Quality Mark for Digital Basic Security for SMEs

Small and medium-sized enterprises (SMEs) are an attractive target for cybercriminals, not because their data is more valuable, but because their digital security often falls short. IT service providers play a key role: they manage the systems and networks of hundreds of SME clients simultaneously.

The Digital Basic Safety Mark SMB certifies ICT service providers who structurally protect their SMB clients with proven basic security measures. DigiTrust conducts the independent certification audit as a recognised audit partner of the CCV.

Independent. Experienced. Appreciative.

SME Digital Basic Security Mark

27001:2023 and 2024 version?

Latest news

ISO/IEC 27001:2022 was published internationally in October 2022. This version was approved for Europe by CEN in July 2023 and subsequently published by NEN in August 2023 as NEN-EN-ISO/IEC 27001:2023 (NL/EN). The international version remains ISO/IEC 27001:2022; when certifying, you must choose between the international or the European/Dutch variant.

What is the SME Digital Basic Security Mark?

The Digital Basic Security SME Mark is a quality mark for IT service providers who ensure the digital basic security of their SME clients. keurmerk is developed by the CCV based on the Digital Security Risk Classification (RKIDV) — a risk model based on the five principles of the National Cyber Security Centre (NCSC). The kitemark originated from a parliamentary motion requesting concrete cybersecurity support for SMEs.

Certified ICT service providers have demonstrably proven that they correctly implement these basic measures for their clients. This gives SMEs the assurance that their digital security is not left to chance.

A CCV certification is relevant for whom?

The quality mark is intended for all ICT service providers that supply security services to SMEs.

MKB entrepreneurs can use the kitemark as a reliable selection criterion when choosing an ICT partner that takes their digital security seriously.

Over 600 organisations have gone before you

ISO 27001 and/or NEN 7510?

If you have a NEN7510 certification then it will remain on the current version. After all, no new version of this standard is available yet. If you have both ISO27001 and NEN7510 certification, you can already switch to the new standard with your current ISO27001 certification. This will create a situation of 'old and new' mixed up in your ISMS.

The administrator/owner of this standard is the NEN. Because a new version of ISO 27001 has been released, the NEN standards committee is currently working on a new version of NEN7510 as well. This is only expected to be finalised and published during 2024.

Do you have any questions about this or about ISO certification 27001 in general?

Here then contact with us.

Direct contact with your specialist

Bell +31(0)88 22 45 600

Our specialists will be happy to tell you more about it. Call us at 088-224 56 00, please email us at [email protected] or use our online contact form. We will be happy to visit you for a no-obligation introduction.

Over 600 organisations have already taken the step.

Callback form

What is being tested?

The audit assesses whether your service provision complies with the five NCSC principles from the RKIDV, translated into concrete security measures for SME clients:

Mapping risks

Do you have a method to identify and prioritise your clients' digital risks? Are risks documented and communicated?

Promoting safe behaviour

Do you encourage safe digital behaviour among your clients' employees? Consider password policies, phishing awareness, and reporting procedures.

Protecting systems, applications, and devices

Do you secure systems, applications, and devices at a level appropriate to your customers' risk profile?

Manage access to data and services

Do you apply the least privilege principle for your clients' employees and external partners? Are access rights revoked in a timely manner when changes occur?

Being prepared for incidents

Do your clients have backups, recovery plans, and emergency procedures? As a service provider, do you know what to do in the event of a client incident?

In addition to the technical measures, DigiTrust also assesses your internal quality management system: how do you structurally guarantee the quality of your service provision?

Being prepared for incidents

Do your clients have backups, recovery plans, and emergency procedures? As a service provider, do you know what to do in the event of a client incident?

The process

Initial
certification

Control 1

Audit of your management system

Control 2