Customer announces a security audit, what do I supply?
Standard kit: ISO or NEN certificate (if any), DPA, recent pen test or vulnerability scan, information-security policy, BCM plan, and evidence of backup-and-restore tests.
Try this first
- 1Ask for scope. "Security audit" is broad; request the exact questionnaire (often custom, sometimes SIG/CAIQ).
- 2Collect existing artefacts. Certificates, DPA, sub-processor list, security policy, incident response plan, backup procedure, vulnerability report.
- 3For gaps, prepare an honest status plus timeline. "ISO 27001 in progress, audit Q3" beats implying something that does not exist.
- 4Designate a point of contact for the audit. Not the whole organisation needs access to the Q&A.
- 5Keep your own log of what you delivered and when. It saves days at the next audit.
When to bring us in
Deep audit with on-site visits or pen-testing rights, and you have never done one? An experienced auditor or consultant in advance is good money.
See also
- Does NIS2 apply to my company?Two questions decide it: are you in a listed sector, and do you meet the threshold from Recommendation 2003/361/EC (more than 50 FTE and more than EUR 10M turnover or balance sheet). Below that you are only indirectly in scope, via your customers. The threshold determines whether you are an important or essential entity depending on sector.
- What changes with the Dutch Cyber Security Act?The Cyberbeveiligingswet is the Dutch implementation of NIS2. Track NCSC for the exact effective date and the lower regulations.
- Am I personally liable as a director under NIS2?Yes. The board is accountable for approving and overseeing the cyber measures. Severe negligence can become personal.
None of the above fits?
Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.
Or skip the DIY entirely
Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.