in supplier relationships
  • NIS2 CIR 2024/2690 Annex 5 — Supply chain policy and supplier register Supplier and third-party security Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 10 — Supply chain security Supplier and third-party security Equivalent
Equivalent
BIS-002 — The Cyberbeveiligingswet applies to managed service providers
A.5.2 Information security roles and responsibilities
  • NIS2 CIR 2024/2690 Annex 1 — Security policy and responsibilities Roles, responsibilities and authorities Partial
Partial
RSK-023 — Customer data is not removed when a contract ends
A.5.20 Addressing information security within supplier agreements
  • EU GDPR (2016) Art. 28 — Processor contracts Supplier and third-party security Related
Related
IPY-006 — Suppliers
A.5.20 Addressing information security within supplier agreements
  • NIS2 CIR 2024/2690 Annex 5 — Supply chain policy and supplier register Supplier and third-party security Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 10 — Supply chain security Supplier and third-party security Equivalent
Equivalent
IPY-006 — Suppliers
A.5.21 Managing information security in the ICT supply chain
  • NIS2 CIR 2024/2690 Annex 5 — Supply chain policy and supplier register ICT supply chain security Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 10 — Supply chain security ICT supply chain security Equivalent
Equivalent
RSK-023 — Customer data is not removed when a contract ends
A.5.22 Monitoring, review and change management of supplier services
  • EU GDPR (2016) Art. 28 — Processor contracts Supplier and third-party security Related
Related
IPY-006 — Suppliers
A.5.22 Monitoring, review and change management of supplier services
  • NIS2 CIR 2024/2690 Annex 5 — Supply chain policy and supplier register Supplier and third-party security Partial
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 10 — Supply chain security Supplier and third-party security Partial
Partial
PRO-008 — Supplier Onboarding and Review Procedure
A.5.23 Information security for use of cloud services
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 10 — Supply chain security ICT supply chain security Equivalent
Equivalent
IPY-006 — Suppliers
A.5.23 Information security for use of cloud services
  • NIS2 CIR 2024/2690 Annex 5 — Supply chain policy and supplier register ICT supply chain security Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 10 — Supply chain security ICT supply chain security Equivalent
Equivalent
OPP-001 — Offer managed security monitoring to existing customers
A.5.24 Information security incident management planning and preparation
  • NIS2 CIR 2024/2690 Annex 3 — Incident handling, monitoring and logging Incident management planning Equivalent
Equivalent
RSK-021 — Incident reporting duties under the Cbw are not met
A.5.25 Assessment and decision on information security events
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 8 — Incident handling and logging Incident detection and response Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 25 — Duty to report significant incidents Incident detection and response Partial
Equivalent
PRO-004 — Personal Data Breach Notification Procedure
A.5.25 Assessment and decision on information security events
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 30 — Informing the recipients of your services Incident detection and response Partial
Partial
137 total
Page 1 of 3

Are you sure?

This action cannot be reverted.

Leave this page?

Your changes on this form are not saved. If you leave, they are lost.