Knowledge and practical explanation
Articles, analyses and practice lessons on digital risks, board-level responsibility, cyber resilience, incidents and suppliers. Written for board, management and professionals who want to make informed choices.
9 articles
Applicability, duty of care, governance, chain responsibility and practical implementation.
Read what NIS2 supply chain demands and chain responsibility from entities and suppliers, and how you can prove to control critical dependencies.
Read the article →This NIS2 checklist helps you step by step to work on the Cybersecurity requirements, which have been in force since 15 August 2026.
Read the article →The Dutch Cybersecurity Act has been in force since 15 August 2026. Read what duty of care, reporting obligation, oversight and possible NIS2 fines mean for organisations and directors.
Read the article →Cyber threats increase in size, complexity and impact. Organisations in all sectors experience that digital attacks are not only a technical issue, but are directly related to strategic goals: delivery reliability, turnover, customer confidence and legal ...
Read the article →Cyber threats affect continuity, reputation and financial results. The NIS2 raises the bar by requiring board members to give control to risk management and information security. The thought is simple: digital security is often business critical and...
Read the article →
What does the Cyber Resilience Act mean for manufacturers, software and digital products? Check the CRA requirements, reporting obligation from 11 September 2026 and deadline 2027.
Read the article →Wouter Parent of Kynexis discusses at NCOD Audit what the Dutch Cybersecurity Act and NIS2 mean for governance, risk management and practical implementation.
Read the article →What should board members regulate about the training obligation under the Dutch Cybersecurity Act? 15 answers on requirements, certificate and testability.
Read the article →Even without your own NIS2 obligation, you can get security requirements from customers covered by the Dutch Cybersecurity Act as a supplier. Read why and how you react.
Read the article →11 articles
Board-level responsibility and sector-specific governance for care, social work, housing associations and non-profit.
What questions does an RvT or RvC ask about cybersecurity? Wouter Parent presents 12 questions for risk-oriented oversight of digital resilience and internal control.
Read the article →
How do you assess a critical IT provider? Wouter Parent gives practical questions about security, continuity, assurance, incidents, access, SLA and exit.
Read the article →What do design, existence and operation mean? Read how governance, IT and audit show that information security measures have been set up and functioning.
Read the article →Manage supplier risks with classification, clear requirements, demonstrable evidence, incident arrangements, continuity and an executable exit strategy.
Read the article →
Translate the Social Work Governance Code 2025 to cybersecurity, responsible data usage, ownership, supplier control and demonstrable security.
Read the article →Connect the Governance Code Care 2022 to digital care, information security, suppliers, continuity and board-level reporting.
Read the article →Translate the Governance Code Housing Corporations 2025 to cyber-weapon, data protection, AI, supplier management and board-level reporting.
Read the article →Practical explanation about the CBF Recognition Scheme 2026, privacy, information security, donor data, payment flows and digital fraud.
Read the article →See important differences between the Social Work Governance Code 2025 and Governance Code Healthcare 2022 and request the targeted comparison on digital governance.
Read the article →
Police and OM are detecting more scalable cybercrime, AI and fading offender groups. What does the Cybercrime image 2026 mean for board members?
Read the article →Cybersecurity governance connects information security, risk the board and management. Read how governance monitoring and a roadmap give you a grip.
Read the article →13 articles
Research forms, audits, ISO 27001, ISMS and the choice of appropriate cybersecurity expertise.
What points do you check in a cybersecurity audit? Wouter Parent gives 12 practical questions about risk, access, recovery, suppliers, monitoring and evidence.
Read the article →Audit, pen test, or vulnerability scan? Wouter Parent explains which research answers which question and when you combine research.
Read the article →How does an ISO 27001 audit proceed? Wouter Parent explains phase 1, phase 2, internal audit, supporting documents, interviews, deviations and preparation in practice.
Read the article →In 5.10.2017, do the ISO 27001 checklist and gain direct insight into strengths and focus within the main components of ISO/IEC 27001:2022.
Read the article →What is an IT security audit investigating? Wouter Parent explains how technology, governance, suppliers, recovery, incidents and demonstrable evidence come together.
Read the article →What does ISO 27001 certification cost? Wouter Parent explains what costs you really make: certification audit, internal time, ISMS, guidance and maintenance.
Read the article →
An ISO 27001 journey requires time, attention and clear choices. However, the same practical problems often arise during preparation.
Read the article →Read how ISO 27001 certification works, what steps and evidence are needed and how Kynexis prepares your ISMS for the certification audit.
Read the article →
Which cybersecurity company suits your question? Compare expertise, independence, evidence, reporting and the role of a cybersecurity specialist.
Read the article →
Wouter Parent shows how he prepares, performs, reports and discusses with IT, the board and management.
Read the article →Follow eight practical steps from scope and GAP analysis to risks, measures, evidence, internal audit and preparation for certification.
Read the article →Compare a cybersecurity baseline assessment, assessment and audit on decision-making, depth, proof, independence and desired security.
Read the article →A clear answer to what an ISMS is, what parts it contains and how risks, measures, evidence and improvement come together.
Read the article →14 articles
Risk analyses, internal control, supplier control, securing and structural CISO direction.
It's not about locking everything down. All prevention is an illusion. An airbag does not prevent a collision, but ensures that the risk becomes more manageable. That is the core of internal control in information security: not excluding any ...
Read the article →Many organisations see risk management as a necessary evil. A check mark exercise to satisfy auditors, or a document that mainly disappears in the drawer. But that's gonna miss the real potential.
Read the article →Many organisations spend most of their IT. From cloud hosting to helpdesk and security monitoring: the dependence of external parties is enormous today. Often there is a blind trust: our IT partner does. But what if that partner...
Read the article →Risk management is too often seen as a cost. In practice, precisely in conjunction with information security and a well-thought-out cyber security strategy, it delivers noticeable returns: fewer incidents, fewer failures and more customer confidence,...
Read the article →A good approach to information security begins with ownership and grows through cooperation. This article shows in simple language how you control, involve people and step by step improves. With this approach, you can increase...
Read the article →Bring together risks, measures, evidence, ownership and follow-up in a workable evidence file.
Read the article →
Cyber insurance may transfer financial damages, but first requires insight into risks, coverage, terms and conditions and appropriate security measures.
Read the article →
The data breach at a UMC Utrecht supplier shows the importance of supplier control, access management, logging and clear incident agreements.
Read the article →A practical approach to comparing IT service providers to service, security, continuity, contract, transition and fitting.
Read the article →Read what choices, costs, security requirements and contractual arrangements are important before outsourcing ICT management to an external service provider.
Read the article →
Set up AI policy? Read what agreements are needed on AI tools, data, privacy, control, employees, security and the AI regulation.
Read the article →To develop information security policy? Read what topics, responsibilities, measures and policy pieces are needed and how you ensure policy.
Read the article →Read what factors determine the cost of CISO as a Service, what deployment models are available and how you compare offers in substance.
Read the article →Compare an external CISO, interim CISO, vCISO and in-house CISO on mandate, continuity, capacity, independence and growth phase.
Read the article →13 articles
Preparing for cyber incidents, responding under pressure and strengthening technical and organisational resilience.
Hacked or a cyber incident? Read what you do in the first 30 minutes, first hours and first 24 hours around isolation, evidence, communication, notification and recovery.
Read the article →The recent incident at Renault UK shows how vulnerable organisations are to third-party attacks. Not Renault itself, but an external data processor was hit. This underlines the importance of good supplychain management: anyone who wants to prevent a cyber attack...
Read the article →The recent cyber attack on Jaguar Land Rover (JLR) is one of the biggest industrial incidents of recent years. With one fragile link, production stopped completely and economic damage amounted to billions. It's a lesson for every ...
Read the article →A cyber attack could hit any organisation. Read what a cyber attack is, how attacks are occurring and what measures help to reduce the likelihood and potential impact.
Read the article →Digital risks are increasing rapidly. Cyber criminals become smarter, regulations such as NIS2 sharper and customers expect demonstrable security. Many organisations wonder: how do we improve our information security in a way that suits our company,...
Read the article →As responsible within an SME organisation, it is tempting to leave IT and security entirely to external parties. But without direction – Without grip – There are blind spots. That's where it goes wrong. Incidents on suppliers, human error...
Read the article →For many SME organisations IT outsourcing is logical. But outsourcing is not the same as letting go. Without board-level direction blind spots arise: unknown vulnerabilities, weak supply chains (supply-chain) and, for example, untested backups. Right there...
Read the article →Security by design is a prerequisite for any organisation that works with apps or connects systems. Build your own software, deploy SaaS, roll out your IoT devices or connect your data via digital links? If safety doesn't start from...
Read the article →Fifteen practical cybersecurity measures for organisations that want to make digital risks manageable and to protect continuity, data and trust.
Read the article →
What is vulnerability management and how do you prioritize critical vulnerabilities in firewalls, VPNs and internet-facing systems? Practical approach for organisations.
Read the article →How do you prevent a software release from causing a data breach? Read how change management, testing environments, safe test data, acceptance tests, rollback and monitoring are connected.
Read the article →
How do you prevent your WordPress site from being hacked? 5 practical tips for updates, plugins, MFA, monitoring and secure WordPress security.
Read the article →What is patch management and how do you determine which security updates are urgent? Read how you prioritize, patch, control and can be demonstrated.
Read the article →4 articles
Learning, practicing and connecting safe behaviour to daily routines and demonstrable follow-up.
During due diligence, audit or preparation for NIS2, the same question often comes back: Do employees know what to do to reduce digital risks, and can the organisation demonstrate this? A cybersecurity awareness training is not a loose e-learning or...
Read the article →Build a structural security awareness program around risks, target groups, training, phishing, reporting behaviour, measurement and demonstrable improvement.
Read the article →
Many organisations invest every year in new technical security layers: Firewalls, endpoint security, multiple verification, better SIEM.
Read the article →
Most organisations do it like this: They buy an e-learning, send an invitation, wait for everyone to complete the module and check it.
Read the article →Choose a live session for the board, executive team, supervisory board or board of trustees and register directly.