Compliance

This is the Compliance demo. Every visitor shares this company, and it resets every night.

What you change here, everyone sees until the next reset. Email, payments, and the AI models are switched off.

Start your own trial
  • EU GDPR (2016)
  • ISO 27001:2022
  • NIS2
  • NIS2 Netherlands (Cbw, 2026)

Nothing found that matches the search criteria.
Start your own trial
SV
Sam de Vries
sam.devries@tidewell-it.example
Legal

Requirements

EU GDPR (2016)

31 requirements
Code
Title
Category
State
Art. 5(1)(a)
Lawfulness, fairness and transparency
Principles
Addressed Mandatory
Art. 5(1)(b)
Purpose limitation
Principles
Addressed Mandatory
Art. 5(1)(c)
Data minimisation
Principles
Addressed Mandatory
Art. 5(1)(d)
Accuracy
Principles
Addressed Mandatory
Art. 5(1)(e)
Storage limitation
Principles
Addressed Mandatory
Art. 5(1)(f)
Integrity and confidentiality
Principles
Addressed Mandatory
Art. 6
Lawfulness of processing
Principles
Addressed Mandatory
Art. 13-14
Information to be provided to data subjects
Principles
Addressed Mandatory
Art. 12
Transparent communication and exercising rights
Data subject rights
Addressed Mandatory
Art. 15
Right of access
Data subject rights
Addressed Mandatory
Art. 16
Right to rectification
Data subject rights
Addressed Mandatory
Art. 17
Right to erasure ('right to be forgotten')
Data subject rights
Addressed Mandatory
Art. 18
Right to restriction of processing
Data subject rights
Addressed Mandatory
Art. 19
Notify recipients of rectification, erasure, or restriction
Data subject rights
Addressed Mandatory
Art. 20
Right to data portability
Data subject rights
Addressed Mandatory
Art. 21
Right to object
Data subject rights
Addressed Mandatory
Art. 24
Responsibility of the controller (accountability)
Controller & processor obligations
Addressed Mandatory
Art. 25
Data protection by design and by default
Controller & processor obligations
Addressed Mandatory
Art. 28
Processor contracts
Controller & processor obligations
Partially addressed Mandatory
Art. 30
Records of processing activities
Controller & processor obligations
Addressed Mandatory
Art. 32
Security of processing
Controller & processor obligations
Addressed Mandatory
Art. 33
Notification of a personal data breach to the supervisory authority
Controller & processor obligations
Addressed Mandatory
Art. 34
Communication of a personal data breach to the data subject
Controller & processor obligations
Partially addressed Mandatory
Art. 9-10
Special-category and criminal-offence data
Controller & processor obligations
Undecided
Art. 35
Data protection impact assessment (DPIA)
Controller & processor obligations
Partially addressed
Art. 36
Prior consultation
Controller & processor obligations
Undecided
Art. 37-39
Data protection officer (DPO)
Controller & processor obligations
Partially addressed
Art. 27
Representative in the Union
Controller & processor obligations
Excluded
Art. 22
Automated individual decision-making, including profiling
Data subject rights
Excluded
Art. 7-8
Conditions for consent
Principles
Excluded
Ch. V
International transfers of personal data
International transfers
Unaddressed

ISO 27001:2022

123 requirements
Code
Title
Category
State
4.1
Understanding the organisation and its context
Management system
Addressed Mandatory
4.2
Understanding the needs and expectations of interested parties
Management system
Addressed Mandatory
4.3
Determining the scope of the information security management system
Management system
Addressed Mandatory
4.4
Information security management system
Management system
Addressed Mandatory
5.1
Leadership and commitment
Management system
Addressed Mandatory
5.2
Policy
Management system
Addressed Mandatory
5.3
Organisational roles, responsibilities and authorities
Management system
Addressed Mandatory
6.1.1
Actions to address risks and opportunities - general
Management system
Addressed Mandatory
6.1.2
Information security risk assessment
Management system
Addressed Mandatory
6.1.3
Information security risk treatment
Management system
Addressed Mandatory
6.2
Information security objectives and planning to achieve them
Management system
Addressed Mandatory
6.3
Planning of changes
Management system
Addressed Mandatory
7.1
Resources
Management system
Addressed Mandatory
7.2
Competence
Management system
Addressed Mandatory
7.3
Awareness
Management system
Addressed Mandatory
7.4
Communication
Management system
Addressed Mandatory
7.5.1
Documented information - general
Management system
Addressed Mandatory
7.5.2
Creating and updating documented information
Management system
Addressed Mandatory
7.5.3
Control of documented information
Management system
Addressed Mandatory
8.1
Operational planning and control
Management system
Addressed Mandatory
8.2
Information security risk assessment (operational)
Management system
Addressed Mandatory
8.3
Information security risk treatment (operational)
Management system
Addressed Mandatory
9.1
Monitoring, measurement, analysis and evaluation
Management system
Addressed Mandatory
9.2.1
Internal audit - general
Management system
Addressed Mandatory
9.2.2
Internal audit programme
Management system
Addressed Mandatory
9.3.1
Management review - general
Management system
Addressed Mandatory
9.3.2
Management review inputs
Management system
Addressed Mandatory
9.3.3
Management review results
Management system
Addressed Mandatory
10.1
Continual improvement
Management system
Addressed Mandatory
10.2
Nonconformity and corrective action
Management system
Addressed Mandatory
A.5.1
Policies for information security
Organizational
Addressed
A.5.2
Information security roles and responsibilities
Organizational
Addressed
A.5.3
Segregation of duties
Organizational
Addressed
A.5.4
Management responsibilities
Organizational
Addressed
A.5.5
Contact with authorities
Organizational
Addressed
A.5.6
Contact with special interest groups
Organizational
Undecided
A.5.7
Threat intelligence
Organizational
Unaddressed
A.5.8
Information security in project management
Organizational
Addressed
A.5.9
Inventory of information and other associated assets
Organizational
Addressed
A.5.10
Acceptable use of information and other associated assets
Organizational
Addressed
A.5.11
Return of assets
Organizational
Addressed
A.5.12
Classification of information
Organizational
Addressed
A.5.13
Labelling of information
Organizational
Unaddressed
A.5.14
Information transfer
Organizational
Addressed
A.5.15
Access control
Organizational
Addressed
A.5.16
Identity management
Organizational
Addressed
A.5.17
Authentication information
Organizational
Addressed
A.5.18
Access rights
Organizational
Addressed
A.5.19
Information security in supplier relationships
Organizational
Partially addressed
A.5.20
Addressing information security within supplier agreements
Organizational
Partially addressed
A.5.21
Managing information security in the ICT supply chain
Organizational
Partially addressed
A.5.22
Monitoring, review and change management of supplier services
Organizational
Partially addressed
A.5.23
Information security for use of cloud services
Organizational
Partially addressed
A.5.24
Information security incident management planning and preparation
Organizational
Addressed
A.5.25
Assessment and decision on information security events
Organizational
Partially addressed
A.5.26
Response to information security incidents
Organizational
Addressed
A.5.27
Learning from information security incidents
Organizational
Partially addressed
A.5.28
Collection of evidence
Organizational
Unaddressed
A.5.29
Information security during disruption
Organizational
Addressed
A.5.30
ICT readiness for business continuity
Organizational
Partially addressed
A.5.31
Legal, statutory, regulatory and contractual requirements
Organizational
Unaddressed
A.5.32
Intellectual property rights
Organizational
Undecided
A.5.33
Protection of records
Organizational
Unaddressed
A.5.34
Privacy and protection of PII
Organizational
Addressed
A.5.35
Independent review of information security
Organizational
Partially addressed
A.5.36
Compliance with policies, rules and standards for information security
Organizational
Addressed
A.5.37
Documented operating procedures
Organizational
Addressed
A.6.1
Screening
People
Addressed
A.6.2
Terms and conditions of employment
People
Addressed
A.6.3
Information security awareness, education and training
People
Addressed
A.6.4
Disciplinary process
People
Addressed
A.6.5
Responsibilities after termination or change of employment
People
Addressed
A.6.6
Confidentiality or non-disclosure agreements
People
Addressed
A.6.7
Remote working
People
Partially addressed
A.6.8
Information security event reporting
People
Addressed
A.7.1
Physical security perimeters
Physical
Addressed
A.7.2
Physical entry
Physical
Addressed
A.7.3
Securing offices, rooms and facilities
Physical
Addressed
A.7.4
Physical security monitoring
Physical
Unaddressed
A.7.5
Protecting against physical and environmental threats
Physical
Addressed
A.7.6
Working in secure areas
Physical
Addressed
A.7.7
Clear desk and clear screen
Physical
Addressed
A.7.8
Equipment siting and protection
Physical
Addressed
A.7.9
Security of assets off-premises
Physical
Unaddressed
A.7.10
Storage media
Physical
Unaddressed
A.7.11
Supporting utilities
Physical
Partially addressed
A.7.12
Cabling security
Physical
Partially addressed
A.7.13
Equipment maintenance
Physical
Undecided
A.7.14
Secure disposal or re-use of equipment
Physical
Addressed
A.8.1
User end point devices
Technological
Addressed
A.8.2
Privileged access rights
Technological
Addressed
A.8.3
Information access restriction
Technological
Addressed
A.8.4
Access to source code
Technological
Addressed
A.8.5
Secure authentication
Technological
Addressed
A.8.6
Capacity management
Technological
Partially addressed
A.8.7
Protection against malware
Technological
Addressed
A.8.8
Management of technical vulnerabilities
Technological
Partially addressed
A.8.9
Configuration management
Technological
Partially addressed
A.8.10
Information deletion
Technological
Partially addressed
A.8.11
Data masking
Technological
Excluded
A.8.12
Data leakage prevention
Technological
Unaddressed
A.8.13
Information backup
Technological
Addressed
A.8.14
Redundancy of information processing facilities
Technological
Partially addressed
A.8.15
Logging
Technological
Partially addressed
A.8.16
Monitoring activities
Technological
Partially addressed
A.8.17
Clock synchronization
Technological
Addressed
A.8.18
Use of privileged utility programs
Technological
Undecided
A.8.19
Installation of software on operational systems
Technological
Addressed
A.8.20
Networks security
Technological
Addressed
A.8.21
Security of network services
Technological
Partially addressed
A.8.22
Segregation of networks
Technological
Partially addressed
A.8.23
Web filtering
Technological
Unaddressed
A.8.24
Use of cryptography
Technological
Addressed
A.8.25
Secure development life cycle
Technological
Addressed
A.8.26
Application security requirements
Technological
Partially addressed
A.8.27
Secure system architecture and engineering principles
Technological
Unaddressed
A.8.28
Secure coding
Technological
Addressed
A.8.29
Security testing in development and acceptance
Technological
Unaddressed
A.8.30
Outsourced development
Technological
Excluded
A.8.31
Separation of development, test and production environments
Technological
Unaddressed
A.8.32
Change management
Technological
Addressed
A.8.33
Test information
Technological
Unaddressed
A.8.34
Protection of information systems during audit testing
Technological
Undecided

NIS2

13 requirements
Code
Title
Category
State
CIR 2024/2690 Annex 1
Security policy and responsibilities
Network and information system security policy
Addressed
CIR 2024/2690 Annex 2
Risk management, compliance monitoring and independent review
Risk management policy
Addressed
CIR 2024/2690 Annex 3
Incident handling, monitoring and logging
Incident handling
Partially addressed
CIR 2024/2690 Annex 4
Continuity plan, backups and crisis management
Business continuity and crisis management
Partially addressed
CIR 2024/2690 Annex 5
Supply chain policy and supplier register
Supply chain security
Partially addressed
CIR 2024/2690 Annex 6
Secure acquisition, development and maintenance
Security in acquisition, development and maintenance
Unaddressed
CIR 2024/2690 Annex 7
Measuring the effectiveness of security measures
Effectiveness assessment
Unaddressed
CIR 2024/2690 Annex 8
Awareness and security training
Cyber hygiene and training
Addressed
CIR 2024/2690 Annex 9
Cryptography policy and key management
Cryptography
Addressed
CIR 2024/2690 Annex 10
Personnel security
Human resources security
Unaddressed
CIR 2024/2690 Annex 11
Access rights, privileged accounts and authentication
Access control
Addressed
CIR 2024/2690 Annex 12
Asset classification, handling and inventory
Asset management
Partially addressed
CIR 2024/2690 Annex 13
Utilities, environmental threats and physical access
Environmental and physical security
Partially addressed

NIS2 Netherlands (Cbw, 2026)

22 requirements
Code
Title
Category
State
Cyberbeveiligingswet art. 21
Duty of care
Duty of care
Addressed Mandatory
Cyberbeveiligingsbesluit art. 6
Security policy and responsibilities
Measures
Addressed
Cyberbeveiligingsbesluit art. 7
Risk management policy
Measures
Addressed
Cyberbeveiligingsbesluit art. 8
Incident handling and logging
Measures
Partially addressed
Cyberbeveiligingsbesluit art. 9
Business continuity and crisis management
Measures
Partially addressed
Cyberbeveiligingsbesluit art. 10
Supply chain security
Measures
Partially addressed
Cyberbeveiligingsbesluit art. 11
Secure acquisition, development and maintenance
Measures
Unaddressed
Cyberbeveiligingsbesluit art. 12
Cyber hygiene and training
Measures
Partially addressed
Cyberbeveiligingsbesluit art. 13
Cryptography policy
Measures
Addressed
Cyberbeveiligingsbesluit art. 14
Personnel security
Measures
Undecided
Cyberbeveiligingsbesluit art. 15
Access policy
Measures
Addressed
Cyberbeveiligingsbesluit art. 16
Asset management
Measures
Partially addressed
Cyberbeveiligingsbesluit art. 17
Alerts, advisories and threat intelligence
Measures
Undecided
Cyberbeveiligingsbesluit art. 18
Evaluation of the measures
Measures
Undecided
Cyberbeveiligingswet art. 24
Board approval and training
Governance
Addressed Mandatory
Cyberbeveiligingswet art. 25
Duty to report significant incidents
Incident reporting
Partially addressed Mandatory
Cyberbeveiligingswet art. 26
Early warning within 24 hours
Incident reporting
Unaddressed Mandatory
Cyberbeveiligingswet art. 27
Notification within 72 hours
Incident reporting
Unaddressed Mandatory
Cyberbeveiligingswet art. 28
Interim report
Incident reporting
Unaddressed Mandatory
Cyberbeveiligingswet art. 29
Progress report and final report
Incident reporting
Unaddressed Mandatory
Cyberbeveiligingswet art. 30
Informing the recipients of your services
Incident reporting
Partially addressed Mandatory
Cyberbeveiligingswet art. 44
Registration in the national register
Registration
Unaddressed Mandatory

Are you sure?

This action cannot be reverted.

Leave this page?

Your changes on this form are not saved. If you leave, they are lost.