Compliance

This is the Compliance demo. Every visitor shares this company, and it resets every night.

What you change here, everyone sees until the next reset. Email, payments, and the AI models are switched off.

Start your own trial
  • EU GDPR (2016)
  • ISO 27001:2022
  • NIS2
  • NIS2 Netherlands (Cbw, 2026)

Nothing found that matches the search criteria.
Start your own trial
SV
Sam de Vries
sam.devries@tidewell-it.example
Legal

Proposed coverage

Covering artifact
Target requirement
Composition paths
Relation strength
RSK-008 — Failure of a colocation provider
Cyberbeveiligingsbesluit art. 10 Supply chain security
  • ISO 27001:2022 A.5.20 — Addressing information security within supplier agreements Supplier and third-party security Equivalent
  • ISO 27001:2022 A.5.21 — Managing information security in the ICT supply chain ICT supply chain security Equivalent
  • ISO 27001:2022 A.5.22 — Monitoring, review and change management of supplier services Supplier and third-party security Partial
Equivalent
RSK-023 — Customer data is not removed when a contract ends
Cyberbeveiligingsbesluit art. 10 Supply chain security
  • EU GDPR (2016) Art. 28 — Processor contracts Supplier and third-party security Related
Related
RSK-025 — Outage of the Microsoft 365 service
Cyberbeveiligingsbesluit art. 10 Supply chain security
  • ISO 27001:2022 A.5.19 — Information security in supplier relationships Supplier and third-party security Equivalent
  • ISO 27001:2022 A.5.22 — Monitoring, review and change management of supplier services Supplier and third-party security Partial
  • ISO 27001:2022 A.5.23 — Information security for use of cloud services ICT supply chain security Equivalent
Equivalent
POL-011 — Secure Development and Change Policy
Cyberbeveiligingsbesluit art. 11 Secure acquisition, development and maintenance
  • ISO 27001:2022 A.8.25 — Secure development life cycle Secure development and SDLC Equivalent
  • ISO 27001:2022 A.8.26 — Application security requirements Secure development and SDLC Equivalent
  • ISO 27001:2022 A.8.28 — Secure coding Secure development and SDLC Equivalent
  • ISO 27001:2022 A.8.32 — Change management IT change management Equivalent
Equivalent
RSK-024 — Unpatched firmware on network equipment
Cyberbeveiligingsbesluit art. 11 Secure acquisition, development and maintenance
  • ISO 27001:2022 A.8.8 — Management of technical vulnerabilities Vulnerability and patch management Partial
Partial
RSK-012 — Late patching of customer endpoints
Cyberbeveiligingsbesluit art. 11 Secure acquisition, development and maintenance
  • ISO 27001:2022 A.8.8 — Management of technical vulnerabilities Vulnerability and patch management Partial
Partial
OBJ-003 — Patch critical vulnerabilities within 7 days
Cyberbeveiligingsbesluit art. 11 Secure acquisition, development and maintenance
  • ISO 27001:2022 A.8.8 — Management of technical vulnerabilities Vulnerability and patch management Partial
Partial
PRO-005 — Change Management Procedure
Cyberbeveiligingsbesluit art. 11 Secure acquisition, development and maintenance
  • ISO 27001:2022 A.8.32 — Change management IT change management Equivalent
Equivalent
PRO-006 — Vulnerability and Patch Management Procedure
Cyberbeveiligingsbesluit art. 11 Secure acquisition, development and maintenance
  • ISO 27001:2022 A.8.8 — Management of technical vulnerabilities Vulnerability and patch management Partial
Partial
OPP-003 — Automate customer onboarding with scripted baselines
Cyberbeveiligingsbesluit art. 11 Secure acquisition, development and maintenance
  • ISO 27001:2022 A.8.25 — Secure development life cycle Secure development and SDLC Equivalent
  • ISO 27001:2022 A.8.28 — Secure coding Secure development and SDLC Equivalent
Equivalent
POL-011 — Secure Development and Change Policy
Cyberbeveiligingsbesluit art. 12 Cyber hygiene and training
  • ISO 27001:2022 A.8.19 — Installation of software on operational systems Secure configuration Related
  • ISO 27001:2022 A.8.9 — Configuration management Secure configuration Related
Related
POL-014 — Remote Working and Mobile Devices Policy
Cyberbeveiligingsbesluit art. 12 Cyber hygiene and training
  • ISO 27001:2022 A.6.7 — Remote working Endpoint and user device security Related
  • ISO 27001:2022 A.8.1 — User end point devices Endpoint and user device security Related
Related
POL-013 — Human Resources Security Policy
Cyberbeveiligingsbesluit art. 12 Cyber hygiene and training
  • ISO 27001:2022 7.3 — Awareness Awareness Equivalent
  • ISO 27001:2022 A.6.3 — Information security awareness, education and training Awareness Partial
Equivalent
POL-003 — Access Control Policy
Cyberbeveiligingsbesluit art. 12 Cyber hygiene and training
  • ISO 27001:2022 A.8.5 — Secure authentication Secure configuration Related
Related
RSK-001 — Ransomware on the managed hosting platform
Cyberbeveiligingsbesluit art. 12 Cyber hygiene and training
  • ISO 27001:2022 A.8.7 — Protection against malware Malware protection Related
Related
RSK-024 — Unpatched firmware on network equipment
Cyberbeveiligingsbesluit art. 12 Cyber hygiene and training
  • ISO 27001:2022 A.8.9 — Configuration management Secure configuration Related
Related
RSK-010 — One engineer holds the knowledge of a customer platform
Cyberbeveiligingsbesluit art. 12 Cyber hygiene and training
  • ISO 27001:2022 A.6.3 — Information security awareness, education and training Awareness Partial
Partial
RSK-022 — Insufficient monitoring coverage on customer networks
Cyberbeveiligingsbesluit art. 12 Cyber hygiene and training
  • ISO 27001:2022 A.8.7 — Protection against malware Malware protection Related
Related
RSK-012 — Late patching of customer endpoints
Cyberbeveiligingsbesluit art. 12 Cyber hygiene and training
  • ISO 27001:2022 A.8.1 — User end point devices Endpoint and user device security Related
  • ISO 27001:2022 A.8.19 — Installation of software on operational systems Secure configuration Related
  • ISO 27001:2022 A.8.7 — Protection against malware Malware protection Related
Related
RSK-006 — Misconfigured customer firewall exposes an internal service
Cyberbeveiligingsbesluit art. 12 Cyber hygiene and training
  • ISO 27001:2022 A.8.9 — Configuration management Secure configuration Related
Related
RSK-002 — Compromise of the remote management platform
Cyberbeveiligingsbesluit art. 12 Cyber hygiene and training
  • ISO 27001:2022 A.8.5 — Secure authentication Secure configuration Related
Related
RSK-018 — Theft or loss of a field engineer laptop
Cyberbeveiligingsbesluit art. 12 Cyber hygiene and training
  • ISO 27001:2022 A.8.1 — User end point devices Endpoint and user device security Related
  • ISO 27001:2022 A.8.7 — Protection against malware Malware protection Related
Related
RSK-004 — Privileged credential theft from an engineer laptop
Cyberbeveiligingsbesluit art. 12 Cyber hygiene and training
  • ISO 27001:2022 A.8.1 — User end point devices Endpoint and user device security Related
  • ISO 27001:2022 A.8.5 — Secure authentication Secure configuration Related
Related
RSK-005 — Phishing of service desk staff leading to access to a customer tenant
Cyberbeveiligingsbesluit art. 12 Cyber hygiene and training
  • ISO 27001:2022 A.6.3 — Information security awareness, education and training Awareness Partial
  • ISO 27001:2022 A.8.5 — Secure authentication Secure configuration Related
  • ISO 27001:2022 A.8.7 — Protection against malware Malware protection Related
Partial
OBJ-002 — Reach 95 percent completion of the annual security awareness training
Cyberbeveiligingsbesluit art. 12 Cyber hygiene and training
  • ISO 27001:2022 7.3 — Awareness Awareness Equivalent
  • NIS2 CIR 2024/2690 Annex 8 — Awareness and security training Awareness Equivalent
  • NIS2 CIR 2024/2690 Annex 8 — Awareness and security training Endpoint and user device security Related
  • NIS2 CIR 2024/2690 Annex 8 — Awareness and security training Malware protection Related
  • NIS2 CIR 2024/2690 Annex 8 — Awareness and security training Secure configuration Related
Equivalent
OBJ-005 — Bring the phishing click rate below 3 percent
Cyberbeveiligingsbesluit art. 12 Cyber hygiene and training
  • ISO 27001:2022 A.6.3 — Information security awareness, education and training Awareness Partial
  • NIS2 CIR 2024/2690 Annex 8 — Awareness and security training Awareness Equivalent
  • NIS2 CIR 2024/2690 Annex 8 — Awareness and security training Endpoint and user device security Related
  • NIS2 CIR 2024/2690 Annex 8 — Awareness and security training Malware protection Related
  • NIS2 CIR 2024/2690 Annex 8 — Awareness and security training Secure configuration Related
Equivalent
PRO-005 — Change Management Procedure
Cyberbeveiligingsbesluit art. 12 Cyber hygiene and training
  • ISO 27001:2022 A.8.9 — Configuration management Secure configuration Related
Related
PRO-006 — Vulnerability and Patch Management Procedure
Cyberbeveiligingsbesluit art. 12 Cyber hygiene and training
  • ISO 27001:2022 A.8.7 — Protection against malware Malware protection Related
Related
POL-003 — Access Control Policy
Cyberbeveiligingsbesluit art. 13 Cryptography policy
  • EU GDPR (2016) Art. 32 — Security of processing Cryptography Related
Related
RSK-014 — A personal data breach is not reported within 72 hours
Cyberbeveiligingsbesluit art. 13 Cryptography policy
  • EU GDPR (2016) Art. 32 — Security of processing Cryptography Related
Related
RSK-018 — Theft or loss of a field engineer laptop
Cyberbeveiligingsbesluit art. 13 Cryptography policy
  • NIS2 CIR 2024/2690 Annex 9 — Cryptography policy and key management Cryptography Equivalent
Equivalent
RSK-013 — Personal data in service desk tickets is handled carelessly
Cyberbeveiligingsbesluit art. 13 Cryptography policy
  • EU GDPR (2016) Art. 32 — Security of processing Cryptography Related
Related
POL-002 — Acceptable Use Policy
Cyberbeveiligingsbesluit art. 14 Personnel security
  • ISO 27001:2022 A.6.4 — Disciplinary process People security Partial
Partial
POL-013 — Human Resources Security Policy
Cyberbeveiligingsbesluit art. 14 Personnel security
  • ISO 27001:2022 A.6.1 — Screening People security Equivalent
  • ISO 27001:2022 A.6.2 — Terms and conditions of employment People security Equivalent
  • ISO 27001:2022 A.6.6 — Confidentiality or non-disclosure agreements People security Partial
Equivalent
RSK-011 — Departing employee keeps access to customer systems
Cyberbeveiligingsbesluit art. 14 Personnel security
  • ISO 27001:2022 A.6.6 — Confidentiality or non-disclosure agreements People security Partial
Partial
RSK-030 — Misuse of customer data by staff
Cyberbeveiligingsbesluit art. 14 Personnel security
  • ISO 27001:2022 A.6.2 — Terms and conditions of employment People security Equivalent
  • ISO 27001:2022 A.6.4 — Disciplinary process People security Partial
  • ISO 27001:2022 A.6.6 — Confidentiality or non-disclosure agreements People security Partial
Equivalent
BIS-005 — Growth from 30 to 45 staff strains onboarding and access control
Cyberbeveiligingsbesluit art. 14 Personnel security
  • ISO 27001:2022 A.6.1 — Screening People security Equivalent
Equivalent
PRO-002 — Joiner, Mover and Leaver Procedure
Cyberbeveiligingsbesluit art. 14 Personnel security
  • ISO 27001:2022 A.6.1 — Screening People security Equivalent
Equivalent
POL-010 — Cryptography Policy
Cyberbeveiligingsbesluit art. 15 Access policy
  • EU GDPR (2016) Art. 32 — Security of processing Access control Related
Related
POL-008 — Personal Data Protection Policy
Cyberbeveiligingsbesluit art. 15 Access policy
  • EU GDPR (2016) Art. 5(1)(f) — Integrity and confidentiality Access control Related
Related
RSK-007 — Unauthorised access to the privileged credential vault
Cyberbeveiligingsbesluit art. 15 Access policy
  • ISO 27001:2022 A.5.17 — Authentication information Identity and authentication Equivalent
  • ISO 27001:2022 A.8.2 — Privileged access rights Privileged and least-privilege access Partial
  • ISO 27001:2022 A.8.3 — Information access restriction Access control Partial
  • NIS2 CIR 2024/2690 Annex 11 — Access rights, privileged accounts and authentication Access control Equivalent
  • NIS2 CIR 2024/2690 Annex 11 — Access rights, privileged accounts and authentication Identity and authentication Equivalent
  • NIS2 CIR 2024/2690 Annex 11 — Access rights, privileged accounts and authentication Privileged and least-privilege access Partial
Equivalent
RSK-011 — Departing employee keeps access to customer systems
Cyberbeveiligingsbesluit art. 15 Access policy
  • ISO 27001:2022 A.5.16 — Identity management Identity and authentication Equivalent
Equivalent
RSK-014 — A personal data breach is not reported within 72 hours
Cyberbeveiligingsbesluit art. 15 Access policy
  • EU GDPR (2016) Art. 32 — Security of processing Access control Related
Related
RSK-002 — Compromise of the remote management platform
Cyberbeveiligingsbesluit art. 15 Access policy
  • ISO 27001:2022 A.5.17 — Authentication information Identity and authentication Equivalent
  • ISO 27001:2022 A.8.2 — Privileged access rights Privileged and least-privilege access Partial
  • ISO 27001:2022 A.8.3 — Information access restriction Access control Partial
Equivalent
RSK-030 — Misuse of customer data by staff
Cyberbeveiligingsbesluit art. 15 Access policy
  • ISO 27001:2022 A.8.3 — Information access restriction Access control Partial
Partial
RSK-013 — Personal data in service desk tickets is handled carelessly
Cyberbeveiligingsbesluit art. 15 Access policy
  • EU GDPR (2016) Art. 32 — Security of processing Access control Related
  • EU GDPR (2016) Art. 5(1)(f) — Integrity and confidentiality Access control Related
Related
RSK-004 — Privileged credential theft from an engineer laptop
Cyberbeveiligingsbesluit art. 15 Access policy
  • ISO 27001:2022 A.5.17 — Authentication information Identity and authentication Equivalent
  • ISO 27001:2022 A.8.2 — Privileged access rights Privileged and least-privilege access Partial
Equivalent
OPP-003 — Automate customer onboarding with scripted baselines
Cyberbeveiligingsbesluit art. 15 Access policy
  • ISO 27001:2022 A.8.4 — Access to source code Access control Partial
Partial
POL-002 — Acceptable Use Policy
Cyberbeveiligingsbesluit art. 16 Asset management
  • ISO 27001:2022 A.5.11 — Return of assets Asset inventory Partial
Partial
RSK-011 — Departing employee keeps access to customer systems
Cyberbeveiligingsbesluit art. 16 Asset management
  • ISO 27001:2022 A.5.11 — Return of assets Asset inventory Partial
Partial
134 total
Page 1 of 3

Are you sure?

This action cannot be reverted.

Leave this page?

Your changes on this form are not saved. If you leave, they are lost.