Compliance

This is the Compliance demo. Every visitor shares this company, and it resets every night.

What you change here, everyone sees until the next reset. Email, payments, and the AI models are switched off.

Start your own trial
  • EU GDPR (2016)
  • ISO 27001:2022
  • NIS2
  • NIS2 Netherlands (Cbw, 2026)

Nothing found that matches the search criteria.
Start your own trial
SV
Sam de Vries
sam.devries@tidewell-it.example
Legal

Proposed coverage

Covering artifact
Target requirement
Composition paths
Relation strength
POL-001 — Information Security Policy
CIR 2024/2690 Annex 1 Security policy and responsibilities
  • ISO 27001:2022 5.2 — Policy Management system policy Equivalent
  • ISO 27001:2022 5.3 — Organisational roles, responsibilities and authorities Roles, responsibilities and authorities Equivalent
  • ISO 27001:2022 A.5.1 — Policies for information security Management system policy Partial
  • ISO 27001:2022 A.5.2 — Information security roles and responsibilities Roles, responsibilities and authorities Partial
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 6 — Security policy and responsibilities Management system policy Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 6 — Security policy and responsibilities Roles, responsibilities and authorities Equivalent
Equivalent
RSK-010 — One engineer holds the knowledge of a customer platform
CIR 2024/2690 Annex 1 Security policy and responsibilities
  • ISO 27001:2022 A.5.2 — Information security roles and responsibilities Roles, responsibilities and authorities Partial
Partial
RSK-016 — Stage 2 audit finds a major nonconformity
CIR 2024/2690 Annex 1 Security policy and responsibilities
  • ISO 27001:2022 A.5.2 — Information security roles and responsibilities Roles, responsibilities and authorities Partial
Partial
BIS-005 — Growth from 30 to 45 staff strains onboarding and access control
CIR 2024/2690 Annex 1 Security policy and responsibilities
  • ISO 27001:2022 5.3 — Organisational roles, responsibilities and authorities Roles, responsibilities and authorities Equivalent
Equivalent
POL-002 — Acceptable Use Policy
CIR 2024/2690 Annex 10 Personnel security
  • ISO 27001:2022 A.6.4 — Disciplinary process People security Partial
Partial
POL-013 — Human Resources Security Policy
CIR 2024/2690 Annex 10 Personnel security
  • ISO 27001:2022 A.6.1 — Screening People security Equivalent
  • ISO 27001:2022 A.6.2 — Terms and conditions of employment People security Equivalent
  • ISO 27001:2022 A.6.6 — Confidentiality or non-disclosure agreements People security Partial
Equivalent
RSK-011 — Departing employee keeps access to customer systems
CIR 2024/2690 Annex 10 Personnel security
  • ISO 27001:2022 A.6.6 — Confidentiality or non-disclosure agreements People security Partial
Partial
RSK-030 — Misuse of customer data by staff
CIR 2024/2690 Annex 10 Personnel security
  • ISO 27001:2022 A.6.2 — Terms and conditions of employment People security Equivalent
  • ISO 27001:2022 A.6.4 — Disciplinary process People security Partial
  • ISO 27001:2022 A.6.6 — Confidentiality or non-disclosure agreements People security Partial
Equivalent
BIS-005 — Growth from 30 to 45 staff strains onboarding and access control
CIR 2024/2690 Annex 10 Personnel security
  • ISO 27001:2022 A.6.1 — Screening People security Equivalent
Equivalent
PRO-002 — Joiner, Mover and Leaver Procedure
CIR 2024/2690 Annex 10 Personnel security
  • ISO 27001:2022 A.6.1 — Screening People security Equivalent
Equivalent
POL-010 — Cryptography Policy
CIR 2024/2690 Annex 11 Access rights, privileged accounts and authentication
  • EU GDPR (2016) Art. 32 — Security of processing Access control Related
Related
POL-003 — Access Control Policy
CIR 2024/2690 Annex 11 Access rights, privileged accounts and authentication
  • EU GDPR (2016) Art. 32 — Security of processing Access control Related
  • EU GDPR (2016) Art. 5(1)(f) — Integrity and confidentiality Access control Related
  • ISO 27001:2022 A.5.15 — Access control Access control Equivalent
  • ISO 27001:2022 A.5.15 — Access control Privileged and least-privilege access Related
  • ISO 27001:2022 A.5.16 — Identity management Identity and authentication Equivalent
  • ISO 27001:2022 A.5.17 — Authentication information Identity and authentication Equivalent
  • ISO 27001:2022 A.8.2 — Privileged access rights Privileged and least-privilege access Partial
  • ISO 27001:2022 A.8.3 — Information access restriction Access control Partial
  • ISO 27001:2022 A.8.4 — Access to source code Access control Partial
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 15 — Access policy Access control Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 15 — Access policy Identity and authentication Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 15 — Access policy Privileged and least-privilege access Partial
Equivalent
POL-008 — Personal Data Protection Policy
CIR 2024/2690 Annex 11 Access rights, privileged accounts and authentication
  • EU GDPR (2016) Art. 5(1)(f) — Integrity and confidentiality Access control Related
Related
RSK-026 — Excessive administrator rights on internal systems
CIR 2024/2690 Annex 11 Access rights, privileged accounts and authentication
  • ISO 27001:2022 A.8.2 — Privileged access rights Privileged and least-privilege access Partial
  • ISO 27001:2022 A.8.3 — Information access restriction Access control Partial
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 15 — Access policy Access control Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 15 — Access policy Identity and authentication Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 15 — Access policy Privileged and least-privilege access Partial
Equivalent
RSK-011 — Departing employee keeps access to customer systems
CIR 2024/2690 Annex 11 Access rights, privileged accounts and authentication
  • ISO 27001:2022 A.5.16 — Identity management Identity and authentication Equivalent
Equivalent
RSK-014 — A personal data breach is not reported within 72 hours
CIR 2024/2690 Annex 11 Access rights, privileged accounts and authentication
  • EU GDPR (2016) Art. 32 — Security of processing Access control Related
Related
RSK-002 — Compromise of the remote management platform
CIR 2024/2690 Annex 11 Access rights, privileged accounts and authentication
  • ISO 27001:2022 A.5.17 — Authentication information Identity and authentication Equivalent
  • ISO 27001:2022 A.8.2 — Privileged access rights Privileged and least-privilege access Partial
  • ISO 27001:2022 A.8.3 — Information access restriction Access control Partial
Equivalent
RSK-030 — Misuse of customer data by staff
CIR 2024/2690 Annex 11 Access rights, privileged accounts and authentication
  • ISO 27001:2022 A.8.3 — Information access restriction Access control Partial
Partial
RSK-013 — Personal data in service desk tickets is handled carelessly
CIR 2024/2690 Annex 11 Access rights, privileged accounts and authentication
  • EU GDPR (2016) Art. 32 — Security of processing Access control Related
  • EU GDPR (2016) Art. 5(1)(f) — Integrity and confidentiality Access control Related
Related
RSK-004 — Privileged credential theft from an engineer laptop
CIR 2024/2690 Annex 11 Access rights, privileged accounts and authentication
  • ISO 27001:2022 A.5.17 — Authentication information Identity and authentication Equivalent
  • ISO 27001:2022 A.8.2 — Privileged access rights Privileged and least-privilege access Partial
Equivalent
PRO-001 — Access Request and Review Procedure
CIR 2024/2690 Annex 11 Access rights, privileged accounts and authentication
  • ISO 27001:2022 A.5.15 — Access control Access control Equivalent
  • ISO 27001:2022 A.5.15 — Access control Privileged and least-privilege access Related
  • ISO 27001:2022 A.5.16 — Identity management Identity and authentication Equivalent
  • ISO 27001:2022 A.8.2 — Privileged access rights Privileged and least-privilege access Partial
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 15 — Access policy Access control Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 15 — Access policy Identity and authentication Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 15 — Access policy Privileged and least-privilege access Partial
Equivalent
OPP-003 — Automate customer onboarding with scripted baselines
CIR 2024/2690 Annex 11 Access rights, privileged accounts and authentication
  • ISO 27001:2022 A.8.4 — Access to source code Access control Partial
Partial
POL-002 — Acceptable Use Policy
CIR 2024/2690 Annex 12 Asset classification, handling and inventory
  • ISO 27001:2022 A.5.11 — Return of assets Asset inventory Partial
Partial
RSK-011 — Departing employee keeps access to customer systems
CIR 2024/2690 Annex 12 Asset classification, handling and inventory
  • ISO 27001:2022 A.5.11 — Return of assets Asset inventory Partial
Partial
PRO-002 — Joiner, Mover and Leaver Procedure
CIR 2024/2690 Annex 12 Asset classification, handling and inventory
  • ISO 27001:2022 A.5.11 — Return of assets Asset inventory Partial
Partial
IPY-003 — Rijksinspectie Digitale Infrastructuur
CIR 2024/2690 Annex 12 Asset classification, handling and inventory
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 16 — Asset management Asset inventory Equivalent
Equivalent
POL-014 — Remote Working and Mobile Devices Policy
CIR 2024/2690 Annex 13 Utilities, environmental threats and physical access
  • ISO 27001:2022 A.7.7 — Clear desk and clear screen Physical security Equivalent
Equivalent
POL-012 — Physical and Environmental Security Policy
CIR 2024/2690 Annex 13 Utilities, environmental threats and physical access
  • ISO 27001:2022 A.7.1 — Physical security perimeters Physical security Equivalent
  • ISO 27001:2022 A.7.11 — Supporting utilities Physical security Partial
  • ISO 27001:2022 A.7.12 — Cabling security Physical security Partial
  • ISO 27001:2022 A.7.2 — Physical entry Physical security Equivalent
  • ISO 27001:2022 A.7.3 — Securing offices, rooms and facilities Physical security Equivalent
  • ISO 27001:2022 A.7.5 — Protecting against physical and environmental threats Physical security Equivalent
  • ISO 27001:2022 A.7.6 — Working in secure areas Physical security Equivalent
  • ISO 27001:2022 A.7.8 — Equipment siting and protection Physical security Equivalent
Equivalent
ISMS scope
CIR 2024/2690 Annex 13 Utilities, environmental threats and physical access
  • ISO 27001:2022 A.7.3 — Securing offices, rooms and facilities Physical security Equivalent
Equivalent
RSK-008 — Failure of a colocation provider
CIR 2024/2690 Annex 13 Utilities, environmental threats and physical access
  • ISO 27001:2022 A.7.5 — Protecting against physical and environmental threats Physical security Equivalent
Equivalent
RSK-009 — Power or cooling failure in a data centre
CIR 2024/2690 Annex 13 Utilities, environmental threats and physical access
  • ISO 27001:2022 A.7.11 — Supporting utilities Physical security Partial
  • ISO 27001:2022 A.7.5 — Protecting against physical and environmental threats Physical security Equivalent
Equivalent
RSK-003 — Loss of customer backup data in a data centre failure
CIR 2024/2690 Annex 13 Utilities, environmental threats and physical access
  • ISO 27001:2022 A.7.5 — Protecting against physical and environmental threats Physical security Equivalent
Equivalent
RSK-020 — Physical intrusion at a data centre
CIR 2024/2690 Annex 13 Utilities, environmental threats and physical access
  • ISO 27001:2022 A.7.1 — Physical security perimeters Physical security Equivalent
  • ISO 27001:2022 A.7.2 — Physical entry Physical security Equivalent
  • ISO 27001:2022 A.7.6 — Working in secure areas Physical security Equivalent
  • ISO 27001:2022 A.7.8 — Equipment siting and protection Physical security Equivalent
Equivalent
PRO-012 — Physical Access and Visitor Management Procedure
CIR 2024/2690 Annex 13 Utilities, environmental threats and physical access
  • ISO 27001:2022 A.7.2 — Physical entry Physical security Equivalent
  • ISO 27001:2022 A.7.3 — Securing offices, rooms and facilities Physical security Equivalent
  • ISO 27001:2022 A.7.6 — Working in secure areas Physical security Equivalent
Equivalent
IPY-004 — Staff and contractors
CIR 2024/2690 Annex 13 Utilities, environmental threats and physical access
  • ISO 27001:2022 A.7.7 — Clear desk and clear screen Physical security Equivalent
Equivalent
POL-004 — Risk Management Policy
CIR 2024/2690 Annex 2 Risk management, compliance monitoring and independent review
  • ISO 27001:2022 6.1.2 — Information security risk assessment Risk assessment Equivalent
  • ISO 27001:2022 6.1.3 — Information security risk treatment Risk treatment Equivalent
  • ISO 27001:2022 8.2 — Information security risk assessment (operational) Risk assessment Equivalent
  • ISO 27001:2022 8.3 — Information security risk treatment (operational) Risk treatment Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 7 — Risk management policy Risk assessment Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 7 — Risk management policy Risk treatment Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 21 — Duty of care Risk treatment Related
Equivalent
POL-001 — Information Security Policy
CIR 2024/2690 Annex 2 Risk management, compliance monitoring and independent review
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 21 — Duty of care Risk treatment Related
Related
RSK-001 — Ransomware on the managed hosting platform
CIR 2024/2690 Annex 2 Risk management, compliance monitoring and independent review
  • ISO 27001:2022 8.3 — Information security risk treatment (operational) Risk treatment Equivalent
Equivalent
RSK-021 — Incident reporting duties under the Cbw are not met
CIR 2024/2690 Annex 2 Risk management, compliance monitoring and independent review
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 21 — Duty of care Risk treatment Related
Related
OBJ-004 — Bring the Cbw measures to full coverage
CIR 2024/2690 Annex 2 Risk management, compliance monitoring and independent review
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 21 — Duty of care Risk treatment Related
Related
BIS-007 — Premiums for cyber insurance are rising
CIR 2024/2690 Annex 2 Risk management, compliance monitoring and independent review
  • ISO 27001:2022 6.1.2 — Information security risk assessment Risk assessment Equivalent
  • ISO 27001:2022 8.2 — Information security risk assessment (operational) Risk assessment Equivalent
Equivalent
IPY-007 — Norland Certification
CIR 2024/2690 Annex 2 Risk management, compliance monitoring and independent review
  • ISO 27001:2022 6.1.3 — Information security risk treatment Risk treatment Equivalent
Equivalent
IPY-003 — Rijksinspectie Digitale Infrastructuur
CIR 2024/2690 Annex 2 Risk management, compliance monitoring and independent review
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 7 — Risk management policy Risk assessment Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 7 — Risk management policy Risk treatment Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 21 — Duty of care Risk treatment Related
Equivalent
POL-002 — Acceptable Use Policy
CIR 2024/2690 Annex 3 Incident handling, monitoring and logging
  • ISO 27001:2022 A.6.8 — Information security event reporting Incident detection and response Related
Related
POL-005 — Incident Response Policy
CIR 2024/2690 Annex 3 Incident handling, monitoring and logging
  • ISO 27001:2022 A.5.24 — Information security incident management planning and preparation Incident management planning Equivalent
  • ISO 27001:2022 A.5.25 — Assessment and decision on information security events Incident detection and response Equivalent
  • ISO 27001:2022 A.5.26 — Response to information security incidents Incident detection and response Equivalent
  • ISO 27001:2022 A.5.27 — Learning from information security incidents Incident detection and response Partial
  • ISO 27001:2022 A.8.15 — Logging Logging and security monitoring Equivalent
  • ISO 27001:2022 A.8.16 — Monitoring activities Logging and security monitoring Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 8 — Incident handling and logging Incident management planning Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 8 — Incident handling and logging Incident detection and response Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 8 — Incident handling and logging Logging and security monitoring Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 25 — Duty to report significant incidents Incident detection and response Partial
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 30 — Informing the recipients of your services Incident detection and response Partial
Equivalent
RSK-021 — Incident reporting duties under the Cbw are not met
CIR 2024/2690 Annex 3 Incident handling, monitoring and logging
  • ISO 27001:2022 A.5.24 — Information security incident management planning and preparation Incident management planning Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 8 — Incident handling and logging Incident management planning Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 8 — Incident handling and logging Incident detection and response Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingsbesluit art. 8 — Incident handling and logging Logging and security monitoring Equivalent
  • NIS2 Netherlands (Cbw, 2026) Cyberbeveiligingswet art. 25 — Duty to report significant incidents Incident detection and response Partial
Equivalent
RSK-014 — A personal data breach is not reported within 72 hours
CIR 2024/2690 Annex 3 Incident handling, monitoring and logging
  • ISO 27001:2022 A.5.24 — Information security incident management planning and preparation Incident management planning Equivalent
  • ISO 27001:2022 A.6.8 — Information security event reporting Incident detection and response Related
Equivalent
RSK-015 — SLA penalties after repeated incidents at one customer
CIR 2024/2690 Annex 3 Incident handling, monitoring and logging
  • ISO 27001:2022 A.5.24 — Information security incident management planning and preparation Incident management planning Equivalent
  • ISO 27001:2022 A.8.16 — Monitoring activities Logging and security monitoring Equivalent
Equivalent
RSK-022 — Insufficient monitoring coverage on customer networks
CIR 2024/2690 Annex 3 Incident handling, monitoring and logging
  • ISO 27001:2022 A.5.24 — Information security incident management planning and preparation Incident management planning Equivalent
  • ISO 27001:2022 A.8.15 — Logging Logging and security monitoring Equivalent
  • ISO 27001:2022 A.8.16 — Monitoring activities Logging and security monitoring Equivalent
  • ISO 27001:2022 A.8.17 — Clock synchronization Logging and security monitoring Partial
Equivalent
RSK-018 — Theft or loss of a field engineer laptop
CIR 2024/2690 Annex 3 Incident handling, monitoring and logging
  • ISO 27001:2022 A.6.8 — Information security event reporting Incident detection and response Related
Related
99 total
Page 1 of 2

Are you sure?

This action cannot be reverted.

Leave this page?

Your changes on this form are not saved. If you leave, they are lost.