Audits & reviews this year
Internal audit
Internal audit — ISO 27001:2022
SCH-001
Gap analysis
Gap analysis: NIS2 Netherlands (Cbw, 2026)
SCH-019
Management review
Management review — ISO 27001:2022
SCH-003
Internal audit
Internal audit — EU GDPR (2016)
SCH-004
External audit
External audit — EU GDPR (2016)
SCH-005
Management review
Management review — EU GDPR (2016)
SCH-006
Internal audit
Internal audit — NIS2
SCH-007
External audit
External audit — NIS2
SCH-008
Management review
Management review — NIS2
SCH-009
Internal audit
Internal audit — NIS2 Netherlands (Cbw, 2026)
SCH-010
External audit
External audit — NIS2 Netherlands (Cbw, 2026)
SCH-011
Management review
Management review — NIS2 Netherlands (Cbw, 2026)
SCH-012
January
- Review Dutch Data Protection Authority · Interested party review · IPY-002
- Review Obtain ISO 27001:2022 certification · Objective review · OBJ-001
-
2 Supplier reviews · 20 – 30 Jan expand collapse
- Test Quarterly external vulnerability scan · Next occurrence · SCH-015
-
3 Risk reviews · 26 – 31 Jan expand collapse
February
-
6 Risk reviews · 3 – 27 Feb expand collapse
- Review Late patching of customer endpoints · Risk review · RSK-012
- Review Departing employee keeps access to customer systems · Risk review · RSK-011
- Review SLA penalties after repeated incidents at one customer · Risk review · RSK-015
- Review One engineer holds the knowledge of a customer platform · Risk review · RSK-010
- Review Stage 2 audit finds a major nonconformity · Risk review · RSK-016
- Review Failure of a colocation provider · Risk review · RSK-008
- Review Bram Oosterhuis · Asset review · PER-040 · Bram Oosterhuis
- Review Rijksinspectie Digitale Infrastructuur · Interested party review · IPY-003
-
2 Supplier reviews · 14 – 24 Feb expand collapse
March
-
2 Asset reviews · 1 – 21 Mar expand collapse
-
3 Supplier reviews · 1 – 31 Mar expand collapse
-
7 Risk reviews · 5 – 29 Mar expand collapse
- Review Unauthorised access to the privileged credential vault · Risk review · RSK-007
- Review Misconfigured customer firewall exposes an internal service · Risk review · RSK-006
- Review A sub-processor changes without notice to customers · Risk review · RSK-017
- Review Phishing of service desk staff leading to access to a customer tenant · Risk review · RSK-005
- Review Privileged credential theft from an engineer laptop · Risk review · RSK-004
- Review Unmanaged devices on the office network · Risk review · RSK-019
- Review Loss of customer backup data in a data centre failure · Risk review · RSK-003
- Review Key person unavailability plan · Continuity plan review · BCP-004
- Review Staff and contractors · Interested party review · IPY-004
- Test Annual penetration test · Next occurrence · SCH-014
April
-
2 Risk reviews · 4 – 10 Apr expand collapse
- Test Backup restore test · Next occurrence · SCH-016
- Review Shareholders and the Advisory Board · Interested party review · IPY-005
- Review Mustafa Karaca · Asset review · PER-030 · Mustafa Karaca
- Review Fortinet · Supplier review · SUP-006
- Review Security Awareness and Training Procedure · Procedure review · PRO-011
May
-
3 Asset reviews · 20 – 30 May expand collapse
- Review Utrecht office loss plan · Continuity plan review · BCP-003
- Review Atlassian · Supplier review · SUP-008
- Review Both colocation contracts end within two years · Business issue review · BIS-004
- Review Access Request and Review Procedure · Procedure review · PRO-001
June
- Review Suppliers · Interested party review · IPY-006
-
4 Policy reviews · 9 – 29 Jun expand collapse
-
2 Supplier reviews · 19 – 29 Jun expand collapse
- Review Change Management Procedure · Procedure review · PRO-005
July
-
5 Procedure reviews · 4 – 24 Jul expand collapse
- Review Joiner, Mover and Leaver Procedure · Procedure review · PRO-002
- Review Internal Audit and Management Review Procedure · Procedure review · PRO-010
- Review Data Subject Request Handling Procedure · Procedure review · PRO-009
- Review Incident Handling Procedure · Procedure review · PRO-003
- Review Supplier Onboarding and Review Procedure · Procedure review · PRO-008
- Review Dimitri Volkov · Asset review · PER-028 · Dimitri Volkov
- Review Blackharbor Security · Supplier review · SUP-014
-
4 Policy reviews · 14 – 24 Jul expand collapse
- Review Norland Certification · Interested party review · IPY-007
- Test Continuity test: Data centre loss plan · Next occurrence · SCH-017
- Review The Cyberbeveiligingswet applies to managed service providers · Business issue review · BIS-002
- Review ISMS scope · Scope review
- Review Offer an immutable backup option · Opportunity review · OPP-004
- Review Ransomware recovery plan · Continuity plan review · BCP-002
August
-
2 Policy reviews · 3 – 28 Aug expand collapse
-
2 Procedure reviews · 3 – 18 Aug expand collapse
-
2 Business issue reviews · 18 – 23 Aug expand collapse
- Review Managed service industry association · Interested party review · IPY-008
- Review Offer managed security monitoring to existing customers · Opportunity review · OPP-001
- Review Sam de Vries · Asset review · PER-001 · Sam de Vries
September
- Review Personal Data Protection Policy · Policy review · POL-008
-
2 Opportunity reviews · 12 – 27 Sep expand collapse
-
3 Supplier reviews · 12 – 22 Sep expand collapse
- Review Personal Data Breach Notification Procedure · Procedure review · PRO-004
October
- Review Bundle Cbw readiness checks into the service desk offer · Opportunity review · OPP-005
- Review Data centre loss plan · Continuity plan review · BCP-001
- Review Physical Access and Visitor Management Procedure · Procedure review · PRO-012
-
124 Requirement reviews · 62 done · 27 Oct expand collapse
- Done Understanding the organisation and its context · Requirement review · 4.1
- Review Understanding the organisation and its context · Requirement review · 4.1
- Done Understanding the needs and expectations of interested parties · Requirement review · 4.2
- Review Understanding the needs and expectations of interested parties · Requirement review · 4.2
- Done Determining the scope of the information security management system · Requirement review · 4.3
- Review Determining the scope of the information security management system · Requirement review · 4.3
- Done Information security management system · Requirement review · 4.4
- Review Information security management system · Requirement review · 4.4
- Done Leadership and commitment · Requirement review · 5.1
- Review Leadership and commitment · Requirement review · 5.1
- Done Policy · Requirement review · 5.2
- Review Policy · Requirement review · 5.2
- Done Organisational roles, responsibilities and authorities · Requirement review · 5.3
- Review Organisational roles, responsibilities and authorities · Requirement review · 5.3
- Done Actions to address risks and opportunities - general · Requirement review · 6.1.1
- Review Actions to address risks and opportunities - general · Requirement review · 6.1.1
- Done Information security risk assessment · Requirement review · 6.1.2
- Review Information security risk assessment · Requirement review · 6.1.2
- Done Information security risk treatment · Requirement review · 6.1.3
- Review Information security risk treatment · Requirement review · 6.1.3
- Done Information security objectives and planning to achieve them · Requirement review · 6.2
- Review Information security objectives and planning to achieve them · Requirement review · 6.2
- Done Planning of changes · Requirement review · 6.3
- Review Planning of changes · Requirement review · 6.3
- Done Resources · Requirement review · 7.1
- Review Resources · Requirement review · 7.1
- Done Competence · Requirement review · 7.2
- Review Competence · Requirement review · 7.2
- Done Awareness · Requirement review · 7.3
- Review Awareness · Requirement review · 7.3
- Done Communication · Requirement review · 7.4
- Review Communication · Requirement review · 7.4
- Done Documented information - general · Requirement review · 7.5.1
- Review Documented information - general · Requirement review · 7.5.1
- Done Creating and updating documented information · Requirement review · 7.5.2
- Review Creating and updating documented information · Requirement review · 7.5.2
- Done Control of documented information · Requirement review · 7.5.3
- Review Control of documented information · Requirement review · 7.5.3
- Done Operational planning and control · Requirement review · 8.1
- Review Operational planning and control · Requirement review · 8.1
- Done Information security risk assessment (operational) · Requirement review · 8.2
- Review Information security risk assessment (operational) · Requirement review · 8.2
- Done Information security risk treatment (operational) · Requirement review · 8.3
- Review Information security risk treatment (operational) · Requirement review · 8.3
- Done Monitoring, measurement, analysis and evaluation · Requirement review · 9.1
- Review Monitoring, measurement, analysis and evaluation · Requirement review · 9.1
- Done Internal audit - general · Requirement review · 9.2.1
- Review Internal audit - general · Requirement review · 9.2.1
- Done Internal audit programme · Requirement review · 9.2.2
- Review Internal audit programme · Requirement review · 9.2.2
- Done Management review - general · Requirement review · 9.3.1
- Review Management review - general · Requirement review · 9.3.1
- Done Management review inputs · Requirement review · 9.3.2
- Review Management review inputs · Requirement review · 9.3.2
- Done Management review results · Requirement review · 9.3.3
- Review Management review results · Requirement review · 9.3.3
- Done Continual improvement · Requirement review · 10.1
- Review Continual improvement · Requirement review · 10.1
- Done Nonconformity and corrective action · Requirement review · 10.2
- Review Nonconformity and corrective action · Requirement review · 10.2
- Done Lawfulness, fairness and transparency · Requirement review · Art. 5(1)(a)
- Review Lawfulness, fairness and transparency · Requirement review · Art. 5(1)(a)
- Done Purpose limitation · Requirement review · Art. 5(1)(b)
- Review Purpose limitation · Requirement review · Art. 5(1)(b)
- Done Data minimisation · Requirement review · Art. 5(1)(c)
- Review Data minimisation · Requirement review · Art. 5(1)(c)
- Done Accuracy · Requirement review · Art. 5(1)(d)
- Review Accuracy · Requirement review · Art. 5(1)(d)
- Done Storage limitation · Requirement review · Art. 5(1)(e)
- Review Storage limitation · Requirement review · Art. 5(1)(e)
- Done Integrity and confidentiality · Requirement review · Art. 5(1)(f)
- Review Integrity and confidentiality · Requirement review · Art. 5(1)(f)
- Done Lawfulness of processing · Requirement review · Art. 6
- Review Lawfulness of processing · Requirement review · Art. 6
- Done Information to be provided to data subjects · Requirement review · Art. 13-14
- Review Information to be provided to data subjects · Requirement review · Art. 13-14
- Done Transparent communication and exercising rights · Requirement review · Art. 12
- Review Transparent communication and exercising rights · Requirement review · Art. 12
- Done Right of access · Requirement review · Art. 15
- Review Right of access · Requirement review · Art. 15
- Done Right to rectification · Requirement review · Art. 16
- Review Right to rectification · Requirement review · Art. 16
- Done Right to erasure ('right to be forgotten') · Requirement review · Art. 17
- Review Right to erasure ('right to be forgotten') · Requirement review · Art. 17
- Done Right to restriction of processing · Requirement review · Art. 18
- Review Right to restriction of processing · Requirement review · Art. 18
- Done Notify recipients of rectification, erasure, or restriction · Requirement review · Art. 19
- Review Notify recipients of rectification, erasure, or restriction · Requirement review · Art. 19
- Done Right to data portability · Requirement review · Art. 20
- Review Right to data portability · Requirement review · Art. 20
- Done Right to object · Requirement review · Art. 21
- Review Right to object · Requirement review · Art. 21
- Done Responsibility of the controller (accountability) · Requirement review · Art. 24
- Review Responsibility of the controller (accountability) · Requirement review · Art. 24
- Done Data protection by design and by default · Requirement review · Art. 25
- Review Data protection by design and by default · Requirement review · Art. 25
- Done Processor contracts · Requirement review · Art. 28
- Review Processor contracts · Requirement review · Art. 28
- Done Records of processing activities · Requirement review · Art. 30
- Review Records of processing activities · Requirement review · Art. 30
- Done Security of processing · Requirement review · Art. 32
- Review Security of processing · Requirement review · Art. 32
- Done Notification of a personal data breach to the supervisory authority · Requirement review · Art. 33
- Review Notification of a personal data breach to the supervisory authority · Requirement review · Art. 33
- Done Communication of a personal data breach to the data subject · Requirement review · Art. 34
- Review Communication of a personal data breach to the data subject · Requirement review · Art. 34
- Done Duty of care · Requirement review · Cyberbeveiligingswet art. 21
- Review Duty of care · Requirement review · Cyberbeveiligingswet art. 21
- Done Board approval and training · Requirement review · Cyberbeveiligingswet art. 24
- Review Board approval and training · Requirement review · Cyberbeveiligingswet art. 24
- Done Duty to report significant incidents · Requirement review · Cyberbeveiligingswet art. 25
- Review Duty to report significant incidents · Requirement review · Cyberbeveiligingswet art. 25
- Done Early warning within 24 hours · Requirement review · Cyberbeveiligingswet art. 26
- Review Early warning within 24 hours · Requirement review · Cyberbeveiligingswet art. 26
- Done Notification within 72 hours · Requirement review · Cyberbeveiligingswet art. 27
- Review Notification within 72 hours · Requirement review · Cyberbeveiligingswet art. 27
- Done Interim report · Requirement review · Cyberbeveiligingswet art. 28
- Review Interim report · Requirement review · Cyberbeveiligingswet art. 28
- Done Progress report and final report · Requirement review · Cyberbeveiligingswet art. 29
- Review Progress report and final report · Requirement review · Cyberbeveiligingswet art. 29
- Done Informing the recipients of your services · Requirement review · Cyberbeveiligingswet art. 30
- Review Informing the recipients of your services · Requirement review · Cyberbeveiligingswet art. 30
- Done Registration in the national register · Requirement review · Cyberbeveiligingswet art. 44
- Review Registration in the national register · Requirement review · Cyberbeveiligingswet art. 44
November
Nothing due
December
Nothing due