Make better strategic decisions with a grip on information security
As a CIO, CISO or security officer, you work with strict frameworks, increasingly sophisticated cyber threats and employees who handle sensitive data from different locations. If your organisation falls under NIS2, ultimate responsibility for cyber risks also lies explicitly with the board. In the Netherlands, this is set out in the Cyberbeveiligingswet (Cbw). With the ISMS software in Key Control Dashboard, you bring information flows, risks and controls together in one environment. That way, you show your senior management, auditor and regulator that your information security is in order. Our specialists help you set it up.
Organisations that rely on our ISMS software
Risk-based approach
Link assets, threats and controls, and set priorities for each risk.
Evidence in order
For each control, record who is responsible, what the status is and where the evidence is kept. That way, you go into every audit well prepared.
Distributed responsibility
Involve departments, stakeholders and suppliers in information security, each from their own role.
How does it work, exactly?
You start straight away with a best-practice setup: dashboards, workflows, a governance structure and reports. We then tailor the system to your requirements and way of working.
The tool organises information automatically, puts ownership with the people who run the processes and supports frameworks such as NIS2, BIO2, ISO 27001, DORA, SOC 2, NEN 7510 and the GDPR. When an incident occurs, you record the follow-up actions straight away, so you limit the damage and keep your organisation running. Want to see all the features at a glance? The factsheet shows, per component, what’s included as standard in the base model.
What you get with our ISMS software
From policy to incident: this is how it works in practice.
Everything in one place
Keep your policies, procedures, controls and asset register together in one environment.
Compliance per framework
The compliance dashboard shows in real time where you stand on each framework.
Audits without the searching
Manage internal and external audits in a dedicated audit module, with the evidence right at hand.
Incidents followed up straight away
Register data breaches and incidents as soon as they happen, including the follow-up actions and who carries them out.
ISMS in line with ISO 27001, BIO2 and NIS2
With a reusable library of controls, you test against multiple frameworks at the same time.
The international standard for an ISMS, with ISO 27002 providing guidance on the controls. The basis for certification and for BIO2.
The Dutch government’s framework for information security, built on ISO 27001 and ISO 27002, with a legal basis through the Cyberbeveiligingswet (Cbw).
The Cbw, the Dutch implementation of NIS2, has been in force since 15 August 2026. If your organisation falls within scope, you have a duty of care, a duty to report incidents and a duty to register.
For the financial sector: requirements for ICT risk management, incident reporting and testing your digital resilience. In force since January 2025.
The Dutch standard for information security in healthcare.
The method Dutch municipalities use to account for their information security each year.
Keep everyone involved with distributed ownership
Key Control Dashboard puts ownership where it belongs: with the departments themselves. With roles and user rights, every employee contributes the information needed and takes responsibility for their own part of information security.
No more going round departments with Excel spreadsheets. Information comes together in one environment, so you make fewer mistakes and see sooner where action is needed.
NIS2 and the Dutch Cbw: what do they mean for your ISMS?
On 15 August 2026, the Cyberbeveiligingswet (Cbw) came into force as the Dutch implementation of the EU NIS2 Directive. It replaces the Wbni, the previous Dutch act on network and information security, and applies to 18 sectors. If your organisation falls within scope, you have a duty of care, a duty to report incidents and a duty to register. Board members must also have enough knowledge themselves to assess cyber risks and measures.
An ISMS gives you the structure to demonstrate this: you keep [risks], controls, incidents and reports in one place. Zero-risk working doesn’t exist, but with the right data, you adjust course step by step.
What our customers have to say
This is what drives us
“We had to choose: replace or keep building. By working with Yellowtail Conclusion, we were able to keep building on a platform that had proven itself in practice for years.”
“The dashboard helps us keep an overview and respond flexibly to new laws and regulations. It grows with us, and that gives us confidence.”
Frequently asked questions about ISMS software
An ISMS (Information Security Management System) is the way you organise information security: policies, risks, measures and controls. ISMS software gives you one environment for all of this. You record risks, link them to policies and processes, automate controls and demonstrate that you meet requirements such as ISO 27001, BIO2 and NIS2.
In general, the law doesn't require you to use software. An ISMS itself is often required, though. For ISO 27001 certification, you set up an ISMS. Dutch government organisations work in line with the BIO2. And organisations that fall under NIS2 (in the Netherlands, the Cbw) have a duty of care for their information security. Software helps you do this in a demonstrable and manageable way.
The cost depends on your requirements, the size of your organisation, your sector and the number of locations. After an initial assessment, you'll know which package and features fit your situation. Want a first impression? Request a demo.
Sound good?
Request a free, no-obligation demo and explore what’s possible. Find out what our services and solutions mean for your organisation.
