Compliance

This is the Compliance demo. Every visitor shares this company, and it resets every night.

What you change here, everyone sees until the next reset. Email, payments, and the AI models are switched off.

Start your own trial
  • EU GDPR (2016)
  • ISO 27001:2022
  • NIS2
  • NIS2 Netherlands (Cbw, 2026)

Nothing found that matches the search criteria.
Start your own trial
SV
Sam de Vries
sam.devries@tidewell-it.example
Legal

Edit POL-014

Cancel
Body

Purpose

This Policy protects information when staff work outside the Utrecht office, from home, at a customer, or on the move, and when they use mobile devices for work.

Scope

This Policy applies to all employees, contractors, and interns who work away from the office, and to every laptop, phone, tablet, and personal device that is used for work.

Policy statements

Eligibility

  1. Remote working is available to staff whose tasks allow it, as agreed with their line manager.
  2. Staff who work remotely have completed induction awareness and sign for the equipment they receive.
  3. The line manager and the HR Lead record the agreement on remote working.

Device requirements

  1. Remote work is done on encrypted, managed laptops with automatic updates and endpoint protection switched on.
  2. The screen locks after 5 minutes without use, and staff lock it by hand whenever they step away.
  3. A device with missing updates or switched-off protection loses access to company systems until it is fixed.

Mobile devices

  1. Phones and tablets that reach company email or systems are enrolled with the Service Desk, require a screen lock, and encrypt their storage.
  2. A lost or stolen device is reported to the Service Desk within 1 hour. The Service Desk can wipe the device remotely, and does so when the device cannot be recovered.

Network access

  1. Remote access to company systems goes through the company VPN with multi-factor authentication.
  2. Public Wi-Fi is not used without the company VPN.

Workspace

  1. Staff keep a clear desk and a clear screen: papers and devices with company information are put away, and the screen is hidden from others.
  2. Calls about confidential matters are held where nobody can listen in.
  3. Company information is not printed at home.

Travelling and off-premises

  1. Devices are carried as hand luggage and are never left in a vehicle.
  2. When a device is used at a customer site, the staff member follows the customer's rules in addition to this Policy.

Personal devices

  1. A personal device may reach email and the intranet only after the Service Desk has enrolled it, and it is not used for administration of customer systems.
  2. Personal devices keep no customer data, and the company may remove its own data and settings from them.

Customer data

  1. Customer data is not kept on local disks. Staff work on it in the customer environment or in approved company systems.
  2. Customer data is not copied to personal cloud storage, personal email, or private messaging.

Roles and responsibilities

The Service Desk Lead owns this Policy, enrols devices, and handles lost devices. The ISMS Manager reviews exceptions. The HR Lead includes remote working in the terms of employment. Every staff member keeps the equipment safe and reports problems at once.

Exceptions

An exception needs a written request to the ISMS Manager that states the reason, the risk, and an end date. Encryption and multi-factor authentication are not subject to exceptions.

Compliance and enforcement

Breaches of this Policy lead to disciplinary measures under the HR process. A device that does not meet the requirements loses access until it does.

Related documents

  • Acceptable Use Policy
  • Access Control Policy
  • Information Classification and Retention Policy
  • Information Security Policy
  • Cryptography Policy

Review

The Service Desk Lead reviews this Policy at least once a year and after a significant change. The Management Board approves each revised version.
    • — none —
    • PER-001 — Sam de Vries
    • PER-002 — Annelies Verbeek
    • PER-003 — Kasper Hoogland
    • PER-004 — Marloes Brinkman
    • PER-005 — Nadia El Idrissi
    • PER-006 — Lotte van Dijk
    • PER-007 — Thijs Bosman
    • PER-008 — Anika Raghavan
    • PER-009 — Daan Rijnders
    • PER-010 — Eva Lundmark
    • PER-011 — Selim Aydogdu
    • PER-012 — Ioana Vasilescu
    • PER-013 — Finn de Rooij
    • PER-014 — Gerrit Smeenk
    • PER-015 — Wouter Hazelhoff
    • PER-016 — Aisha Rahman
    • PER-017 — Niels Dekker
    • PER-018 — Tariq Rashidi
    • PER-019 — Fleur Maas
    • PER-020 — Hans Overbeek
    • PER-021 — Marit Koster
    • PER-022 — Alessandro Ferrante
    • PER-023 — Yara Visser
    • PER-024 — Lars Ekstedt
    • PER-025 — Amira Khalil
    • PER-026 — Remco Bergsma
    • PER-027 — Roos van Beek
    • PER-028 — Dimitri Volkov
    • PER-029 — Esther Blom
    • PER-030 — Mustafa Karaca
    • PER-031 — Floris Adriaanse
    • PER-032 — Joris Kamphuis
    • PER-033 — Lieke Bakhuizen
    • PER-034 — Charlotte Veldhuis
    • PER-035 — Rik Meinders
    • PER-036 — Elena Marques
    • PER-037 — Judith Haanstra
    • PER-038 — Vera Dijkstra
    • PER-039 — Hanneke Rutten
    • PER-040 — Bram Oosterhuis
    • PER-041 — Stefan Kowalski
    • PER-042 — Imogen Clarke
    • PER-043 — Gustav Lindahl
    • PER-044 — Noah Smit
    • PER-045 — Sofie Claes
    • PER-046 — Marjolein Teunissen
    • PER-047 — Willem-Jan Roest
    • PER-048 — Rosalind Achterberg
    • PER-049 — Mikael Strand
    • PER-050 — Ilse Wiegman
    • PER-051 — Cornelis Vos
    • PER-052 — Patrick Ellison

    Nothing found that matches the search criteria.
    • ROL-001 — ISMS Manager
    • ROL-002 — Internal Auditor
    • ROL-003 — Data Protection Officer
    • ROL-004 — Service Desk Lead
    • ROL-005 — Change Manager
    • ROL-006 — Incident Coordinator
    • ROL-007 — Supplier Manager
    • ROL-008 — HR Lead
    • ROL-009 — Facilities Lead
    • ROL-010 — Management Board

    Nothing found that matches the search criteria.
    Who must approve this policy?
    Who must read this document?
    Requirements covered by this policy
    • Art. 5(1)(a) — Lawfulness, fairness and transparency (Mandatory)
    • Art. 5(1)(b) — Purpose limitation (Mandatory)
    • Art. 5(1)(c) — Data minimisation (Mandatory)
    • Art. 5(1)(d) — Accuracy (Mandatory)
    • Art. 5(1)(e) — Storage limitation (Mandatory)
    • Art. 5(1)(f) — Integrity and confidentiality (Mandatory)
    • Art. 6 — Lawfulness of processing (Mandatory)
    • Art. 13-14 — Information to be provided to data subjects (Mandatory)
    • Art. 12 — Transparent communication and exercising rights (Mandatory)
    • Art. 15 — Right of access (Mandatory)
    • Art. 16 — Right to rectification (Mandatory)
    • Art. 17 — Right to erasure ('right to be forgotten') (Mandatory)
    • Art. 18 — Right to restriction of processing (Mandatory)
    • Art. 19 — Notify recipients of rectification, erasure, or restriction (Mandatory)
    • Art. 20 — Right to data portability (Mandatory)
    • Art. 21 — Right to object (Mandatory)
    • Art. 24 — Responsibility of the controller (accountability) (Mandatory)
    • Art. 25 — Data protection by design and by default (Mandatory)
    • Art. 28 — Processor contracts (Mandatory)
    • Art. 30 — Records of processing activities (Mandatory)
    • Art. 32 — Security of processing (Mandatory)
    • Art. 33 — Notification of a personal data breach to the supervisory authority (Mandatory)
    • Art. 34 — Communication of a personal data breach to the data subject (Mandatory)
    • Art. 35 — Data protection impact assessment (DPIA)
    • Art. 37-39 — Data protection officer (DPO)
    • Ch. V — International transfers of personal data
    • 4.1 — Understanding the organisation and its context (Mandatory)
    • 4.2 — Understanding the needs and expectations of interested parties (Mandatory)
    • 4.3 — Determining the scope of the information security management system (Mandatory)
    • 4.4 — Information security management system (Mandatory)
    • 5.1 — Leadership and commitment (Mandatory)
    • 5.2 — Policy (Mandatory)
    • 5.3 — Organisational roles, responsibilities and authorities (Mandatory)
    • 6.1.1 — Actions to address risks and opportunities - general (Mandatory)
    • 6.1.2 — Information security risk assessment (Mandatory)
    • 6.1.3 — Information security risk treatment (Mandatory)
    • 6.2 — Information security objectives and planning to achieve them (Mandatory)
    • 6.3 — Planning of changes (Mandatory)
    • 7.1 — Resources (Mandatory)
    • 7.2 — Competence (Mandatory)
    • 7.3 — Awareness (Mandatory)
    • 7.4 — Communication (Mandatory)
    • 7.5.1 — Documented information - general (Mandatory)
    • 7.5.2 — Creating and updating documented information (Mandatory)
    • 7.5.3 — Control of documented information (Mandatory)
    • 8.1 — Operational planning and control (Mandatory)
    • 8.2 — Information security risk assessment (operational) (Mandatory)
    • 8.3 — Information security risk treatment (operational) (Mandatory)
    • 9.1 — Monitoring, measurement, analysis and evaluation (Mandatory)
    • 9.2.1 — Internal audit - general (Mandatory)
    • 9.2.2 — Internal audit programme (Mandatory)
    • 9.3.1 — Management review - general (Mandatory)
    • 9.3.2 — Management review inputs (Mandatory)
    • 9.3.3 — Management review results (Mandatory)
    • 10.1 — Continual improvement (Mandatory)
    • 10.2 — Nonconformity and corrective action (Mandatory)
    • A.5.1 — Policies for information security
    • A.5.2 — Information security roles and responsibilities
    • A.5.3 — Segregation of duties
    • A.5.4 — Management responsibilities
    • A.5.5 — Contact with authorities
    • A.5.7 — Threat intelligence
    • A.5.8 — Information security in project management
    • A.5.9 — Inventory of information and other associated assets
    • A.5.10 — Acceptable use of information and other associated assets
    • A.5.11 — Return of assets
    • A.5.12 — Classification of information
    • A.5.13 — Labelling of information
    • A.5.14 — Information transfer
    • A.5.15 — Access control
    • A.5.16 — Identity management
    • A.5.17 — Authentication information
    • A.5.18 — Access rights
    • A.5.19 — Information security in supplier relationships
    • A.5.20 — Addressing information security within supplier agreements
    • A.5.21 — Managing information security in the ICT supply chain
    • A.5.22 — Monitoring, review and change management of supplier services
    • A.5.23 — Information security for use of cloud services
    • A.5.24 — Information security incident management planning and preparation
    • A.5.25 — Assessment and decision on information security events
    • A.5.26 — Response to information security incidents
    • A.5.27 — Learning from information security incidents
    • A.5.28 — Collection of evidence
    • A.5.29 — Information security during disruption
    • A.5.30 — ICT readiness for business continuity
    • A.5.31 — Legal, statutory, regulatory and contractual requirements
    • A.5.33 — Protection of records
    • A.5.34 — Privacy and protection of PII
    • A.5.35 — Independent review of information security
    • A.5.36 — Compliance with policies, rules and standards for information security
    • A.5.37 — Documented operating procedures
    • A.6.1 — Screening
    • A.6.2 — Terms and conditions of employment
    • A.6.3 — Information security awareness, education and training
    • A.6.4 — Disciplinary process
    • A.6.5 — Responsibilities after termination or change of employment
    • A.6.6 — Confidentiality or non-disclosure agreements
    • A.6.7 — Remote working
    • A.6.8 — Information security event reporting
    • A.7.1 — Physical security perimeters
    • A.7.2 — Physical entry
    • A.7.3 — Securing offices, rooms and facilities
    • A.7.4 — Physical security monitoring
    • A.7.5 — Protecting against physical and environmental threats
    • A.7.6 — Working in secure areas
    • A.7.7 — Clear desk and clear screen
    • A.7.8 — Equipment siting and protection
    • A.7.9 — Security of assets off-premises
    • A.7.10 — Storage media
    • A.7.11 — Supporting utilities
    • A.7.12 — Cabling security
    • A.7.14 — Secure disposal or re-use of equipment
    • A.8.1 — User end point devices
    • A.8.2 — Privileged access rights
    • A.8.3 — Information access restriction
    • A.8.4 — Access to source code
    • A.8.5 — Secure authentication
    • A.8.6 — Capacity management
    • A.8.7 — Protection against malware
    • A.8.8 — Management of technical vulnerabilities
    • A.8.9 — Configuration management
    • A.8.10 — Information deletion
    • A.8.12 — Data leakage prevention
    • A.8.13 — Information backup
    • A.8.14 — Redundancy of information processing facilities
    • A.8.15 — Logging
    • A.8.16 — Monitoring activities
    • A.8.17 — Clock synchronization
    • A.8.19 — Installation of software on operational systems
    • A.8.20 — Networks security
    • A.8.21 — Security of network services
    • A.8.22 — Segregation of networks
    • A.8.23 — Web filtering
    • A.8.24 — Use of cryptography
    • A.8.25 — Secure development life cycle
    • A.8.26 — Application security requirements
    • A.8.27 — Secure system architecture and engineering principles
    • A.8.28 — Secure coding
    • A.8.29 — Security testing in development and acceptance
    • A.8.31 — Separation of development, test and production environments
    • A.8.32 — Change management
    • A.8.33 — Test information
    • CIR 2024/2690 Annex 1 — Security policy and responsibilities
    • CIR 2024/2690 Annex 2 — Risk management, compliance monitoring and independent review
    • CIR 2024/2690 Annex 3 — Incident handling, monitoring and logging
    • CIR 2024/2690 Annex 4 — Continuity plan, backups and crisis management
    • CIR 2024/2690 Annex 5 — Supply chain policy and supplier register
    • CIR 2024/2690 Annex 6 — Secure acquisition, development and maintenance
    • CIR 2024/2690 Annex 7 — Measuring the effectiveness of security measures
    • CIR 2024/2690 Annex 8 — Awareness and security training
    • CIR 2024/2690 Annex 9 — Cryptography policy and key management
    • CIR 2024/2690 Annex 10 — Personnel security
    • CIR 2024/2690 Annex 11 — Access rights, privileged accounts and authentication
    • CIR 2024/2690 Annex 12 — Asset classification, handling and inventory
    • CIR 2024/2690 Annex 13 — Utilities, environmental threats and physical access
    • Cyberbeveiligingswet art. 21 — Duty of care (Mandatory)
    • Cyberbeveiligingsbesluit art. 6 — Security policy and responsibilities
    • Cyberbeveiligingsbesluit art. 7 — Risk management policy
    • Cyberbeveiligingsbesluit art. 8 — Incident handling and logging
    • Cyberbeveiligingsbesluit art. 9 — Business continuity and crisis management
    • Cyberbeveiligingsbesluit art. 10 — Supply chain security
    • Cyberbeveiligingsbesluit art. 11 — Secure acquisition, development and maintenance
    • Cyberbeveiligingsbesluit art. 12 — Cyber hygiene and training
    • Cyberbeveiligingsbesluit art. 13 — Cryptography policy
    • Cyberbeveiligingsbesluit art. 15 — Access policy
    • Cyberbeveiligingsbesluit art. 16 — Asset management
    • Cyberbeveiligingswet art. 24 — Board approval and training (Mandatory)
    • Cyberbeveiligingswet art. 25 — Duty to report significant incidents (Mandatory)
    • Cyberbeveiligingswet art. 26 — Early warning within 24 hours (Mandatory)
    • Cyberbeveiligingswet art. 27 — Notification within 72 hours (Mandatory)
    • Cyberbeveiligingswet art. 28 — Interim report (Mandatory)
    • Cyberbeveiligingswet art. 29 — Progress report and final report (Mandatory)
    • Cyberbeveiligingswet art. 30 — Informing the recipients of your services (Mandatory)
    • Cyberbeveiligingswet art. 44 — Registration in the national register (Mandatory)

    Nothing found that matches the search criteria.
    Linked requirements show this document as a coverage source on each requirement's Details page.
    Implemented by procedures
    • PRO-001 — Access Request and Review Procedure
    • PRO-007 — Backup and Restore Procedure
    • PRO-005 — Change Management Procedure
    • PRO-009 — Data Subject Request Handling Procedure
    • PRO-003 — Incident Handling Procedure
    • PRO-010 — Internal Audit and Management Review Procedure
    • PRO-002 — Joiner, Mover and Leaver Procedure
    • PRO-004 — Personal Data Breach Notification Procedure
    • PRO-012 — Physical Access and Visitor Management Procedure
    • PRO-011 — Security Awareness and Training Procedure
    • PRO-008 — Supplier Onboarding and Review Procedure
    • PRO-006 — Vulnerability and Patch Management Procedure

    Nothing found that matches the search criteria.
    Comments on this Policy (0)

    Add comment

      Are you sure?

      This action cannot be reverted.

      Leave this page?

      Your changes on this form are not saved. If you leave, they are lost.