ISMS scope

Services in scope

The ISMS covers the services Tidewell IT delivers to its customers: workplace management with the service desk and field services, network management for customer sites, and hosting on the managed hosting platform with its backups. It also covers the internal processes behind those services, such as incident handling, change management, access management, and the administration of customer credentials.

Sites

Three sites are in scope: the head office in Utrecht, where the service desk, the security team, and the Management Board work, and the two data centre suites that Tidewell IT rents from Nordwave Colocation and Brightspan Datacenters. Engineers who work at a customer site or from home are in scope as long as they use Tidewell IT devices and accounts.

Interfaces

Customers reach the services through the remote management platform and the ticketing system, and the duties on each side are written down in the master services agreement. Suppliers take part through the colocation contracts, the offsite backup service, Microsoft 365, and Amazon Web Services, and the Suppliers register holds each of them with its criticality and review rhythm. The certification body and the supervisory authorities receive information about the ISMS through the ISMS Manager.

Out of scope

The systems that customers run themselves, and the data in their own tenants, are outside the boundary, because customers decide how those are configured and used. Tidewell IT is in scope wherever it administers such a system, through its own access, its tooling, and its change process. Sales and the marketing website are outside the boundary too, except for the personal data they hold.

Changes to the scope

A new site, service, or supplier enters the scope through a change that the ISMS Manager records and the Management Board approves. The scope is reviewed once a year, and again when the company opens or closes a site.