General Data Protection Regulation (EU-GDPR)

G. Non-disclosure agreement
Requirements for confidentiality or for a non-disclosure agreement reflecting the organisation’ s needs for the protection of information will be established and assessed regularly.
The following points of concern apply to the requirements set for the confidentiality agreement and the non-disclosure agreement:

1. the definition of the information that must be secured (for example, confidential information);
2. the expected term of a confidentiality or non-disclosure agreement, including cases where the confidentiality may be subject to restrictions;
3. actions needed at the end of the agreement;
4. responsibilities and actions of the signatories to prevent unauthorised publication of information;
5. ownership of the information, intellectual property and the connection thereof with the protection of the confidential information;
6. authorised use of confidential information and the rights of the signatory to use information;
7. right to audit activities and to inspect where any confidential Information may be involved;
8. process for notification an reporting of unauthorised disclosure or infringement of  confidential information;
9. conditions on which the information must be returned or destroyed at the end of the agreement; and anticipated actions to be taken in the event of a breach of the provisions of the agreement.

H. Assessment of the information security policy
The organisation’s approach to the management of information security and the implementation thereof (i.e. management objectives, management measures, policy, processes and procedures for information security) need to be independent and assessed at appropriate intervals or once changes occur in the implementation of the security.

1. 1. The information security policy will be evaluated at least once every three years (by an independent expert) and will be adjusted if required.
   2. Periodic self-evaluations will be executed by order of the line management.
   3. Annually, in accordance with the P&C cycle, the board will be given a report of the functioning of the information security.

I. Identification of risks relating to external parties
The risk the organisation’s information and ICT facilities are exposed to from the business processes involving external parties must be identified and suitable management measures need to be implemented before granting access.

1. 1. Information security is demonstrably considered (based on a risk assessment) when deciding whether or not to engage the external party.
   2. It has been determined, prior to entering into a contract for outsourcing or hiring of external staff, what kind of access (physical, network or to data) external parties will need have to perform the assignment as agreed upon in the contract and the necessary security measures involved therein.
   3. It has been determined, prior to entering into a contract for outsourcing or hiring of external staff, what kind of value or sensitivity the information has the third party may come into contact with and whether additional security measures may be necessary.
   4. It has been determined, prior to entering into a contract for outsourcing or hiring of external staff, how authenticated or authorised access will be determined.
   5. If the external parties manage systems in which personal data are being processed, a Processing Agreement will be entered into (in conformity with 28 of the GDPR).
   6. In the contract with the external parties the security measures  to be provided have been laid down, that the external party has taken these measures and complies with them, and that security incidents will be reported without delay (also see 6.2.3.3)
      It is also described how these security measures will have to be inspected by the external party (e.g. by audits or penetration tests) and the way in which the supervision has been arranged for.
   7. Annually it will be reported how the external party complies with the arrangements.

J. Dealing with security in agreements of LiteServer with a third party (sub-processor)
In agreements with third parties including access to, processing of, communication or management of information or of ICF facilities or addition of products or services to the ICT facilities, the relevant security requirement will have to be included.

1. 1. The measures forming a part of 6.2.1. have been defined and implemented prior to entering into the contract.
   2. Outsourcing (development and adaptation) of software  is organised in line with formal contracts in which inter alia intellectual property, quality aspects, security aspects, liability, escrow and reviews have been regulated.
   3. It has been laid down in contracts with external parties how to deal with changes and how to prevent the security of being affected by the changes.
   4. In contracts with external parties it has been laid down how to deal with confidentiality and the non-disclosure agreement.
   5. There is a plan for termination of the hired services that addresses availability, confidentiality and integrity.
   6. It has been laid down in contracts with external parties how escalations and liability have been arranged for.
   7. When using sub-contractors the same security requirements apply as for the contracting party. The main contractor is responsible for ensuring agreements made with the sub-contractor.
   8. The products, services and the preconditions applying, reports and registrations delivered by a third party, will be assessed in terms of compliance with the arrangements in the agreement. Improvement actions will be initiated when performances are under the agreed level.

K. Measures for networks
Networks are to be managed and controlled adequately to secure them against threats and to maintain security for the systems and applications using the network, including information which is transported.

1. 1. The network is monitored and managed, so attacks, malfunctions or failures will be discovered and remedied and the network’s integrity will not get lower than the agreed minimum level.
   2. Exchange of data between trusted and non-trusted zones must be checked in an automated manner as regards content for the presence of malware.
   3. When transporting confidential Information through non-trusted networks, such as the Internet, a suitable encryption must be used. See 12.3.1.3.
   4. There are procedures for remote management of equipment.

L. Monitoring  system utilisation
Procedures need to be laid down for monitoring the use of the ICT facilities. The result of the monitoring activities will have to assessed regularly.

1. 1. 1. In either case the following events will be included in the logging:
         1. usage of the technical management functions, such as changes of configuration or setting, implementation of a system command, starting and stopping, implementation of a backup or restore.
         2. usage of the technical management functions, such as changes of configuration or setting, release of new functionality, interventions in data sets (including databases).
         3. proceedings of security management, such as import and export of users, granting and withdrawing rights, password reset, issuance and withdrawal of  crypto keys.
         4. security incidents (such as the presence of malware, testing for vulnerabilities or weaknesses, erroneous login attempts, exceedance of authorisation powers, refused attempts to gain access, use of non-operational system services, starting and stopping the security services).
         5. disruptions of the production process (such as queues filling up, system failures, abort during the execution of the software, non-availability of the invoked programme parts or systems).
         6. actions of users, such as good and bad login attempts, system access, use of on-line transactions and system administrators accessing files.

M. Protection of information in log files
Log facilities and information in log files need be protected against infringement and unauthorised access.

1. 1. Overwriting (automatically) or deleting  log files will be logged in the newly built log.
   2. The consultation of log files is restricted to authorised users. Hereby access is limited to read-only permission.
   3. Log files are protected in such a way that they cannot be adapted nor manipulated.
   4. The settings of the log mechanisms are protected in such a way that they cannot be adapted nor manipulated. If the settings will have to be adapted, this will always be subject to a four eyes principle.
   5. The availability of log information is ensured within the term in which the log analysis is deemed necessary, with a minimum of three months, in accordance with the wishes of the system owner. In the event of a (presumed) information security incident the retention period will be at least three years.
   6. Monitoring of storage and logging: the filling of the storage medium for the log files above a certain limit will be logged and leads to automatic alerts of the management organisation. This also applies if retention of log data is not (or no longer) possible (e.g. a logging server not being accessible).

N. Integrity of messages
There are requirements to be determined and appropriate management measures to be adopted and implemented for the achievement of authenticity and the protection of the integrity of messages in applications.

O. Policy for the use of cryptographic management measures
A policy will have to be developed and implemented for the use of cryptographic management measures for the protection of information.

1. 1. 1. The cryptographic algorithms used for encryption are documented as open standard and have been tested by independent reliable experts.
      2. When using cryptographic products an assessment of the risks associated with locations, processes, and attending parties will follow.
      3. The cryptographic security services and components comply with generally accepted security criteria (such as FIPS 140-2 and, where possible, the [Dutch] National Communications Security Agency [NBV]).

P. Key Management
Key management needs to be adopted to support the use of cryptographic techniques within the organisation.

1. 1. In the key management attention has been paid to the process, the actors and their responsibilities at least.
   2. The period of validity of cryptographic keys is determined on the basis of the intended use and is laid down in the cryptographic policy.
   3. The confidentiality of cryptographic keys must be ensured during generation, use, transport and storage of the keys.
   4. A procedure has been laid down in which it is determined how to deal with compromised keys.

Q. Management of operational software
Procedures will have to be determined to manage the  installation of software on production systems.

• Only authorised personnel may install or activate features and software.
• Only following a successful test and acceptance may software be installed on a production environment.
• Installed software, configurations and documentation are kept in a configuration database.
• Only (versions of) software maintained by the supplier will be used.
• A log will be kept of updates.
• There will be a rollback strategy.

R. Change management procedures
The implementation of changes will be subject to formal change control procedures.

1. 1. Change management has been demonstrably set up  in accordance with current best practices such as ITIL and ASL for applications.

S. Technical assessment of applications after changes in the operating system
In case of changes in operating systems, business-critical applications need to be assessed and tested to ensure that the activities or security of the organisation will not be adversely affected.  

1. 1. Of adjustments (such as updates) to software components of the technical infrastructure it is established that these will not endanger the correct functionality of the technical components.

T. Control of technical vulnerabilities
Information must be obtained in a timely manner on the technical vulnerabilities of the information systems used. The extent to which the organisation is exposed to such vulnerabilities must be evaluated and proper measures will have to be taken for the handling of the associated risks.

1. 1. There is a process for the management of technical vulnerabilities; this shall include, as a minimum, reporting of incidents to the Information Security Service for municipalities, periodic penetration tests, risk analyses of vulnerabilities and patching.
   2. Of the software facilities of the technical infrastructure there may be (preferably automated) check-ups whether the last updates (patches) have been implemented. Implementation of updates will not take place automated, unless specific arrangements have been made in this regard with the supplier.
   3. If a patch is available, the risks involved with its installation must be evaluated (the risks connected to the vulnerability need to be compared with the risks of the installation of the patch).
   4. Updates/patches for vulnerabilities with a potential high risk of misuse and extensive damage will be implemented as soon as possible, though within one week. Less critical security updates/patched will have to be scheduled for the next maintenance round.
   5. If there is still no patch available, actions must be taken in accordance with the opinion of a Computer Emergency Response Team (CERT), e.g. the Dutch National Cyber Security Centre (NCSC).

U. Collecting evidence
In the event a follow-up proceeding including legal measures (either under civil law or criminal law) is initiated against a person or organisation after an information security incident, evidence will be collected, preserved and presented in accordance with the requirements for proof applying to the relevant legal area.

1. 1. In support of a follow-up procedure resulting from a security incident evidence needs to be  collected, preserved and presented in accordance with the requirements for proof applying to the relevant legal area.

V. Compliance with security policies and standards
To achieve compliance with security policies and standards, Line Managers need to ensure that all security procedures within their area of responsibility will be properly implemented.

1. 1. The line management is responsible for the implementation and the security procedures and the testing accordingly  (e.g. annually in control statement). In accordance with our strategic Baseline Policy, the Head of Legal & Security will, on behalf of the board, ensure supervision of the implementation of the security policy. This also includes periodical security self-evaluations, which may be performed by or on behalf of the Head Legal & Security or by internal of external audit teams.
   2. In the P&C cycle reports are produced on information security based on the in control statement.

W. Testing technical compliance

Information systems will have to be tested regularly for compliance with implementation of security standards.

1. Information systems will have to be tested regularly for compliance with security standards. This may be facilitated e.g. by vulnerability analysis and penetration tests.