Technical and organizational measures of Business Driver ("TOM")
Annex 4 - Business Driver technical and organizational measures
Digital Solution pays close attention to the security and protection of such Personal Data.
For the following description of the status quo of the elementary data protection measures, it is not possible to cover all the security measures adopted by Digital Solution. In particular with regard to data protection and data security, it is not possible to provide detailed descriptions of the confidential measures, since the protection of security measures to avoid unauthorized disclosure is at least as important as the security measure itself.
The Customer is encouraged to speak about every single issue concerning the technical and organizational measures with the Customer's account manager at Digital Solution or, if applicable, with the Digital Solution DPO ([email protected]).
Data protection from design and data protection by default (Art. 25 Section 2 of the G DPR)
In Digital Solution, data protection is taken into account as soon as possible using data protection-compatible settings sets ("Data protection from design and data protection by default") to avoid illegal processing or improper use of data. By adopting appropriate sets of technical settings, we intend to guarantee the collection and processing of only the Personal Data that are actually necessary for a specific purpose (Principle of data minimization).
To obtain low-risk processing of personal data, the following protective measures are adopted, inter alia:
- Minimize the amount of personal data
- Perform pseudo anonymization or data encryption as soon as possible
- Create transparency in relation to procedures and data processing
- Delete or anonymize data as soon as possible
- Minimize access to data
Controlling access to data
Digital Solution applies detailed policies to which personnel with access to information systems are obliged to comply and which are aimed at ensuring conduct suitable for ensuring compliance with the principles of confidentiality, availability and integrity of data in the use of IT resources.
Digital Solution defines the access profiles in compliance with the least privilege ("minimum privilege") necessary for the execution of the assigned tasks. The authorization profiles are identified and configured before the start of the treatment, in order to limit access to only the data necessary for the execution of the task that the individual must perform. These profiles are subject to periodic checks aimed at verifying the existence of the conditions for the conservation of the profiles assigned.
Authentication credentials - The systems are configured with suitable methods to allow access only to subjects with authentication credentials that allow their univocal identification. Among these, code associated with a keyword, reserved and known only by the same; authentication device in possession and exclusive use of the user, possibly associated with an identification code or a single-use keyword ("OTP").
Password - With regard to the basic characteristics or, obligation to modify the first access, minimum length, absence of elements easily referable to the subject, rules of complexity, expiry, history, evaluation of robustness, display and archiving, the keyword is managed in accordance with the industry best practices. Punctual instructions are provided to the subjects to whom the credentials are attributed in relation to the methods to be adopted to ensure their secrecy.
Logging - The systems are configurable with methods that allow the tracing of accesses and, where appropriate, of the activities carried out by the different types of users protected by adequate security measures that guarantee their integrity.
Transmission control
The transfer of Personal Data to a third party (e.g. customers, subcontractors, service provider) is carried out only in the presence of a specific contract and only for a specific purpose. If Personal Data is transferred to companies whose headquarters are outside the EU / EEA, Digital Solution establishes the presence of an adequate level of data protection at the destination office or organization in compliance with the data protection requirements of the European Union, e.g. using contracts based on the contractual clauses of the EU model.
Communication line security - As far as its competence is concerned, Digital Solution has adopted secure communication protocols in line with what technology makes available (https, tsl, sftp, ftps).
Checking availability
The availability check is intended to ensure the protection of personal data from accidental destruction and loss.
If Personal Data are no longer necessary for the purposes for which they were processed, they are immediately deleted. It should be noted that with each cancellation, the Personal Data, in the first instance, are only blocked and then definitively deleted at a later time. This measure is taken to avoid accidental cancellations or intentional damage.
For technical reasons, copies of Personal Data may be present in the backup files and can be made by mirroring the services. Without prejudice to the obligation of retention of Digital Solution data provided by law (see the Data Processing Agreement), these copies are also deleted, if necessary, with a delay determined technically. The availability of the systems themselves is guaranteed in accordance with the necessary level of security through the relative security measures (e.g. mirroring of hard disks, RAID systems, etc.).
Backup & Restore - Appropriate measures are taken to ensure the restoration of access to data in the event of damage to the same or electronic tools, in certain times compatible with the rights of the interested parties. Where the contractual agreements provide for it, an operational continuity plan integrated, where necessary, with the disaster recovery plan is used; they guarantee the availability and access to the systems even in the event of significant negative events that persist over time.
Protection from viruses and malicious software - The systems are protected against the risk of intrusion and the action of programs by activating suitable electronic instruments updated periodically. Antivirus tools that are kept constantly updated are in use.
Separation check
Personal data are used only for internal purposes (e.g. as part of the related relationship with the customer). A transfer to a third party, such as a subcontractor, is carried out exclusively in compliance with contractual agreements and data protection legislation.
Employees are given instructions to collect, process and use Personal Data only in the context and for the purposes set by the tasks they have to perform (e.g. the provision of the service). At a technical level, multi-client functions, separation of functions and separation of production and test systems are used for this purpose.
Data Center - Physical access to the Data Center is limited to authorized parties only
For details of the security measures adopted with reference to the data center services provided by the Additional Data Processors, as identified in the DPA, reference is made to the indicated security measures described by the same Additional Managers and made available on the relevant institutional sites at the following addresses (or to those that will subsequently be made available by the Additional Managers):
For data center services provided by Amazon Web Services https://aws.amazon.com/it/compliance/data-center/controls/
For the Data Center services provided by Microsoft: https://www.microsoft.com/en-us/trustcenter
For the Data Center services provided by Hetzner Gmbh: https://www.hetzner.com/rechtliches/datenschutz
For the Data Center services provided by Aruba Spa: https://www.cloud.it/gdpr-protezione-dati-normativa-ue.aspx
Hardening
Specific hardening activities are in place to prevent the occurrence of security incidents by minimizing the architectural weaknesses of operating systems, applications and network equipment considering - in particular - the decrease in risks associated with system vulnerabilities, the decrease in risks connected to the application context present on the systems and the increase in the protection levels of the services provided by the systems themselves.
Vulnerability Assessment & Penetration Test
Digital Solution periodically carries out vulnerability analysis activities aimed at detecting the state of exposure to known vulnerabilities, both in relation to infrastructure and application areas, considering the systems in operation or under development.
If deemed appropriate in relation to the identified potential risks, these checks are periodically integrated with specific Penetration Test techniques, through intrusion simulations that use different attack scenarios, with the aim of verifying the level of security of applications / systems / networks through activities that aim to exploit the detected vulnerabilities to circumvent the physical / logical security mechanisms and have access to them.
The results of the verifications are punctually and examined in detail to identify and implement the improvement points necessary to guarantee the high level of safety required.
Management of the response to an unforeseen event
Digital Solution deals with security-related events using standard operating procedures and processes based on tools based on "ITIL Best Practice", in order to restore trouble-free operation as soon as possible. Security incidents are monitored and analyzed promptly by the Digital Solution organization for security management. Depending on the nature of the event, the necessary and competent specialists and assistance teams from Digital Solution will participate in the process. At the moment, this Management of the response to an unexpected event is being activated.
Certifications
At the moment, Digital Solution is evaluating the possibility of activating the processes for obtaining the following certifications:
- DIN EN ISO 9001: 2015 (Quality management)
- ISO / IEC 27001: 2013 (Information security management)
- ISO / IEC 20000-1: 2011 (IT service manager)