Security policy and responsibilities

Catalog reference

Have an adopted security policy for your network and information systems, put it in writing and apply it demonstrably (art. 6(1)). Set the roles, responsibilities and authorities for the security of those systems, and keep conflicting roles, responsibilities and authorities apart as far as possible (art. 6(2)). Require your staff and everyone else who works in the entity to apply the security in line with the policy (art. 6(3)). Run a management system for the security of your network and information systems, so you can show that you meet Cyberbeveiligingswet art. 21 (art. 6(4)). Government bodies run that management system on ISO 27001:2023, including its scope, and keep an overview of their crucial network and information systems as part of it: the Cyberbeveiligingsregeling sector overheid (BWBR0052963, arts. 3 and 4) sets this, and the Cyberbeveiligingsregeling IenW (BWBR0052878, arts. 6 and 7) sets it for waterschappen. Other essential and important entities in the sectors that IenW regulation covers also record, as part of the management system, which risk-management measures (processes and controls) are monitored, measured, analysed and evaluated, by which methods, when, and by whom (Cyberbeveiligingsregeling IenW art. 10). Exclude this only if the Account is exclusively one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. An entity that is only partly one of those types keeps both sets.

Narrative — how we satisfy this requirement