7. Support
7.1 Resources
Section titled “7.1 Resources”- Every software developer spends 5 to 10% of their time on security issues. The budget for this comes from the SLA agreements with customers.
- The ISMS security meeting is a fixed moment in which the people with security roles go through the ISMS: new and open risks, the objectives, incidents and non-conformities, security news, and whether everyone still has enough time for their security work. It runs monthly until the first certification audit and quarterly after that, as a recurring task whose issue holds the minutes.
- The yearly budget includes the external internal auditor and the certification body.
7.2 Competence
Section titled “7.2 Competence”- The roles table lists the competence each role needs, based on education or experience.
- Each role holder has a profile, such as a LinkedIn page, that shows they have that competence.
- Where a role holder lacks a competence, the Information Security Officer plans training or coaching and records it in an issue.
7.3 Awareness
Section titled “7.3 Awareness”- New employees read the security pages and this ISMS section during onboarding and confirm that in their onboarding issue. The management statement explains why it matters.
- Every ISMS security meeting has a news round: what everyone saw in the news on security and privacy, and what it means for us.
- Security changes that affect everyone are announced in the relevant Mattermost channels and in the daily scrum.
7.4 Communication
Section titled “7.4 Communication”| What | When | With whom | How |
|---|---|---|---|
| Security obligations of both sides | At contract start and renewal | Customers | Contracts and SLAs |
| Security information for users | Always available | Customers and their users | Product support pages |
| Incidents that affect customers | As agreed in the SLA | Customers | E-mail, calls |
| Personal data breaches | Within 72 hours | Autoriteit Persoonsgegevens | Their notification form |
| Policies and changes to them | When they change | Employees | Handbook, announced in Mattermost |
| Status of the ISMS | Every ISMS security meeting | Security role holders | Meeting issue |
| Performance of the ISMS | Yearly | Management | Management review |
7.5 Documented information
Section titled “7.5 Documented information”- The ISMS is documented in this handbook and in GitLab. GitLab provides access control and the full history of every change.
- Every change to the handbook goes through a merge request that someone else reviews and approves. The published handbook, built from the main branch, is the version in force.
- Records (risks, objectives, recurring tasks with their minutes, audit reports, non-conformities) are GitLab issues that only employees can read.
- Records are kept for at least three years, one certification cycle. After that they stay in GitLab, except personal data that is no longer needed, which is deleted.
- Documents of external origin that the ISMS needs, such as the ISO standard and signed contracts, are kept in Nextcloud.