From compliance to structurally mature information security 

CJ2 is a hosting organization that has been operating for over twenty years from a clear conviction: data needs to be close by. Not only because of speed and accessibility, but increasingly from the perspective of data sovereignty and control over the entire chain. The organization provides hosting services, online workspaces, applications, and websites to a broad customer base, ranging from small associations to healthcare institutions with hundreds of employees working entirely in the cloud. 

What sets CJ2 apart is that the entire infrastructure is managed in-house from end to end. From network to connections and hosting: everything remains under its own control. In doing so, a deliberate choice is made for open source technology and in-house network management, keeping dependence on external parties to a minimum. 

To further professionalize their information security and support their ISO and NEN certifications, CJ2 is working with Nestor Security and our partner Warpnet. While Nestor Security supports the organization in the areas of governance, risk management, and certification, Warpnet provides an objective assessment of the technical security with independent pentests. Together, CJ2 helps to continuously improve information security. In this customer case, the stakeholders from CJ2, Nestor Security, and Warpnet tell how that collaboration looks like and what insights and improvements it has yielded. 

Information security as the core of operations 

Information security is intertwined with CJ2“s entire operation. The organization is ISO 27001 and NEN 7510 certified and has been working systematically to improve its security maturity since 2017. Carlos de Boer, CEO of CJ2, explains: ”The importance of information security has only increased over the years, partly due to growth, customer expectations, and new regulations, such as NIS2. That is super important to us. We manage everything, so it is essential that we also have everything under control. That is precisely why we hold those certificates."  

As the organization grew, so did the volume of documentation and processes surrounding information security. What once started out as manageable became increasingly complex due to the sheer amount of policy, documents, and mutual dependencies. Internally, the first phase of certification was looked back on as a period when the standard was the primary guiding factor. “We were already doing a lot technically, but we had actually started with the idea that we had to check off everything that was in the standard. Only later do you realize that you also just have to look at: what are we already doing, and how do we properly record that,” Carlos says. That shift became important: instead of adapting the organization to the standard, the standard was increasingly translated to the reality of the organization itself. 

Bringing structure to complexity 

To support that movement, an external security officer was brought in via Nestor Security. Her role primarily involved redesigning risk management and guiding the recertification process. From the beginning, the sheer volume of documentation stood out. “CJ2 had an incredible amount of documentation regarding the ISO 27001 standard. An important next step is to further structure that documentation so that everything is easily searchable and consistent,” says Wendy Sikkema, Security Officer at Nestor Security. 

Therefore, simplification was chosen. Topics were restructured, policies were revised, and where possible, references were used instead of duplication. In addition, a fixed consultation structure was introduced. “We sit down together every week. This ensures that expectations remain constantly clear and allows you to respond more quickly when something changes. What we are trying to do is bring the standard closer to the organization itself. So that it becomes something you can use instead of something you merely have to comply with.”  

Independent validation in practice 

In addition to audits, CJ2 has penetration tests conducted annually to have the technical side of information security independently assessed. Warpnet was engaged for a configuration review and pentest on a new identity provider and open-source platform components. Because the system was still under development, a large part of the process consisted of interactive sessions in which choices, configuration, and architecture were discussed together. “CJ2”s employees were very good at explaining their choices. They were motivated and also asked many questions in return, making it a truly interactive process," says Nikhil John Thomas, Pentester at Warpnet. 

The outcome of the pentest was predominantly affirmative. Several recommendations were made, but no critical vulnerabilities were found. “We do not report findings in the sense of ‘you are not doing a good job’, but rather recommendations. It is about what you can improve on what is already there.” This was primarily seen by CJ2 as confirmation of their existing course. 

Experience with collaboration and process 

Patrick Hulshof, System & Security Engineer at CJ2, shares more about the collaboration with Warpnet: “The entire process was experienced as accessible and transparent. The intake was clear, the collaboration during the test was open, and there was plenty of room for mutual understanding. The report was seen as an important part of the value: not only technically complete, but above all easy to follow and practical to use.” 

For CJ2, the added value of the collaboration with Nestor Security lies not only in their substantive knowledge, but also in the way it is communicated. Where the organization previously focused mainly on compliance, Nestor Security helped view information security from the perspective of their own daily practice. In the process, existing choices were critically evaluated and sharpened where necessary. As Carlos himself points out: “Nestor Security's consultants help us describe things as clearly as possible, while remaining realistic. In the beginning, they really held up a mirror to us. That has made us look at our processes and policy differently.” 

The insights from audits and pentests are actively fed back into the organization and serve as input for further maturity in risk management. The focus is increasingly shifting toward gathering risks from within the organization itself. Wendy explains: “I visit every team to see where they see risks. I take those back with me, and then we perform a risk analysis on them.” 

Continuous improvement 

The collaboration has since evolved into a structural way of working in which information security grows along with the organization. Through the combination of external expertise, internal involvement, and independent validation, a mature approach has emerged in which compliance is not the endpoint, but a logical consequence of well-designed processes. Carlos ultimately summarizes that feeling as follows: “You benefit from it. More professional. And that is something that lasts. Digital dependency is increasing and cyber threats are becoming more frequent, so handling sensitive data with care is simply a priority.”