Review risk: Incident reporting duties under the Cbw are not met

The Cyberbeveiligingswet requires an early warning within 24 hours of a significant incident and a notification within 72 hours. As a managed service provider Tidewell IT must be able to judge and report in that time, also at night and over a weekend.

Measures

The Incident Coordinator keeps a decision tree for what counts as significant and a prepared notification form for the national authority. The on-call rota names a deputy for every shift.