Compliance

This is the Compliance demo. Every visitor shares this company, and it resets every night.

What you change here, everyone sees until the next reset. Email, payments, and the AI models are switched off.

Start your own trial
  • EU GDPR (2016)
  • ISO 27001:2022
  • NIS2
  • NIS2 Netherlands (Cbw, 2026)

Nothing found that matches the search criteria.
Start your own trial
SV
Sam de Vries
sam.devries@tidewell-it.example
Legal

Edit POL-013

Cancel
Body

Purpose

This Policy makes sure that the people who work for Tidewell IT are suitable for their roles, understand their security duties, and leave the company in an orderly way. People are our strongest control and our largest risk.

Scope

This Policy applies to candidates, employees, contractors, interns, and members of the Management Board, from the first screening until access ends and the equipment is returned.

Policy statements

Screening

  1. Identity and references are checked before an offer becomes final, within the limits of Dutch law and in proportion to the role.
  2. A Verklaring Omtrent het Gedrag is required for roles with access to customer environments.
  3. Screening is repeated when a person moves to a role with wider access.

Terms of employment

  1. A signed confidentiality agreement is in place before the person gets access to any system or information.
  2. Contracts state the person's security duties and the consequences of a breach, and these duties continue after the contract ends.
  3. Contractors and interns sign the same agreement as employees before their first day.

Awareness and training

  1. Every starter completes induction awareness in the first 2 weeks.
  2. Everyone completes an annual refresher. A phishing simulation runs every quarter, and people who click receive coaching.
  3. Completion is recorded in the Training register and reported to the Management Board.

Competence

  1. Each role has a description and the competencies it needs, recorded in the Roles register.
  2. Gaps between a person's competence and the role are closed with training, coaching, or a change of tasks.
  3. The line manager and the HR Lead review competence in the yearly performance conversation.

Change of role and leaving

  1. Access changes on the day a role changes. A mover keeps no access that the new role does not need.
  2. A leaver's access ends by the end of the last working day, and equipment, badges, and tokens are returned on that day.
  3. The HR Lead reminds a leaver of the duty of confidentiality that continues after the contract.
  4. Departed staff are removed from mailing lists, shared channels, and customer contact lists on the day they leave.

Board members

  1. Members of the Management Board follow annual cyber risk training, as the Cbw requires, and the attendance is recorded.
  2. Board members approve the security policies and answer for the resources that the ISMS needs.
  3. The Management Board reviews the state of information security at least once a year in the management review.

Roles and responsibilities

The HR Lead owns this Policy and runs screening, contracts, and leaving. The Service Desk Lead provides and removes accounts and equipment. The ISMS Manager arranges the awareness programme. Line managers confirm what each team member needs. The Management Board is accountable for its own training.

Exceptions

An exception needs a written request to the HR Lead that states the reason, the risk, and an end date, and the ISMS Manager must agree. Access to customer environments is never given without screening.

Compliance and enforcement

Breaches of this Policy lead to disciplinary measures under the HR process. Reports about screening or training that was missed are raised as Findings in the next internal audit.

Related documents

  • Joiner, Mover and Leaver Procedure
  • Security Awareness and Training Procedure
  • Access Control Policy
  • Acceptable Use Policy
  • Information Security Policy

Review

The HR Lead reviews this Policy at least once a year and after a significant change. The Management Board approves each revised version.
    • — none —
    • PER-001 — Sam de Vries
    • PER-002 — Annelies Verbeek
    • PER-003 — Kasper Hoogland
    • PER-004 — Marloes Brinkman
    • PER-005 — Nadia El Idrissi
    • PER-006 — Lotte van Dijk
    • PER-007 — Thijs Bosman
    • PER-008 — Anika Raghavan
    • PER-009 — Daan Rijnders
    • PER-010 — Eva Lundmark
    • PER-011 — Selim Aydogdu
    • PER-012 — Ioana Vasilescu
    • PER-013 — Finn de Rooij
    • PER-014 — Gerrit Smeenk
    • PER-015 — Wouter Hazelhoff
    • PER-016 — Aisha Rahman
    • PER-017 — Niels Dekker
    • PER-018 — Tariq Rashidi
    • PER-019 — Fleur Maas
    • PER-020 — Hans Overbeek
    • PER-021 — Marit Koster
    • PER-022 — Alessandro Ferrante
    • PER-023 — Yara Visser
    • PER-024 — Lars Ekstedt
    • PER-025 — Amira Khalil
    • PER-026 — Remco Bergsma
    • PER-027 — Roos van Beek
    • PER-028 — Dimitri Volkov
    • PER-029 — Esther Blom
    • PER-030 — Mustafa Karaca
    • PER-031 — Floris Adriaanse
    • PER-032 — Joris Kamphuis
    • PER-033 — Lieke Bakhuizen
    • PER-034 — Charlotte Veldhuis
    • PER-035 — Rik Meinders
    • PER-036 — Elena Marques
    • PER-037 — Judith Haanstra
    • PER-038 — Vera Dijkstra
    • PER-039 — Hanneke Rutten
    • PER-040 — Bram Oosterhuis
    • PER-041 — Stefan Kowalski
    • PER-042 — Imogen Clarke
    • PER-043 — Gustav Lindahl
    • PER-044 — Noah Smit
    • PER-045 — Sofie Claes
    • PER-046 — Marjolein Teunissen
    • PER-047 — Willem-Jan Roest
    • PER-048 — Rosalind Achterberg
    • PER-049 — Mikael Strand
    • PER-050 — Ilse Wiegman
    • PER-051 — Cornelis Vos
    • PER-052 — Patrick Ellison

    Nothing found that matches the search criteria.
    • ROL-001 — ISMS Manager
    • ROL-002 — Internal Auditor
    • ROL-003 — Data Protection Officer
    • ROL-004 — Service Desk Lead
    • ROL-005 — Change Manager
    • ROL-006 — Incident Coordinator
    • ROL-007 — Supplier Manager
    • ROL-008 — HR Lead
    • ROL-009 — Facilities Lead
    • ROL-010 — Management Board

    Nothing found that matches the search criteria.
    Who must approve this policy?
    • ROL-001 — ISMS Manager
    • ROL-002 — Internal Auditor
    • ROL-003 — Data Protection Officer
    • ROL-004 — Service Desk Lead
    • ROL-005 — Change Manager
    • ROL-006 — Incident Coordinator
    • ROL-007 — Supplier Manager
    • ROL-008 — HR Lead
    • ROL-009 — Facilities Lead
    • ROL-010 — Management Board

    Nothing found that matches the search criteria.
    Who must read this document?
    Requirements covered by this policy
    • Art. 5(1)(a) — Lawfulness, fairness and transparency (Mandatory)
    • Art. 5(1)(b) — Purpose limitation (Mandatory)
    • Art. 5(1)(c) — Data minimisation (Mandatory)
    • Art. 5(1)(d) — Accuracy (Mandatory)
    • Art. 5(1)(e) — Storage limitation (Mandatory)
    • Art. 5(1)(f) — Integrity and confidentiality (Mandatory)
    • Art. 6 — Lawfulness of processing (Mandatory)
    • Art. 13-14 — Information to be provided to data subjects (Mandatory)
    • Art. 12 — Transparent communication and exercising rights (Mandatory)
    • Art. 15 — Right of access (Mandatory)
    • Art. 16 — Right to rectification (Mandatory)
    • Art. 17 — Right to erasure ('right to be forgotten') (Mandatory)
    • Art. 18 — Right to restriction of processing (Mandatory)
    • Art. 19 — Notify recipients of rectification, erasure, or restriction (Mandatory)
    • Art. 20 — Right to data portability (Mandatory)
    • Art. 21 — Right to object (Mandatory)
    • Art. 24 — Responsibility of the controller (accountability) (Mandatory)
    • Art. 25 — Data protection by design and by default (Mandatory)
    • Art. 28 — Processor contracts (Mandatory)
    • Art. 30 — Records of processing activities (Mandatory)
    • Art. 32 — Security of processing (Mandatory)
    • Art. 33 — Notification of a personal data breach to the supervisory authority (Mandatory)
    • Art. 34 — Communication of a personal data breach to the data subject (Mandatory)
    • Art. 35 — Data protection impact assessment (DPIA)
    • Art. 37-39 — Data protection officer (DPO)
    • Ch. V — International transfers of personal data
    • 4.1 — Understanding the organisation and its context (Mandatory)
    • 4.2 — Understanding the needs and expectations of interested parties (Mandatory)
    • 4.3 — Determining the scope of the information security management system (Mandatory)
    • 4.4 — Information security management system (Mandatory)
    • 5.1 — Leadership and commitment (Mandatory)
    • 5.2 — Policy (Mandatory)
    • 5.3 — Organisational roles, responsibilities and authorities (Mandatory)
    • 6.1.1 — Actions to address risks and opportunities - general (Mandatory)
    • 6.1.2 — Information security risk assessment (Mandatory)
    • 6.1.3 — Information security risk treatment (Mandatory)
    • 6.2 — Information security objectives and planning to achieve them (Mandatory)
    • 6.3 — Planning of changes (Mandatory)
    • 7.1 — Resources (Mandatory)
    • 7.2 — Competence (Mandatory)
    • 7.3 — Awareness (Mandatory)
    • 7.4 — Communication (Mandatory)
    • 7.5.1 — Documented information - general (Mandatory)
    • 7.5.2 — Creating and updating documented information (Mandatory)
    • 7.5.3 — Control of documented information (Mandatory)
    • 8.1 — Operational planning and control (Mandatory)
    • 8.2 — Information security risk assessment (operational) (Mandatory)
    • 8.3 — Information security risk treatment (operational) (Mandatory)
    • 9.1 — Monitoring, measurement, analysis and evaluation (Mandatory)
    • 9.2.1 — Internal audit - general (Mandatory)
    • 9.2.2 — Internal audit programme (Mandatory)
    • 9.3.1 — Management review - general (Mandatory)
    • 9.3.2 — Management review inputs (Mandatory)
    • 9.3.3 — Management review results (Mandatory)
    • 10.1 — Continual improvement (Mandatory)
    • 10.2 — Nonconformity and corrective action (Mandatory)
    • A.5.1 — Policies for information security
    • A.5.2 — Information security roles and responsibilities
    • A.5.3 — Segregation of duties
    • A.5.4 — Management responsibilities
    • A.5.5 — Contact with authorities
    • A.5.7 — Threat intelligence
    • A.5.8 — Information security in project management
    • A.5.9 — Inventory of information and other associated assets
    • A.5.10 — Acceptable use of information and other associated assets
    • A.5.11 — Return of assets
    • A.5.12 — Classification of information
    • A.5.13 — Labelling of information
    • A.5.14 — Information transfer
    • A.5.15 — Access control
    • A.5.16 — Identity management
    • A.5.17 — Authentication information
    • A.5.18 — Access rights
    • A.5.19 — Information security in supplier relationships
    • A.5.20 — Addressing information security within supplier agreements
    • A.5.21 — Managing information security in the ICT supply chain
    • A.5.22 — Monitoring, review and change management of supplier services
    • A.5.23 — Information security for use of cloud services
    • A.5.24 — Information security incident management planning and preparation
    • A.5.25 — Assessment and decision on information security events
    • A.5.26 — Response to information security incidents
    • A.5.27 — Learning from information security incidents
    • A.5.28 — Collection of evidence
    • A.5.29 — Information security during disruption
    • A.5.30 — ICT readiness for business continuity
    • A.5.31 — Legal, statutory, regulatory and contractual requirements
    • A.5.33 — Protection of records
    • A.5.34 — Privacy and protection of PII
    • A.5.35 — Independent review of information security
    • A.5.36 — Compliance with policies, rules and standards for information security
    • A.5.37 — Documented operating procedures
    • A.6.1 — Screening
    • A.6.2 — Terms and conditions of employment
    • A.6.3 — Information security awareness, education and training
    • A.6.4 — Disciplinary process
    • A.6.5 — Responsibilities after termination or change of employment
    • A.6.6 — Confidentiality or non-disclosure agreements
    • A.6.7 — Remote working
    • A.6.8 — Information security event reporting
    • A.7.1 — Physical security perimeters
    • A.7.2 — Physical entry
    • A.7.3 — Securing offices, rooms and facilities
    • A.7.4 — Physical security monitoring
    • A.7.5 — Protecting against physical and environmental threats
    • A.7.6 — Working in secure areas
    • A.7.7 — Clear desk and clear screen
    • A.7.8 — Equipment siting and protection
    • A.7.9 — Security of assets off-premises
    • A.7.10 — Storage media
    • A.7.11 — Supporting utilities
    • A.7.12 — Cabling security
    • A.7.14 — Secure disposal or re-use of equipment
    • A.8.1 — User end point devices
    • A.8.2 — Privileged access rights
    • A.8.3 — Information access restriction
    • A.8.4 — Access to source code
    • A.8.5 — Secure authentication
    • A.8.6 — Capacity management
    • A.8.7 — Protection against malware
    • A.8.8 — Management of technical vulnerabilities
    • A.8.9 — Configuration management
    • A.8.10 — Information deletion
    • A.8.12 — Data leakage prevention
    • A.8.13 — Information backup
    • A.8.14 — Redundancy of information processing facilities
    • A.8.15 — Logging
    • A.8.16 — Monitoring activities
    • A.8.17 — Clock synchronization
    • A.8.19 — Installation of software on operational systems
    • A.8.20 — Networks security
    • A.8.21 — Security of network services
    • A.8.22 — Segregation of networks
    • A.8.23 — Web filtering
    • A.8.24 — Use of cryptography
    • A.8.25 — Secure development life cycle
    • A.8.26 — Application security requirements
    • A.8.27 — Secure system architecture and engineering principles
    • A.8.28 — Secure coding
    • A.8.29 — Security testing in development and acceptance
    • A.8.31 — Separation of development, test and production environments
    • A.8.32 — Change management
    • A.8.33 — Test information
    • CIR 2024/2690 Annex 1 — Security policy and responsibilities
    • CIR 2024/2690 Annex 2 — Risk management, compliance monitoring and independent review
    • CIR 2024/2690 Annex 3 — Incident handling, monitoring and logging
    • CIR 2024/2690 Annex 4 — Continuity plan, backups and crisis management
    • CIR 2024/2690 Annex 5 — Supply chain policy and supplier register
    • CIR 2024/2690 Annex 6 — Secure acquisition, development and maintenance
    • CIR 2024/2690 Annex 7 — Measuring the effectiveness of security measures
    • CIR 2024/2690 Annex 8 — Awareness and security training
    • CIR 2024/2690 Annex 9 — Cryptography policy and key management
    • CIR 2024/2690 Annex 10 — Personnel security
    • CIR 2024/2690 Annex 11 — Access rights, privileged accounts and authentication
    • CIR 2024/2690 Annex 12 — Asset classification, handling and inventory
    • CIR 2024/2690 Annex 13 — Utilities, environmental threats and physical access
    • Cyberbeveiligingswet art. 21 — Duty of care (Mandatory)
    • Cyberbeveiligingsbesluit art. 6 — Security policy and responsibilities
    • Cyberbeveiligingsbesluit art. 7 — Risk management policy
    • Cyberbeveiligingsbesluit art. 8 — Incident handling and logging
    • Cyberbeveiligingsbesluit art. 9 — Business continuity and crisis management
    • Cyberbeveiligingsbesluit art. 10 — Supply chain security
    • Cyberbeveiligingsbesluit art. 11 — Secure acquisition, development and maintenance
    • Cyberbeveiligingsbesluit art. 12 — Cyber hygiene and training
    • Cyberbeveiligingsbesluit art. 13 — Cryptography policy
    • Cyberbeveiligingsbesluit art. 15 — Access policy
    • Cyberbeveiligingsbesluit art. 16 — Asset management
    • Cyberbeveiligingswet art. 24 — Board approval and training (Mandatory)
    • Cyberbeveiligingswet art. 25 — Duty to report significant incidents (Mandatory)
    • Cyberbeveiligingswet art. 26 — Early warning within 24 hours (Mandatory)
    • Cyberbeveiligingswet art. 27 — Notification within 72 hours (Mandatory)
    • Cyberbeveiligingswet art. 28 — Interim report (Mandatory)
    • Cyberbeveiligingswet art. 29 — Progress report and final report (Mandatory)
    • Cyberbeveiligingswet art. 30 — Informing the recipients of your services (Mandatory)
    • Cyberbeveiligingswet art. 44 — Registration in the national register (Mandatory)

    Nothing found that matches the search criteria.
    Linked requirements show this document as a coverage source on each requirement's Details page.
    Implemented by procedures
    • PRO-001 — Access Request and Review Procedure
    • PRO-007 — Backup and Restore Procedure
    • PRO-005 — Change Management Procedure
    • PRO-009 — Data Subject Request Handling Procedure
    • PRO-003 — Incident Handling Procedure
    • PRO-010 — Internal Audit and Management Review Procedure
    • PRO-002 — Joiner, Mover and Leaver Procedure
    • PRO-004 — Personal Data Breach Notification Procedure
    • PRO-012 — Physical Access and Visitor Management Procedure
    • PRO-011 — Security Awareness and Training Procedure
    • PRO-008 — Supplier Onboarding and Review Procedure
    • PRO-006 — Vulnerability and Patch Management Procedure

    Nothing found that matches the search criteria.
    Comments on this Policy (0)

    Add comment

      Are you sure?

      This action cannot be reverted.

      Leave this page?

      Your changes on this form are not saved. If you leave, they are lost.