Biztory Security & Compliance Hub

Biztory's complete information security document library — NIS2 compliant, updated July 2026

38 documents 11 domains NIS2 Article 21 Cronos/Xplore Group framework

Search in Drive

View all documents in Google Drive

No documents match ""

Try searching in Drive for full-text results

Governance

IS Policy — Scope

Scope, objectives, and NIS2 obligations of Biztory's IS programme

IS Roles & Responsibilities

Full RACI matrix — ISO (Tom), BCP Commander, GDPR Lead, Tech Lead, Asset Owners

IS Risk Assessment

Threat landscape, likelihood/impact scoring, priority risks — initial assessment

IS Risk Treatment Plan

Accepted, mitigated, and transferred risks with owners and resolution dates

Incident Management

Security Incident Management — Introduction

Incident classification, response steps, escalation paths, NIS2 reporting deadlines

Incident Report Form

Google Form for staff to report security incidents — responses auto-logged to register

Identity, Access & Assets

Code of Conduct v2 + Authentication

Binding IS rules for all staff — devices, accounts, passwords, AI tools, incident reporting

Password Policy

Password requirements, MFA rules, credential management and sharing prohibitions

Access Control Ownership Register

Maps every system to its data owner; governs n8n access provisioning and offboarding

CRUD Access Matrix

Role-by-system permission matrix defining Create/Read/Update/Delete rights per role

Asset Prioritisation Register

Critical assets ranked by business impact and recovery priority

System White- & Blacklist

Approved and prohibited applications and SaaS tools across all Biztory entities

Software Approval Process

How to request, evaluate, and approve new software; shadow IT policy

Data Leakage Detection & Prevention

DLP controls, monitoring approach, and incident response for data leakage events

Secure Disposal — Mobile Devices

Wiping standards, certificate requirements, and GDPR-compliant disposal procedures

InTune & Microsoft Defender Guide

Internal setup guide for device management and endpoint protection tooling

Mobile Device & Hardware Inventory

Regional hardware inventories (BE/NL/UK/DE), asset owners, onboarding & offboarding process

Data Flows & GDPR

Data Flows — Customer

All software tools processing client data (Snowflake, Fivetran, Tableau, HubSpot, GCP, n8n…) with privacy policy links

Data Flows — Internal

All software tools processing employee and candidate data (Workable, Slack, Google Workspace, Smartsheet…) with privacy policy links

Physical Security & Awareness

Office Spaces & Security

Clean desk, visitor management, physical access controls per office location

CoC — Use of Physical Assets

Rules for handling company-owned hardware, screens, and physical media

Social Engineering Dangers

Phishing, vishing, pretexting — awareness guide with real examples and red flags

People & HR Security

Data Handling Best Practices

Classification, approved storage, client data rules, AI tool limits, retention schedule, GDPR

Vulnerabilities & the Importance of Patches

Patch deadlines by severity (critical 48h), Dependabot, SaaS vulnerability handling

Data & Secure Locations — Guidelines

Where to store what, approved cloud locations, on-premises vs. remote rules

CoC — Disciplinary Actions

Consequences of IS policy violations — warnings, escalation to management, dismissal

Operational Security

Logging of Critical Systems

What to log, where, retention periods, and alerting thresholds per system category

Impact of People Change

Security considerations when roles change — joiners, movers, leavers, contractor offboarding

Project Onboarding & Offboarding

Access provisioning and revocation process when staff join or leave a client project

IS Risk Analysis

Operational risk analysis for ongoing projects and system changes

Business Continuity & Disaster Recovery

Business Continuity Plan 2026

Full BCP — incident response, escalation trees, communication plan, recovery procedures

RTO & RPO per Asset

Recovery time and recovery point objectives per critical system and data category

Critical Information on Secondary Platform

What to back up where, secondary platform requirements, offline storage rules

Capacity Monitoring & Alerting

Thresholds, tooling, and alert routing for infrastructure capacity and availability

Cryptography

Cryptography Policy

Approved algorithms, key management, certificate lifecycle, and at-rest/in-transit requirements

Supplier Management

Supplier Management IS Policy

Security requirements for third-party suppliers, due diligence process, contractual obligations

Supplier Inventory

Register of all third-party suppliers with data access, risk classification, and review dates

Client-Facing

Security & Data Protection Framework (TOMs)

Technical and Organisational Measures — for client contracts, procurement, and due diligence