Information security
Information security at Newway
At Newway, protecting information is central to everything we do. We make sure data, systems and processes are reliable, secure and available, for our clients and for our own organisation.
Version November 2026 · last updated 9 November 2026
Part of the general terms and conditions
This document belongs to the general terms and conditions of Newway. By accepting a quotation or agreement from Newway, you also accept this document; no separate signature is needed. If you want to deviate from it, we record that as an exception signed by both of us.
Our vision on information security
For us, information security is not a separate measure but a fixed part of how we work and design solutions. We work from three core principles:
- Confidentiality: information is only accessible to those who are authorised.
- Integrity: information is correct, complete and reliable.
- Availability: information is available when it is needed.
These principles are the basis of all our processes, systems and choices.
How we organise information security
Newway works with an information security management system (ISMS) and is certified to ISO 27001 and NEN 7510. Our approach follows a fixed cycle:
- Policy and principles: management sets the information security policy.
- Risk assessment: we periodically assess the risks around information and systems.
- Measures and set-up: we implement appropriate technical and organisational measures.
- Execution and monitoring: we apply the measures continuously, with logging and checks.
- Evaluation and improvement: periodic management reviews and adjustment.
For us, information security is not a project but a continuous process.
Security in practice
Access and authorisation
Access to systems and data is based on roles and responsibilities. Authorisations are managed and checked periodically.
Authentication and access protection
We apply strong password rules and use multi-factor authentication wherever possible. On our client portal, two-step verification has been mandatory for everyone since 9 November 2026, with an authenticator app or an emailed code (how it works).
Handling information
Information is classified by sensitivity and risk. The level of security is adjusted accordingly.
Suppliers and collaboration
We only work with suppliers that meet our security requirements. Agreements are laid down in contracts and evaluated periodically. The parties that process data on our behalf are listed in the Trust Center.
Incident management
Security incidents are registered, analysed and followed up. Where necessary, we take immediate action and build improvements into our way of working.
Continuity
We take measures to safeguard the continuity of our services, including during disruptions or incidents.
People and organisation
Information security starts with people. That is why we ensure:
- clear roles and responsibilities;
- awareness and training of employees, including the safe use of AI;
- security as a fixed part of everyday work.
Management is ultimately responsible for the information security policy and for embedding it in the organisation.
Compliance and standards
Newway is certified to ISO 27001 and NEN 7510 and works in line with relevant laws, regulations and recognised standards, including:
- ISO 27001;
- NEN 7510;
- the General Data Protection Regulation (GDPR).
We review our approach periodically and adjust where needed.
Assurance and control
To make sure information security works, Newway carries out, among other things:
| Activity | Frequency |
|---|---|
| Evaluation of policy and measures | At least once a year |
| Review of authorisations and access rights | Periodically |
| Monitoring of systems and processes | Continuously |
| Management reviews | Periodically |
| Registration and follow-up of incidents | Immediately and continuously |
| Maintenance of documentation and procedures | Continuously |
The information security policy is set by management and reviewed periodically.
Roles and responsibilities
The table below shows, in broad terms, how responsibilities are divided within Newway.
| Area | Responsible | Involved |
|---|---|---|
| Setting policy | Management | Security officer |
| Implementing measures | Security officer | IT and operations |
| Access and authorisation management | Management and IT | Team leads |
| Incident management | Security officer | Teams involved |
| Evaluation and improvement | Management | Security officer |
| Awareness and compliance | Employees | Whole organisation |
The exact allocation of roles may differ per situation or project, but responsibilities always remain assured within the organisation.
Continuous improvement
Information security keeps developing. Through monitoring, evaluations and improvement measures, we keep sharpening our processes and measures.
More information
On request, we share relevant parts of our ISMS with clients and suppliers, insofar as this fits within confidentiality and contractual arrangements. This may include policy documents, procedures, a description of security measures and an explanation of our controls. We share documentation based on a risk assessment and, where needed, under a confidentiality agreement.
How we handle personal data and AI in your environment is set out in the data processing agreement and AI addendum and in the Trust Center. Questions or need documentation? Email info@newway.nl.
Questions about these documents? Email info@newway.nl or call +31 85 007 04 97.
Newway Solutions B.V. · Walpoort 10, 5211 DK 's-Hertogenbosch, the Netherlands · Chamber of Commerce 10030845 · VAT NL0040.22.944.B.01
This is a translation of the Dutch text. In case of differences between the two versions, the Dutch text prevails.
