Compliance | mvdm.io

AST-001 — Customer configuration database

AST-002 — Customer contracts and SLAs

AST-003 — Customer network diagrams

AST-004 — Privileged credential vault contents

AST-005 — Backup catalogues and encryption keys

AST-006 — Employee HR records

AST-007 — Financial administration

AST-008 — ISMS documentation

AST-009 — Monitoring and audit logs

AST-010 — Public website content

AST-011 — Remote monitoring and management platform

AST-012 — Service desk ticketing system

AST-013 — Virtualisation platform

AST-014 — Backup software

AST-015 — Endpoint detection and response agents

AST-016 — Identity provider and single sign-on

AST-017 — Documentation wiki

AST-018 — Customer VPN gateway software

AST-019 — Legacy hosting control panel

AST-020 — Core network switches, data centre A

AST-021 — Core network switches, data centre B

AST-022 — Perimeter firewalls

AST-023 — Hypervisor hosts, data centre A

AST-024 — Hypervisor hosts, data centre B

AST-025 — Primary storage arrays

AST-026 — Employee laptop fleet

AST-027 — Mobile device fleet

AST-028 — Hardware security keys

AST-029 — Next-generation firewall refresh

AST-030 — Old tape library

AST-031 — Contractor laptop of Imogen Clarke

AST-032 — Microsoft 365 tenant

AST-033 — Colocation space, data centre A

AST-034 — Colocation space, data centre B

AST-035 — Internet and transit connectivity

AST-036 — Offsite backup storage

AST-037 — Network engineering expertise

AST-038 — Service desk team knowledge

AST-039 — Utrecht office

AST-040 — Former Amersfoort office

BIS-001 — Customers increasingly ask suppliers for an ISO 27001 certificate

BIS-002 — The Cyberbeveiligingswet applies to managed service providers

BIS-003 — Only two engineers can operate the storage layer of the hosting platform

BIS-004 — Both colocation contracts end within two years

BIS-005 — Growth from 30 to 45 staff strains onboarding and access control

BIS-006 — Nine customers migrated off the retired legacy platform need post-migration checks

BIS-007 — Premiums for cyber insurance are rising

BIS-008 — The Amersfoort office closed and its customers moved

BCP-001 — Data centre loss plan

BCP-002 — Ransomware recovery plan

BCP-003 — Utrecht office loss plan

BCP-004 — Key person unavailability plan

BCP-005 — Colocation provider failure plan

AUD-0001 — ISO 27001 internal audit

AUD-0002 — ISO 27001 certification audit, Stage 1

AUD-0003 — ISO 27001 certification audit, Stage 2

BCT-0001 — Tabletop — Ransomware recovery plan

BCT-0002 — Partial failover — Data centre loss plan

GAP-0001 — Gap analysis — ISO 27001:2022

GAP-0002 — Gap analysis — NIS2 Netherlands (Cbw, 2026)

MRV-0001 — ISMS management review

MTG-0001 — ISMS monthly meeting 1

MTG-0002 — ISMS monthly meeting 2

MTG-0003 — ISMS monthly meeting 3

MTG-0004 — ISMS monthly meeting 4

MTG-0005 — ISMS monthly meeting 5

MTG-0006 — ISMS monthly meeting 6

MTG-0007 — ISMS monthly meeting 7

MTG-0008 — ISMS monthly meeting 8

MTG-0009 — ISMS monthly meeting 9

MTG-0010 — ISMS monthly meeting 10

MTG-0011 — ISMS monthly meeting 11

MTG-0012 — ISMS monthly meeting 12

TES-0001 — Penetration test, external and internal network

FND-001 — Access rights reviews were skipped for two quarters

FND-002 — Leavers' accounts are disabled later than the 24-hour target

FND-003 — Supplier reviews are not completed on schedule

FND-004 — The clear-desk rule is not applied in the service desk area

FND-005 — Automate the leaver checklist

FND-006 — Reported gap: no CCTV at the second server room

FND-007 — Backup restore tests are not documented

FND-008 — Pentest results are not tracked to closure

FND-009 — Test accounts from the pentest were not removed afterwards

FND-010 — Include the identity provider and the customer VPN gateway in the next pentest scope

FND-011 — The Statement of Applicability is thin on the reasons for including three controls

FND-012 — Management review minutes do not record decisions on resources

FND-013 — The internal audit programme does not yet cover the Cbw

FND-014 — Role-specific training is not recorded for two Roles

FND-015 — Map the Cbw reporting duties onto the incident process

INC-001 — Ransomware on a customer file server

INC-002 — Phishing campaign against the service desk

INC-003 — Cooling failure in a data centre rack

INC-004 — Engineer's laptop lost on a train

INC-005 — Stale admin account used on a customer backup repository

INC-006 — Monitoring agent update causes reboot loops on customer workstations

INC-007 — Repeated failed logins on the remote desktop gateway

IPY-001 — Customers

IPY-002 — Dutch Data Protection Authority

IPY-003 — Rijksinspectie Digitale Infrastructuur

IPY-004 — Staff and contractors

IPY-005 — Shareholders and the Advisory Board

IPY-006 — Suppliers

IPY-007 — Norland Certification

IPY-008 — Managed service industry association

IPY-009 — Visitors of the website

KPI-001 — Mean time to patch critical vulnerabilities (days)

KPI-002 — Security awareness training completion (%)

KPI-003 — Phishing simulation click rate (%)

KPI-004 — Backup restore tests passed (%)

KPI-005 — Open vulnerabilities older than 30 days

KPI-006 — Supplier reviews completed on schedule (%)

KPI-007 — Legacy monitoring servers in operation

OBJ-001 — Obtain ISO 27001:2022 certification

OBJ-002 — Reach 95 percent completion of the annual security awareness training

OBJ-003 — Patch critical vulnerabilities within 7 days

OBJ-004 — Bring the Cbw measures to full coverage

OBJ-005 — Bring the phishing click rate below 3 percent

OBJ-006 — Enforce multi-factor authentication on every customer administrator account

OBJ-007 — Offer customers a SOC 2 report

OPP-001 — Offer managed security monitoring to existing customers

OPP-002 — Reuse the ISO 27001 evidence for customer security questionnaires

OPP-003 — Automate customer onboarding with scripted baselines

OPP-004 — Offer an immutable backup option

OPP-005 — Bundle Cbw readiness checks into the service desk offer

OPP-006 — Open a second office in Rotterdam

PER-001 — Sam de Vries

PER-002 — Annelies Verbeek

PER-003 — Kasper Hoogland

PER-004 — Marloes Brinkman

PER-005 — Nadia El Idrissi

PER-006 — Lotte van Dijk

PER-007 — Thijs Bosman

PER-008 — Anika Raghavan

PER-009 — Daan Rijnders

PER-010 — Eva Lundmark

PER-011 — Selim Aydogdu

PER-012 — Ioana Vasilescu

PER-013 — Finn de Rooij

PER-014 — Gerrit Smeenk

PER-015 — Wouter Hazelhoff

PER-016 — Aisha Rahman

PER-017 — Niels Dekker

PER-018 — Tariq Rashidi

PER-019 — Fleur Maas

PER-020 — Hans Overbeek

PER-021 — Marit Koster

PER-022 — Alessandro Ferrante

PER-023 — Yara Visser

PER-024 — Lars Ekstedt

PER-025 — Amira Khalil

PER-026 — Remco Bergsma

PER-027 — Roos van Beek

PER-028 — Dimitri Volkov

PER-029 — Esther Blom

PER-030 — Mustafa Karaca

PER-031 — Floris Adriaanse

PER-032 — Joris Kamphuis

PER-033 — Lieke Bakhuizen

PER-034 — Charlotte Veldhuis

PER-035 — Rik Meinders

PER-036 — Elena Marques

PER-037 — Judith Haanstra

PER-038 — Vera Dijkstra

PER-039 — Hanneke Rutten

PER-040 — Bram Oosterhuis

PER-041 — Stefan Kowalski

PER-042 — Imogen Clarke

PER-043 — Gustav Lindahl

PER-044 — Noah Smit

PER-045 — Sofie Claes

PER-046 — Marjolein Teunissen

PER-047 — Willem-Jan Roest

PER-048 — Rosalind Achterberg

PER-049 — Mikael Strand

PER-050 — Ilse Wiegman

PER-051 — Cornelis Vos

PER-052 — Patrick Ellison

POL-001 — Information Security Policy

POL-002 — Acceptable Use Policy

POL-003 — Access Control Policy

POL-004 — Risk Management Policy

POL-005 — Incident Response Policy

POL-006 — Business Continuity and Disaster Recovery Policy

POL-007 — Supplier Security Policy

POL-008 — Personal Data Protection Policy

POL-009 — Information Classification and Retention Policy

POL-010 — Cryptography Policy

POL-011 — Secure Development and Change Policy

POL-012 — Physical and Environmental Security Policy

POL-013 — Human Resources Security Policy

POL-014 — Remote Working and Mobile Devices Policy

POL-015 — Removable Media Policy

PRO-001 — Access Request and Review Procedure

PRO-002 — Joiner, Mover and Leaver Procedure

PRO-003 — Incident Handling Procedure

PRO-004 — Personal Data Breach Notification Procedure

PRO-005 — Change Management Procedure

PRO-006 — Vulnerability and Patch Management Procedure

PRO-007 — Backup and Restore Procedure

PRO-008 — Supplier Onboarding and Review Procedure

PRO-009 — Data Subject Request Handling Procedure

PRO-010 — Internal Audit and Management Review Procedure

PRO-011 — Security Awareness and Training Procedure

PRO-012 — Physical Access and Visitor Management Procedure

10.1 — Continual improvement

10.2 — Nonconformity and corrective action

4.1 — Understanding the organisation and its context

4.2 — Understanding the needs and expectations of interested parties

4.3 — Determining the scope of the information security management system

4.4 — Information security management system

5.1 — Leadership and commitment

5.2 — Policy

5.3 — Organisational roles, responsibilities and authorities

6.1.1 — Actions to address risks and opportunities - general

6.1.2 — Information security risk assessment

6.1.3 — Information security risk treatment

6.2 — Information security objectives and planning to achieve them

6.3 — Planning of changes

7.1 — Resources

7.2 — Competence

7.3 — Awareness

7.4 — Communication

7.5.1 — Documented information - general

7.5.2 — Creating and updating documented information

7.5.3 — Control of documented information

8.1 — Operational planning and control

8.2 — Information security risk assessment (operational)

8.3 — Information security risk treatment (operational)

9.1 — Monitoring, measurement, analysis and evaluation

9.2.1 — Internal audit - general

9.2.2 — Internal audit programme

9.3.1 — Management review - general

9.3.2 — Management review inputs

9.3.3 — Management review results

A.5.1 — Policies for information security

A.5.10 — Acceptable use of information and other associated assets

A.5.11 — Return of assets

A.5.12 — Classification of information

A.5.13 — Labelling of information

A.5.14 — Information transfer

A.5.15 — Access control

A.5.16 — Identity management

A.5.17 — Authentication information

A.5.18 — Access rights

A.5.19 — Information security in supplier relationships

A.5.2 — Information security roles and responsibilities

A.5.20 — Addressing information security within supplier agreements

A.5.21 — Managing information security in the ICT supply chain

A.5.22 — Monitoring, review and change management of supplier services

A.5.23 — Information security for use of cloud services

A.5.24 — Information security incident management planning and preparation

A.5.25 — Assessment and decision on information security events

A.5.26 — Response to information security incidents

A.5.27 — Learning from information security incidents

A.5.28 — Collection of evidence

A.5.29 — Information security during disruption

A.5.3 — Segregation of duties

A.5.30 — ICT readiness for business continuity

A.5.31 — Legal, statutory, regulatory and contractual requirements

A.5.33 — Protection of records

A.5.34 — Privacy and protection of PII

A.5.35 — Independent review of information security

A.5.36 — Compliance with policies, rules and standards for information security

A.5.37 — Documented operating procedures

A.5.4 — Management responsibilities

A.5.5 — Contact with authorities

A.5.7 — Threat intelligence

A.5.8 — Information security in project management

A.5.9 — Inventory of information and other associated assets

A.6.1 — Screening

A.6.2 — Terms and conditions of employment

A.6.3 — Information security awareness, education and training

A.6.4 — Disciplinary process

A.6.5 — Responsibilities after termination or change of employment

A.6.6 — Confidentiality or non-disclosure agreements

A.6.7 — Remote working

A.6.8 — Information security event reporting

A.7.1 — Physical security perimeters

A.7.10 — Storage media

A.7.11 — Supporting utilities

A.7.12 — Cabling security

A.7.14 — Secure disposal or re-use of equipment

A.7.2 — Physical entry

A.7.3 — Securing offices, rooms and facilities

A.7.4 — Physical security monitoring

A.7.5 — Protecting against physical and environmental threats

A.7.6 — Working in secure areas

A.7.7 — Clear desk and clear screen

A.7.8 — Equipment siting and protection

A.7.9 — Security of assets off-premises

A.8.1 — User end point devices

A.8.10 — Information deletion

A.8.11 — Data masking

A.8.12 — Data leakage prevention

A.8.13 — Information backup

A.8.14 — Redundancy of information processing facilities

A.8.15 — Logging

A.8.16 — Monitoring activities

A.8.17 — Clock synchronization

A.8.19 — Installation of software on operational systems

A.8.2 — Privileged access rights

A.8.20 — Networks security

A.8.21 — Security of network services

A.8.22 — Segregation of networks

A.8.23 — Web filtering

A.8.24 — Use of cryptography

A.8.25 — Secure development life cycle

A.8.26 — Application security requirements

A.8.27 — Secure system architecture and engineering principles

A.8.28 — Secure coding

A.8.29 — Security testing in development and acceptance

A.8.3 — Information access restriction

A.8.30 — Outsourced development

A.8.31 — Separation of development, test and production environments

A.8.32 — Change management

A.8.33 — Test information

A.8.4 — Access to source code

A.8.5 — Secure authentication

A.8.6 — Capacity management

A.8.7 — Protection against malware

A.8.8 — Management of technical vulnerabilities

A.8.9 — Configuration management

Art. 12 — Transparent communication and exercising rights

Art. 13-14 — Information to be provided to data subjects

Art. 15 — Right of access

Art. 16 — Right to rectification

Art. 17 — Right to erasure ('right to be forgotten')

Art. 18 — Right to restriction of processing

Art. 19 — Notify recipients of rectification, erasure, or restriction

Art. 20 — Right to data portability

Art. 21 — Right to object

Art. 22 — Automated individual decision-making, including profiling

Art. 24 — Responsibility of the controller (accountability)

Art. 25 — Data protection by design and by default

Art. 27 — Representative in the Union

Art. 28 — Processor contracts

Art. 30 — Records of processing activities

Art. 32 — Security of processing

Art. 33 — Notification of a personal data breach to the supervisory authority

Art. 34 — Communication of a personal data breach to the data subject

Art. 35 — Data protection impact assessment (DPIA)

Art. 37-39 — Data protection officer (DPO)

Art. 5(1)(a) — Lawfulness, fairness and transparency

Art. 5(1)(b) — Purpose limitation

Art. 5(1)(c) — Data minimisation

Art. 5(1)(d) — Accuracy

Art. 5(1)(e) — Storage limitation

Art. 5(1)(f) — Integrity and confidentiality

Art. 6 — Lawfulness of processing

Art. 7-8 — Conditions for consent

CIR 2024/2690 Annex 1 — Security policy and responsibilities

CIR 2024/2690 Annex 10 — Personnel security

CIR 2024/2690 Annex 11 — Access rights, privileged accounts and authentication

CIR 2024/2690 Annex 12 — Asset classification, handling and inventory

CIR 2024/2690 Annex 13 — Utilities, environmental threats and physical access

CIR 2024/2690 Annex 2 — Risk management, compliance monitoring and independent review

CIR 2024/2690 Annex 3 — Incident handling, monitoring and logging

CIR 2024/2690 Annex 4 — Continuity plan, backups and crisis management

CIR 2024/2690 Annex 5 — Supply chain policy and supplier register

CIR 2024/2690 Annex 6 — Secure acquisition, development and maintenance

CIR 2024/2690 Annex 7 — Measuring the effectiveness of security measures

CIR 2024/2690 Annex 8 — Awareness and security training

CIR 2024/2690 Annex 9 — Cryptography policy and key management

Ch. V — International transfers of personal data

Cyberbeveiligingsbesluit art. 10 — Supply chain security

Cyberbeveiligingsbesluit art. 11 — Secure acquisition, development and maintenance

Cyberbeveiligingsbesluit art. 12 — Cyber hygiene and training

Cyberbeveiligingsbesluit art. 13 — Cryptography policy

Cyberbeveiligingsbesluit art. 15 — Access policy

Cyberbeveiligingsbesluit art. 16 — Asset management

Cyberbeveiligingsbesluit art. 6 — Security policy and responsibilities

Cyberbeveiligingsbesluit art. 7 — Risk management policy

Cyberbeveiligingsbesluit art. 8 — Incident handling and logging

Cyberbeveiligingsbesluit art. 9 — Business continuity and crisis management

Cyberbeveiligingswet art. 21 — Duty of care

Cyberbeveiligingswet art. 24 — Board approval and training

Cyberbeveiligingswet art. 25 — Duty to report significant incidents

Cyberbeveiligingswet art. 26 — Early warning within 24 hours

Cyberbeveiligingswet art. 27 — Notification within 72 hours

Cyberbeveiligingswet art. 28 — Interim report

Cyberbeveiligingswet art. 29 — Progress report and final report

Cyberbeveiligingswet art. 30 — Informing the recipients of your services

Cyberbeveiligingswet art. 44 — Registration in the national register

RSK-001 — Ransomware on the managed hosting platform

RSK-002 — Compromise of the remote management platform

RSK-003 — Loss of customer backup data in a data centre failure

RSK-004 — Privileged credential theft from an engineer laptop

RSK-005 — Phishing of service desk staff leading to access to a customer tenant

RSK-006 — Misconfigured customer firewall exposes an internal service

RSK-007 — Unauthorised access to the privileged credential vault

RSK-008 — Failure of a colocation provider

RSK-009 — Power or cooling failure in a data centre

RSK-010 — One engineer holds the knowledge of a customer platform

RSK-011 — Departing employee keeps access to customer systems

RSK-012 — Late patching of customer endpoints

RSK-013 — Personal data in service desk tickets is handled carelessly

RSK-014 — A personal data breach is not reported within 72 hours

RSK-015 — SLA penalties after repeated incidents at one customer

RSK-016 — Stage 2 audit finds a major nonconformity

RSK-017 — A sub-processor changes without notice to customers

RSK-018 — Theft or loss of a field engineer laptop

RSK-019 — Unmanaged devices on the office network

RSK-020 — Physical intrusion at a data centre

RSK-021 — Incident reporting duties under the Cbw are not met

RSK-022 — Insufficient monitoring coverage on customer networks

RSK-023 — Customer data is not removed when a contract ends

RSK-024 — Unpatched firmware on network equipment

RSK-025 — Outage of the Microsoft 365 service

RSK-026 — Excessive administrator rights on internal systems

RSK-027 — Data loss during a customer migration project

RSK-028 — Disruption during the move to the Utrecht office

RSK-029 — Legacy hosting platform without vendor support

RSK-030 — Misuse of customer data by staff

ROL-001 — ISMS Manager

ROL-002 — Internal Auditor

ROL-003 — Data Protection Officer

ROL-004 — Service Desk Lead

ROL-005 — Change Manager

ROL-006 — Incident Coordinator

ROL-007 — Supplier Manager

ROL-008 — HR Lead

ROL-009 — Facilities Lead

ROL-010 — Management Board

ISMS scope

SUP-001 — Microsoft 365

SUP-002 — Amazon Web Services

SUP-003 — Cisco

SUP-004 — Dell Technologies

SUP-005 — Veeam

SUP-006 — Fortinet

SUP-007 — CrowdStrike

SUP-008 — Atlassian

SUP-009 — KPN

SUP-010 — TeamViewer

SUP-011 — Nordwave Colocation

SUP-012 — Brightspan Datacenters

SUP-013 — Harbourlight Offsite Backup

SUP-014 — Blackharbor Security

SUP-015 — Norland Certification

SUP-016 — Quillstone Legal

SUP-017 — Loonwerk Payroll Services

SUP-018 — Meridian Cyber Insurance

SUP-019 — Coreline Remote Monitoring

SUP-020 — Freshfield Cleaning

VUL-001 — Remote code execution in the remote management agent

VUL-002 — Outdated firmware on the perimeter firewall pair

VUL-003 — Backup server admin interface reachable from the customer network

VUL-004 — Injection flaw in the legacy hosting control panel

VUL-005 — No rate limit on the single sign-on login

VUL-006 — Old management protocol on the data centre power distribution units

VUL-007 — Weak cipher suites on the customer VPN gateway

VUL-008 — Hypervisor management network not separated from the office network

VUL-009 — Shared mailbox password stored in a wiki page

VUL-010 — Reported unsupported plugin version in the ticketing system

VUL-011 — Hypervisor hosts missing two months of patches

VUL-012 — Self-signed certificate on an internal monitoring dashboard

Edit TSK-1023

Are you sure?

Leave this page?