Audits & reviews this year
January
February
March
-
3 Supplier reviews · 3 done · 1 – 31 Mar expand collapse
- Done Key person unavailability plan · Continuity plan review · BCP-004
- Done Removable Media Policy · Policy review · POL-015
- Done Staff and contractors · Interested party review · IPY-004
April
May
-
4 Risk reviews · 4 done · 10 – 28 May expand collapse
-
2 Supplier reviews · 2 done · 20 – 30 May expand collapse
- Done Utrecht office loss plan · Continuity plan review · BCP-003
-
3 Policy reviews · 3 done · 30 May expand collapse
- Done Both colocation contracts end within two years · Business issue review · BIS-004
- Done Access Request and Review Procedure · Procedure review · PRO-001
June
- Done Suppliers · Interested party review · IPY-006
-
4 Policy reviews · 4 done · 9 – 29 Jun expand collapse
-
2 Supplier reviews · 2 done · 19 – 29 Jun expand collapse
- Done Change Management Procedure · Procedure review · PRO-005
- Done Offer customers a SOC 2 report · Objective review · OBJ-007
July
-
2 Risk reviews · 2 done · 3 – 30 Jul expand collapse
-
5 Procedure reviews · 5 done · 4 – 24 Jul expand collapse
- Done Joiner, Mover and Leaver Procedure · Procedure review · PRO-002
- Done Internal Audit and Management Review Procedure · Procedure review · PRO-010
- Done Data Subject Request Handling Procedure · Procedure review · PRO-009
- Done Incident Handling Procedure · Procedure review · PRO-003
- Done Supplier Onboarding and Review Procedure · Procedure review · PRO-008
-
2 Supplier reviews · 2 done · 9 – 24 Jul expand collapse
-
4 Policy reviews · 4 done · 14 – 24 Jul expand collapse
- Done Norland Certification · Interested party review · IPY-007
- Done The Cyberbeveiligingswet applies to managed service providers · Business issue review · BIS-002
- Done ISMS scope · Scope review
- Done Offer an immutable backup option · Opportunity review · OPP-004
- Done Ransomware recovery plan · Continuity plan review · BCP-002
August
-
9 Risk reviews · 9 done · 1 – 31 Aug expand collapse
- Done Personal data in service desk tickets is handled carelessly · Risk review · RSK-013
- Done Incident reporting duties under the Cbw are not met · Risk review · RSK-021
- Done Late patching of customer endpoints · Risk review · RSK-012
- Done Departing employee keeps access to customer systems · Risk review · RSK-011
- Done SLA penalties after repeated incidents at one customer · Risk review · RSK-015
- Done One engineer holds the knowledge of a customer platform · Risk review · RSK-010
- Done Power or cooling failure in a data centre · Risk review · RSK-009
- Done Stage 2 audit finds a major nonconformity · Risk review · RSK-016
- Done Failure of a colocation provider · Risk review · RSK-008
-
2 Policy reviews · 2 done · 3 – 28 Aug expand collapse
-
4 Supplier reviews · 4 done · 3 – 28 Aug expand collapse
-
2 Procedure reviews · 2 done · 3 – 18 Aug expand collapse
-
3 Objective reviews · 3 done · 8 – 23 Aug expand collapse
- Done Premiums for cyber insurance are rising · Business issue review · BIS-007
- Done Managed service industry association · Interested party review · IPY-008
- Done Offer managed security monitoring to existing customers · Opportunity review · OPP-001
September
-
7 Risk reviews · 7 done · 6 – 30 Sep expand collapse
- Done Unauthorised access to the privileged credential vault · Risk review · RSK-007
- Done Misconfigured customer firewall exposes an internal service · Risk review · RSK-006
- Done A sub-processor changes without notice to customers · Risk review · RSK-017
- Done Phishing of service desk staff leading to access to a customer tenant · Risk review · RSK-005
- Done Privileged credential theft from an engineer laptop · Risk review · RSK-004
- Done Unmanaged devices on the office network · Risk review · RSK-019
- Done Loss of customer backup data in a data centre failure · Risk review · RSK-003
-
2 Objective reviews · 2 done · 7 – 22 Sep expand collapse
- Done Personal Data Protection Policy · Policy review · POL-008
-
2 Opportunity reviews · 2 done · 12 – 27 Sep expand collapse
-
2 Supplier reviews · 2 done · 12 – 17 Sep expand collapse
- Done Personal Data Breach Notification Procedure · Procedure review · PRO-004
- Done Supplier reviews completed on schedule (%) · KPI measurement · KPI-006
October
-
6 KPI measurements · 5 done · 5 – 30 Oct expand collapse
- Done Open vulnerabilities older than 30 days · KPI measurement · KPI-005
- Done Backup restore tests passed (%) · KPI measurement · KPI-004
- Done Phishing simulation click rate (%) · KPI measurement · KPI-003
- Done Security awareness training completion (%) · KPI measurement · KPI-002
- Done Mean time to patch critical vulnerabilities (days) · KPI measurement · KPI-001
- Measurement Supplier reviews completed on schedule (%) · KPI measurement · KPI-006
-
2 Risk reviews · 2 done · 6 – 12 Oct expand collapse
- Done Bundle Cbw readiness checks into the service desk offer · Opportunity review · OPP-005
- Done Data centre loss plan · Continuity plan review · BCP-001
- Done Obtain ISO 27001:2022 certification · Objective review · OBJ-001
- Review Hans Overbeek · Asset review · PER-020 · Hans Overbeek (overdue)
- Review Loonwerk Payroll Services · Supplier review · SUP-017 (overdue)
- Training Phishing recognition and reporting · Training assignment · TRN-002 · 5 people (overdue)
November
-
5 KPI measurements · 4 – 23 Nov expand collapse
- Measurement Open vulnerabilities older than 30 days · KPI measurement · KPI-005
- Measurement Backup restore tests passed (%) · KPI measurement · KPI-004
- Measurement Phishing simulation click rate (%) · KPI measurement · KPI-003
- Measurement Security awareness training completion (%) · KPI measurement · KPI-002
- Measurement Mean time to patch critical vulnerabilities (days) · KPI measurement · KPI-001
-
2 Objective reviews · 6 – 21 Nov expand collapse
-
3 Training assignments · 8 – 16 Nov expand collapse
- Meeting Monthly ISMS meeting · Next occurrence · SCH-013
-
2 Supplier reviews · 16 – 26 Nov expand collapse
- Review Customers · Interested party review · IPY-001
December
-
5 Asset reviews · 1 – 11 Dec expand collapse
- Review Roos van Beek · Asset review · PER-027 · Roos van Beek
- Review Charlotte Veldhuis · Asset review · PER-034 · Charlotte Veldhuis
- Review Lotte van Dijk · Asset review · PER-006 · Lotte van Dijk
- Review Joris Kamphuis · Asset review · PER-032 · Joris Kamphuis
- Review Gerrit Smeenk · Asset review · PER-014 · Gerrit Smeenk
- Training Secure administration of customer systems · Training assignment · TRN-005 · 1 people
-
2 Risk reviews · 6 – 30 Dec expand collapse
-
2 Objective reviews · 6 – 21 Dec expand collapse
- Review Dell Technologies · Supplier review · SUP-004
- Test Continuity test: Ransomware recovery plan · Next occurrence · SCH-018
- Review Colocation provider failure plan · Continuity plan review · BCP-005
- Review Only two engineers can operate the storage layer of the hosting platform · Business issue review · BIS-003