Information security for dry feet
Safe information systems and safe industrial systems at the Dutch water boards, such as flood defenses, measuring equipment and water treatment plants are crucial to our society. Prolonged droughts and heavy rainfall demonstrate time and again how dependent the Netherlands is on well-managed water management. The water boards play a crucial role in this and information security must be in order.
In 2013, the 21 Water Boards and the Waterschapshuis in the Netherlands started implementing the Baseline on Information Security for Water Boards (BIWA). Each Water Board (as well as Waterschapshuis) has its own responsibility to comply with BIWA standards. Each Water Board has been implementing BIWA since 2013, either individually or in (regional) cooperation with other Water Boards. Information security is a responsibility of the individual Water Boards, but there is a common interest in basic security in all regions. All Water Boards and the Waterschapshuis have conducted a baseline measurement (GAP analysis) of the state of Information Security and have adopted an Information Security Policy. A characteristic feature of the Water Boards is that in addition to office automation, these organizations also have industrial systems within the IT landscape.
All Dutch Water Boards and the Waterschapshuis (HWH) have set themselves the goal of having themselves tested externally against the security measures derived from the Baseline Information Security for Water Boards (BIWA). This assessment is not a goal in itself, but should enable the line management of the water boards and HWH to take targeted measures in the Plan-Do-Check-Act (PDCA) cycle to increase the security of the processes, applications and systems. This is a growth path, in which the security level is raised to the desired level in steps that are manageable for management. In carrying out this audit, the PDCA cycle of the Water Boards and HWH was taken into account and the audit approach was partly geared to this.
Within each water board and HWH, Highberg its audit team worked with the water board in 2017 to prepare, conduct this audit and deliver the audit report for it. Each organization carried out the necessary preparations based on two questionnaires. Based on this, Highberg conducted document studies and prepared the audit interviews. The audit interviews took place with various representatives from each organization. On the basis of this document study and audit interviews, the audit findings and recommendations were formulated, and the final audit report was drawn up.
For each water board (including HWH), Highberg prepared an audit report documenting the findings and conclusions with respect to the management system and security measures.
________________________________________
Would you like to know more about this case? If so, please contact Joep Janssen.
