Insights on ISO certification, NIS2, EU regulation and audit readiness in the Netherlands. Practical analysis for leadership, IT and compliance teams — educational, not legal advice.
We cover regulatory changes, audit trends and what organisations can do in practice. Each article links to topics in our knowledge base — from vendor management to processor agreements.
Free tool: Vendor & processor document generator — GDPR, ISO 27001, NIS2, DORA and more; fill in and print as PDF.
For operational ISMS work see ISO Ready. Sources: sources & linking.
Browse the articles below for the latest posts. Combine news with guides on ISO 27001 certification and NIS2 in the knowledge base.
Management review is not a meeting without minutes. Which input, decisions and KPIs belong — and what must not be missing?
Read article: ISO 27001 management review: content auditors expect in 2026 →
Management review is not a meeting without minutes. Which input, decisions and KPIs belong — and what must not be missing?
Read article: ISO 27001 management review: content auditors expect in 2026 →
Supply-chain risk is not a forgotten spreadsheet. How to prioritise vendors, contracts and evidence for supervisors and enterprise customers?
Read article: Vendor risk under NIS2 and DORA: one register, two frameworks →
Backup alone is not enough — restore must be tested and ransomware must not encrypt backups. Practical SME approach.
Read article: Immutable backups in 2026: what auditors and insurers require →
US customers ask for SOC 2; European chains ISO 27001. How to choose — or combine — without duplicate audit work?
Read article: SOC 2 vs ISO 27001 in 2026: what SME customers really ask for →
Privacy and security belong in one management system. How to avoid duplicate documentation and satisfy GDPR and audit?
Read article: ISO 27701 alongside ISO 27001: privacy in the same ISMS →
Awareness is more than annual e-learning. How to link behaviour, phishing tests and management review to ISO 27001?
Read article: Security awareness for SMEs: measurable and audit-ready in 2026 →
Privileged access and orphaned accounts are surveillance favourites. How to organise reviews per cloud app with an auditable trail.
Read article: Access reviews in SaaS: quarterly rhythm without Excel chaos →
Ransomware remains the dominant threat for Dutch SMEs. What belongs in your playbook — and what do auditors and customers want to see?
Read article: Ransomware playbook for SMEs: first hours and audit evidence →
Internal audit is not a paper exercise. How to choose samples, train auditors and deliver evidence certification bodies accept.
Read article: ISO 27001 internal audit in 2026: planning that prepares surveillance →
Essential and important entities must report incidents on time. How to organise triage, chain communication and documentation without panic?
Read article: NIS2 incident notification: practical timelines and evidence in 2026 →
CIS is practical for technical teams; ISO for the management system. How to avoid duplicate documentation.
Read article: CIS Controls alongside ISO 27001: when it helps — and when it does not →