Skip to content
IT-Checklist

About IT-Checklist

Last updated: Ā· IT-Checklist editorial team Ā· All changes

IT-Checklist is a free and independent questionnaire. In a few minutes you see how your IT security is doing. The site is for sole traders and small and medium-sized businesses in the Netherlands. So for companies without their own security department that still want to know where their biggest risks are, and what to do about them.

Large organisations have auditors and consultants. Small businesses usually get scattered tips or a sales pitch. IT-Checklist sits somewhere in the middle. It is a complete checklist in plain language. Every measure comes with an explanation and a first step. You donā€™t need an account and you donā€™t leave any details.

Who makes IT-Checklist?

The IT-Checklist editorial team writes and maintains the content. We donā€™t work for a vendor of security products. We also donā€™t sell software or services through the questionnaire. Got a question, correction or addition? Send it through the contact form and pick the reason ā€˜Improving the questionnaireā€™.

How the questionnaire is built

  • The questions are grouped into topics, from identity and access to NIS2. You can also read all questions and advice on the checklist by topic page.
  • Every question describes a desired situation. You answer yes, no, not applicable or prefer not to say. Only yes and no count towards your score.
  • Every measure has a weight from 1 to 3. The label shows which: recommended (1), important (2) or do first (3). Measures that prevent the most incidents, such as MFA, weigh the most.
  • The questionnaire adapts to your type of business. If you are a sole trader, you get no questions about staff or offboarding.

Sources

The questions and advice come from public standards, laws and guidance from Dutch and European government bodies. We translate those to the daily reality of a small business. These are the main sources:

  • the controls of ISO/IEC 27001:2022 and, for healthcare, NEN 7510;
  • the Dutch Cybersecurity Act (NIS2) and publications of the NCSC;
  • the GDPR and guidance from the Dutch Data Protection Authority;
  • the EU AI Act and the Cyber Resilience Act;
  • the baseline measures for businesses from the NCSC (formerly the Digital Trust Center).

Do we mention a deadline, fine or date? Then that page links to the official source.

How we keep the content up to date

IT laws change quickly. When a law takes effect, a deadline moves or a standard gets a new version, we update the questionnaire and the explanation pages. The top of every page shows when we last updated its content. All changes are listed by date in the changelog.

Advertising and independence

IT-Checklist is free. Ads pay for the site, including Google AdSense. An ad always carries the label ā€˜Advertisementā€™. Advertisers have no say in the questions, the advice or the order in which we mention things. When we name a product as an example, such as a password manager, nobody paid us for that.

Privacy

You take the check anonymously. We donā€™t ask for your name or email address. We donā€™t store your answers in a way that links them to you. Cookies for statistics and ads are only set if you agree to them. All details are in the privacy statement.

Not a substitute for tailored advice

The check gives an indication based on your own answers. It is not an audit and it is not legal advice. A high score also doesnā€™t prove that you comply with a law or standard. Take the result to a conversation with your IT partner, adviser or certification body.