CCV Keurmerk Monitoring

How quickly an organization detects a digital threat often determines the extent of the damage. Therefore, more and more organizations are outsourcing the monitoring of their systems to a SIEM or SOC provider. But how do you, as a client, know if that service provider is doing it right? The CCV Keurmerk Monitoring makes the quality of monitoring services visible and verifiable.

DigiTrust is the first certification body for the CCV Monitoring Certification. We conduct the certification audit independently for providers of monitoring services that want to obtain the certification.

Independent. Experienced. Appreciative.

27001:2023 and 2024 version?

Latest news

ISO/IEC 27001:2022 was published internationally in October 2022. This version was approved for Europe by CEN in July 2023 and subsequently published by NEN in August 2023 as NEN-EN-ISO/IEC 27001:2023 (NL/EN). The international version remains ISO/IEC 27001:2022; when certifying, you must choose between the international or the European/Dutch variant.

What is the CCV Cybersecurity Monitoring Certification?

In monitoring, IT and OT systems, networks, and other digital environments are continuously or periodically monitored. The goal is to detect deviations, vulnerabilities, and possible cyberattacks as early as possible. This includes analyzing log files, detecting suspicious activity, and reporting security incidents.

Two terms often come up:
• SIEM: the technical solution that collects and analyzes security information.
• SOC: the team of specialists that assesses the signals and, if necessary, takes action.

A good monitoring service not only collects reports. The service also assesses them, adapts to the customer’s risks and scales up in a timely manner if something is really wrong. The CCV Monitoring Label was developed by the Centre for Crime Prevention and Security (CCV). The label sets out the quality requirements that such a service must meet.

For whom is the CCV Keurmerk Monitoring intended?

The certification mark is intended for organizations that provide monitoring services to other organizations, such as:

providers of SOC or SIEM services
Managed Security Service Providers (MSSP’s)
IT service providers that have security monitoring in their portfolio
Cybersecurity companies with their own 24/7 detection and response service

Organizations that want to outsource their monitoring can use the certification mark as a selection criterion. This way they choose a service provider whose quality has been independently verified.

What is being tested?

In our audit, we look not only at the technology you use. We primarily assess how your service delivery is structured in practice. The following topics are discussed, among others:

The full requirements are listed in the Certification scheme Monitoring on the CCV website.

Monitoring and detection

Are the agreed upon environments monitored according to a defined scope, and are relevant signals picked up?

Analysis and evaluation

Are reports expertly evaluated, and are genuine threats distinguished from false alarms?

Escalation and follow-up

Is it clear when and how a possible incident is reported, escalated, and followed up?

Communication and reporting

Are there clear agreements with clients, and are the reports understandable?

Security and continuity

Is your own service provision organized in a safe and reliable manner?

Quality and staff

Do you employ qualified staff and have established procedures, and do you periodically evaluate your service delivery?

Why monitoring is so important

Ransomware, data breaches, and other cyberattacks are becoming increasingly sophisticated. Preventing an attack is not always possible. Therefore, it is crucial to quickly detect an attack and respond immediately. Monitoring is an indispensable component in this context.

The quality of monitoring services varies greatly, however, and for clients this is difficult to assess. Do the reports actually yield something? How quickly is a response given? Who calls at three o’clock in the morning? The CCV Keurmerk Monitoring provides an independent and verifiable answer to these questions.

CCV Keurmerk Monitoring: have yourself certified

Do you provide monitoring services to other organizations? With the CCV Monitoring Certification, you demonstrate that your service meets established quality standards. This clearly distinguishes you from other providers in the market.

With the certification mark you show that:

Your monitoring service has been independently assessed
You work with qualified analysts and secure processes
signals are analyzed, followed up and escalated in a structured manner
Clients can confidently outsource their monitoring to you

After certification, your organization will be included in the list of certified service providers on the CCV website.

DigiTrust: the first certification body for Monitoring

The CCV develops and manages the certification mark, but does not carry out the certification itself. That task is carried out by an independent certification institution. DigiTrust has been appointed by the CCV as the first certification institution for the CCV Monitoring Certification Mark.

You can come to us for:

information about the steps in the certification process
Applying for an audit
practical information about audit preparation and the documentation to be reviewed
Planning and lead time
The practical requirements for your organization

Over 600 organisations have gone before you

ISO 27001 and/or NEN 7510?

If you have a NEN7510 certification then it will remain on the current version. After all, no new version of this standard is available yet. If you have both ISO27001 and NEN7510 certification, you can already switch to the new standard with your current ISO27001 certification. This will create a situation of 'old and new' mixed up in your ISMS.

The administrator/owner of this standard is the NEN. Because a new version of ISO 27001 has been released, the NEN standards committee is currently working on a new version of NEN7510 as well. This is only expected to be finalised and published during 2024.

Do you have any questions about this or about ISO certification 27001 in general?

Here then contact with us.

Direct contact with your specialist

Bell +31(0)88 22 45 600

Our specialists are happy to tell you more about certification. Call us 088-224 56 00, send an email to sales@digitrust.nl or use our online contact form.

Over 600 organisations have already taken the step.

Callback form

The process

1. View the schedule

Read about the requirements the Monitoring certification scheme places on your department and organization.

2. Prepare yourself

Map out how your service is organized and where improvements are still needed.

3. Initial certification

Our auditors assess whether your monitoring service meets the requirements of the schedule.

4. Resolving deviations

If we notice a discrepancy, you will have the opportunity to resolve it within a fixed timeframe and to prove it.

5. Achieving the certification mark

If you meet all the requirements, you are eligible to apply for the CCV Keurmerk Monitoring certification.

6. Periodic inspection

Even after certification, we regularly check whether you continue to meet the requirements.

Why DigiTrust as an Audit Partner?

DigiTrust is the first certification body for the CCV Monitoring Certification. We are also an audit partner for the CCV certifications Pentesten, Incident Response and Security Awareness Training. Our auditors combine deep knowledge of cybersecurity with years of audit experience.

With DigiTrust you can count on:

Premium audits
Our own auditors; we do not work with contracted auditors
Quick response to all your questions
Direct contact with the back office and the auditors
Quick quote, usually within a few days
We can often schedule your audit within a short period of time

What does certification cost?

The costs depend on the size of your organization and your monitoring service. Contact us for a customized quote. Usually you will receive it within a few days.

Bell +31 (0)88 22 45 600 or mail to sales@digitrust.nl.

Frequently asked questions

Who manages the CCV Keurmerk Monitoring?

The Centre for Crime Prevention and Security (CCV) develops and manages the certification. The certification itself is carried out by an independent certification body, such as DigiTrust.

What is the difference between SIEM and SOC?

SIEM is the technology that collects and analyzes security information. A SOC is the team that assesses and follows up on that information. The certification marks look at the whole picture.

Is the certification also intended for organizations that manage their own monitoring themselves?

No. The certification mark is intended for service providers that provide monitoring services to other organizations.

What happens if an anomaly is found during the audit?

You are given a fixed deadline to resolve the discrepancy. After that, you show that this has been done.

Where can I find certified service providers?

In the overview of certified companies on the CCV website.

CCV Keurmerk Monitoring

27001:2023 and 2024 version?

Latest news

What is the CCV Cybersecurity Monitoring Certification?

For whom is the CCV Keurmerk Monitoring intended?

What is being tested?

Why monitoring is so important

CCV Keurmerk Monitoring: have yourself certified

DigiTrust: the first certification body for Monitoring

Over 600 organisations have gone before you

ISO 27001 and/or NEN 7510?

Direct contact with your specialist

Callback form

The process

1. View the schedule

2. Prepare yourself

3. Initial certification

4. Resolving deviations

5. Achieving the certification mark

6. Periodic inspection

Why DigiTrust as an Audit Partner?

What does certification cost?

Frequently asked questions

Who manages the CCV Keurmerk Monitoring?

What is the difference between SIEM and SOC?

Is the certification also intended for organizations that manage their own monitoring themselves?

What happens if an anomaly is found during the audit?

Where can I find certified service providers?

Ⓒ 2026 DigiTrust BV