Confidentiality Pursuant. Admittance Control Unauthorized persons shall be denied access to data processing equipment, which processes or uses personal data by means of the following measures. The assigned authorizations are regularly checked for their necessity. Technical Measures • Alarm • Automatic access control system • Chip cards / transponder systems • Manual locking system • Safety Locks • Locking system with code lock Organizational Measures • Documented handout of keys, chip cards etc. • Reception • Visitors accompanied by employees • Care when selecting cleaning services System Access Control Access to information systems is granted exclusively on a need-to-know basis. The following measures are taken to prevent unauthorized data processing systems from being used: Technical Measures • Login with username + password • Use of monitored and up-to-date anti-virus protection • Firewall • Intrusion Detection Systems, in addition to SoftwareONE’s own Intrusion Detection Systems, the infrastructure is also protected by Microsoft security for Azure. Details can be found here Azure infrastructure security | Microsoft Docs • Mobile Device Management • MS Direct Access with IPSec tunnel to SoftwareONE’s data center • To access SoftwareONE’s managed cloud environments SoftwareONE run a VDI-based access solution with MFA but without any VPN connectivity from corporate network • Encryption of data carriers • Encryption Smartphones: Mobile handheld devices are set up in such a way that they cannot be used without entering an access password. The PINs have a minimum length of four characters. The devices are secured using the basic encryption of the manufacturer's methods • BIOS protection (separate password) • Automatic desktop lock • Encryption: All Devices are BitLocker encrypted – 256 Bit AES encryption • File shredder (min. level 4, cross cut) • External service provider for document shredding (DIN 66399) • Physical deletion of data media • Microsoft Azure securely erase or destroy drives used for storage that suffer hardware failure. When such devices are decommissioned, they are purged or destroyed according to NIST 800-88 Guidelines for Media Sanitation. Further details can be found here: xxxxx://xxx.xxxxxxxxx.xxx/en-us/trustcenter/privacy/you-own-your-data Organizational Measures • Manage user permissions: All accesses and identifiers ("accounts") are assigned exclusively on a person specific basis. The use of accounts by several persons (group accounts) is not permitted. If th...
