Ketenpas
NederlandsWhat is Ketenpas?

This is an example. The company on this page is made up. This is what the Ketenpas looks like that you send to your customer instead of filling in their questionnaire; your own passport carries your name, scores and branding.

Start with the free scan

Security Passport

Voorbeeld Installatietechniek B.V.

Elektrotechniek en klimaatinstallaties voor zorg en industrie

Good

This organisation has assessed its information security against the ten measures from article 21 of the NIS2 directive, the basis of the Dutch Cybersecurity Act.

27 of the 39 measures are in order.

Assessed on
14 October 2026
Valid until
14 October 2027
Basis
NIS2 article 21, 39 points

Measures per topic

Below is what this organisation has put in place, per topic.

  • Risk analysis and security policy

    90%
    • Is there an information security policy that the board has formally adoptedevidencedA.5.1
    • Have you carried out a risk assessment in the past twelve months6.1.2
    • Is it recorded who in your organisation is ultimately responsible for cybersecurityA.5.2

  • Incident handling

    90%
    • Is there a written procedure for what you do during a cyber incidentevidencedA.5.24A.5.26
    • Do your staff know who to report a suspicious message or incident toA.6.8
    • Can you report a serious incident to your customers and the CSIRT within 24 hoursA.5.5A.5.26

  • Business continuity and backups

    91%
    • Are backups of all your business-critical data made automaticallyevidencedA.8.13
    • Is at least one backup kept out of reach of your networkA.8.13
    • Have you tested in the past year that restoring from backup actually worksevidencedA.8.13A.5.30

  • Supply chain security

    67%
    • Do you have an overview of your IT suppliers and the access they haveA.5.19A.5.21
    • Do the contracts with your main suppliers contain security agreementsA.5.20

  • Procurement, development and maintenance

    90%
    • Are updates and security patches installed structurally and on timeevidencedA.8.8
    • Do you know which devices and software are on your networkA.5.9
    • Are you still running software or equipment that no longer receives updatesA.8.8

  • Testing effectiveness

    60%
    • Do you periodically test whether your security measures actually workA.5.36

  • Cyber hygiene and training

    94%
    • Do all staff receive awareness training at least once a yearevidencedA.6.3
    • Are there clear rules on passwords, working from home and personal useA.5.10A.6.7
    • Does the board follow cybersecurity training as wellA.6.3A.5.4

  • Cryptography and encryption

    100%
    • Are laptops and mobile devices encryptedevidencedA.8.1A.8.24
    • Is data sent over encrypted connectionsA.5.14A.8.24
    • Are your backups stored encryptedA.8.13A.8.24

  • Personnel, access control and assets

    78%
    • Do staff only have access to what they need for their workA.5.15A.5.18
    • Is access withdrawn immediately when someone leavesevidencedA.5.18A.6.5
    • Do you have an overview of company assets and who is using themA.5.9A.5.11

  • Multi-factor authentication and secure communication

    91%
    • Is multi-factor authentication mandatory on email and on every system reachable from the internetevidencedA.8.5
    • Do administrators use MFA and separate admin accountsA.8.2A.8.5
    • Is remote access protected with multi-factor authenticationA.8.5A.6.7

About this passport

This overview is based on self-reporting by the organisation itself. It is not a certification and not an audit, and Ketenpas has not verified the answers. If you want certainty on a specific point, ask for underlying evidence.

For 9 of the 27 confirmed measures, this organisation has recorded underlying evidence, such as a policy or a test report. Those documents are deliberately not on this page; request them from the organisation itself.

Open points are not shown here. A shareable page naming exactly which security is missing would show an attacker the way. The score and the count out of 39 measures indicate how much is still to do.

The numbers next to the measures refer to the corresponding controls in ISO 27001:2022; A. points to Annex A, numbers without A. to the main body of the standard. The reference shows alignment with the standard and is not a certification.

Questions about this passport? Voorbeeld Installatietechniek B.V., ICT

Assessing suppliers yourself?

This passport covers one supplier. With the Ketenpas supply chain register you invite all your suppliers and see in one overview whose security is in order, ready to demonstrate. It is free for up to three suppliers.

See the supply chain register