Critical processes
Identify essential services, impact tolerance, recovery objectives and the consequences of disruption.
Cybersecurity is a boardroom responsibility
Digital dependencies are growing. Do you know what is at risk?
Modern business processes depend on complex networks of IT, operational technology, people, platforms and suppliers — inside and outside your organisation.
Trust in People helps boards and supervisory bodies connect those dependencies to business impact, strategic decisions and demonstrable cyber resilience. Not more bureaucracy, but better control of what matters.
Business-led cyber resilience
Start with the business process. Then trace the dependencies.
A business impact analysis (BIA) identifies the services that truly matter, the consequences of disruption and the recovery priorities. From there, IT and OT risk becomes actionable business risk.
Dependencies
Connect processes to applications, OT, identities, data, infrastructure, cloud, suppliers and partners.
Risk and strategy
Evaluate disruption scenarios, select proportionate controls, allocate resources and record risk decisions.
Test and measure
Exercise incidents, validate recovery, track meaningful indicators and revisit assumptions as dependencies change.
Beyond the traditional cyberattack
The risks are broader than hackers.
Digital dependency can threaten continuity, autonomy and trust even without a conventional security breach.
Unauthorised access
Compromised credentials, privileged access, weak segregation of duties and failures across identity providers.
Licences and platforms
Unilateral licence withdrawal, service suspension, changing terms and dependence on a single critical provider.
Recovery capability
Untested backups, unavailable suppliers, inaccessible data and recovery times that exceed business tolerance.
Employee and user profiling
Identity metadata, MFA-related telemetry, cookies and online profiles that may expose behaviour and create privacy or dependency risks.
External dependencies
Cloud, connectivity, software, outsourced operations and subcontractors outside direct organisational control.
Incidents and decisions
Unclear escalation, untested fallback procedures, reporting thresholds and decisions made too late under pressure.
Governance that serves the business
Make cyber risk part of strategic management.
Combine enterprise IT governance, information security and cybersecurity accountability — without treating them as separate silos.
COBIT · IT governancePeople · Process · TechnologyCybersecurity · Accountability
- Policy with purpose: define what to protect, why, and who is accountable.
- Risk-based priorities: align controls and budgets with business impact and dependency concentration.
- Exercises before incidents: board-level scenarios, crisis decisions, legal reporting and recovery drills.
- Evidence over checklists: test effectiveness, make deviations visible and document decisions.
- Strategy and foresight: anticipate technology shifts, supplier lock-in and future resilience needs.
Tailored to your organisation
Board training built around your own business risks.
No generic cybersecurity lecture. Practical, tailored training for executive boards and supervisory boards, using your critical processes, actual dependencies and relevant incident scenarios.
Understand and challenge
Recognise digital dependencies, ask informed questions of IT, OT, risk management and suppliers, and assess the implications for your services.
Exercise and decide
Run realistic tabletop scenarios involving service disruption, compromised access, cloud failure or supplier suspension — with executive decision points.
Govern and demonstrate
Review risk appetite, policies, incident obligations, management information and evidence of oversight. Turn learning into concrete board actions.
Dutch NIS2 implementation requires training for in-scope executive management. Training for supervisory board members can strengthen oversight, but the statutory training duty does not apply to every supervisory director in the same way. Training design and evidence should follow the applicable requirements.
Legal duties, practical oversight
Know what applies. Demonstrate what works.
Trust in People supports a proportionate approach to NIS2 and its Dutch implementation, including the Cybersecurity Act (Cbw), Cybersecurity Decree (Cbb) and — where applicable — critical-entity resilience requirements under the Wwke.
From obligations to evidence
Scope and registrationDuty of careRisk managementIncident notificationSupply-chain resilienceManagement trainingRecovery exercises
What should the board be able to answer?
Which services are critical? Where are our single points of failure? What impact can we tolerate? What have we tested? Which residual risks have we accepted — and on what evidence?
Applicability and obligations depend on entity type, sector and the relevant legal framework. No dashboard or training alone establishes full compliance.
Trust in People · The Information Protection Company
Cyber resilience belongs in business strategy.
Independent, business-led guidance and tailored board training for leaders who want to protect continuity while keeping their organisations free to operate, adapt and grow.