Notifications
-
Thijs Bosman on INC-008 — Customer ticket export sent to the wrong recipient Unread Mentioned
Containment is done, @Sam de Vries . The recipient confirmed in writing that the message and the attachment are deleted. I removed the mailbox rule that suggest…
-
Nadia El Idrissi on INC-008 — Customer ticket export sent to the wrong recipient Unread Mentioned
Ilse Wiegman's draft notification is ready for your review, @Sam de Vries . I checked the timeline in it against the Incident, and the two match.
-
Hans Overbeek on VUL-001 — Remote code execution in the remote management agent Unread Mentioned
The vendor patch is on our own workstations first, @Sam de Vries . If that stays quiet I roll it out to the customer fleet in the next change window, which keep…
-
Lotte van Dijk on FND-011 — The Statement of Applicability is thin on the reasons for including three controls Unread Mentioned
I wrote down why the service desk tools are in scope, so the reasons for two of the three controls are done. The third one is yours, @Sam de Vries , because it…
-
Vera Dijkstra on POL-003 — Access Control Policy Unread Mentioned
@Sam de Vries , which register do we point the auditor to for this?
-
Lotte van Dijk on FND-002 — Leavers' accounts are disabled later than the 24-hour target Unread Mentioned
The effectiveness check showed the same gap as the audit did: some leavers kept an active account for more than a day. I think the checklist reaches us too late…
-
Nadia El Idrissi on POL-001 — Information Security Policy Mentioned
The Management Board would like the objectives section shorter before it signs the next version. @Sam de Vries , can you bring it down to what fits on one page?
-
Vera Dijkstra on FND-003 — Supplier reviews are not completed on schedule Mentioned
The late supplier reviews are done now, and the next round is planned together with the contract renewals. The effectiveness check can start after that round, @…
-
Vera Dijkstra on RSK-008 — Failure of a colocation provider Mentioned
Both colocation contracts come up for renewal in the coming year. @Sam de Vries , should we add the exit terms to this Risk before the next supplier review?
-
Hans Overbeek on MRV-0001 — ISMS management review Mentioned
The action list from the review is complete, @Sam de Vries . I took the three infrastructure actions. The hosting capacity action still needs an owner and a dat…
-
Nadia El Idrissi on INC-005 — Stale admin account used on a customer backup repository Mentioned
The report is filed, and I would like the access review to cover every administrator account on the customer backup repositories before we close this one, @Sam…