Alerts, advisories and threat intelligence

Catalog reference

When you are specifically alerted to vulnerabilities or cyber threats that are relevant to the security of your network and information systems, assess whether the measures taken under Cyberbeveiligingswet art. 21 need changes or additions, and record the result of that assessment in writing (art. 17(1)). Do the same for targeted security advisories and threat information that are relevant to your systems and that you receive from relevant organisations, including CSIRTs, competent authorities, other government bodies, direct suppliers and direct service providers (art. 17(2)). Exclude this only if the Account is exclusively one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. An entity that is only partly one of those types keeps both sets.