The SURFaudit assessment framework is the shared yardstick for information security and privacy in Dutch vocational and higher education. The framework is based on the NBA information security maturity model and measures, per control, how mature an institution is on a scale from 1 to 5.
Together with the Ministry of Education (OCW), the sector aims for an average maturity level of 3. Universities have their information security audited externally every year, universities of applied sciences every two years. Vocational colleges do so annually through MBO Digitaal. The results come together in an annual benchmark.
Measure:
Record how your institution organises information security and privacy, with clear roles and responsibilities. The executive board steers this and carries final responsibility.
Measure:
Map the main risks to education, research and operations. Choose controls based on those risks and evaluate them periodically.
Measure:
Make staff aware of their role in information security and keep that knowledge up to date. For example with Arda's cyber security awareness e-learning. That is how they learn to recognise risks.
Measure:
Give staff and students access only to the systems and data they need. Revoke rights promptly when someone changes role or leaves.
Measure:
Make agreements with suppliers and partners about information security and privacy. Check periodically whether they keep to those agreements.
Measure:
Have your controls assessed through a self-assessment, peer review or external audit. Submit the results by 31 January for the SURFaudit benchmark covering the previous year.
The framework's human resources domain requires security awareness among staff. At level 3, controls must be documented, implemented and demonstrably effective. The Arda platform helps you get there.
Level 3
Arda offers one programme for all staff, with e-learning, interactive films, serious games and phishing training. With learning paths you tailor the content to different groups.
Audit
As an administrator you see exactly how many participants have completed which components. The reports let you show an auditor that your programme is really being carried out.
Effect
With the Phishing Inbox, staff practise with realistic emails. You see how their behaviour develops and adjust your programme based on the results.
Practical
Log in with single sign-on via SURF and connect Arda to your Active Directory. With Arda for students you also prepare students for a safe digital future.
Do you want to demonstrably raise security awareness within your institution? Arda helps staff recognise digital risks, so they become the strongest link in the security of education and research.
It is not a law. The sector has, however, agreed with the Ministry of Education to aim for an average maturity level of 3. Institutions are themselves responsible for meeting these sector agreements, and the umbrella organisations share the sector picture with the ministry.
The SURFaudit assessment framework is intended for vocational colleges, universities of applied sciences and universities. The IBP standards framework applies to primary, secondary and special education. Both work with maturity levels and have level 3 as their goal.
No. The SURFaudit assessment framework is a yardstick for determining the maturity of information security and privacy, not a certification standard. If you want a certificate, look at ISO 27001.
Aware employees who know how to keep cybercriminals out.
50% more reports of suspicious emails by employees.
Less stress about reputational damage and recovery costs after an incident.
