Technical and Organisational Measures

This English version is provided for convenience only. The German version is legally binding; in the event of any discrepancy between the two versions, the German version shall prevail.

General measures

An information security management system (ISMS) is operated on the basis of ISO 27001 – initial certification: 5 July 2026, period of validity: until 4 July 2029; TrustedCloud certification: 14 June 2014.

• The information security, IT usage and data protection policy is accessible to all employees and is updated regularly or as required
• A data protection officer has been appointed and reports directly to the management
• Risk management has been established and reports to the management
• Emergency planning and a recovery plan have been established
• An incident management system has been established
• All employees are obliged to comply with data protection and confidentiality

Confidentiality

Physical access control

Measures to prevent unauthorised persons from gaining access to data processing facilities with which personal data are processed and used:

• Access control system
• Door security in the office building (electric door openers with access logging and logged key issuance in accordance with key management)
• Additional biometric access security for the data centre and electronic door security for two-stage physical access control
• Establishment of protection zones and definition of access rules
• Visitor rules and logging of all visitors
• Visitors and suppliers are subject to continuous supervision depending on the protection zone
• All-round video surveillance of the building exterior with tamper detection and recording; complete video surveillance of the data centre interior
• Intruder alarm system connected to the security service

System access control

Measures to prevent data processing systems from being used by unauthorised persons:

• Granting of authorisations in accordance with the role and authorisation concept on a need basis
• Definition of authorisations by the head of technology and the management
• Logged assignment of authorisations by the head of technology
• Workstation PCs are protected by employees’ local passwords
• In the intranet, password policies are enforced via MS AD (including special characters, minimum length, regular password changes)
• Employees’ local systems are updated regularly whenever updates are released
• Automatic locking (e.g. password or pause function)
• Upstream physical firewall with IDS and IPS
• Use of virus scanners
• Physical separation of networks
• Monitoring of network traffic

Data access control

Measures to ensure that authorised persons can access exclusively the data covered by their access authorisation and that personal data cannot be read, copied, modified or removed without authorisation during processing, use and after storage:

• Passwords are issued exclusively by authorised staff to persons designated by the Client
• On the Contractor’s side, instructions are communicated via an ITIL-compliant ticket system
• Authorisations for the processing of personal data are controlled and logged via Active Directory
• Logging of logins to the systems
• Destruction of data media in accordance with the data media destruction concept
• Where the Customer processes personal data on its systems, the Customer itself is primarily responsible for securing the data; if this responsibility is assigned, the security mechanisms are to be reviewed by the Customer at irregular intervals and objected to where necessary

Separation control

Measures to ensure that data collected for different purposes can be processed separately:

• All data can be processed separately from one another owing to the way in which they are stored
• Exclusive use of software that provides multi-tenancy capability
• Separation of the processing systems
• Separation of systems into production and test environments
• Customers have no mutual access to other customers’ systems

Integrity

Transfer control

Measures to ensure that personal data cannot be read, copied, modified or removed without authorisation during electronic transmission, during their transport or during their storage on data media:

• Personal data are disclosed only at the request of authorised persons or institutions
• Where personal data are transferred to authorised persons or institutions, this is done in encrypted form – at the express request of the Customer also unencrypted
• Upon disposal, data media containing personal data are wiped several times using different erasure methods; the data medium is then destroyed and properly disposed of

Input control

Measures to ensure that it can subsequently be checked and established whether and by whom personal data have been entered into, modified in or removed from data processing systems:

• Logging of system activities by a monitoring system
• Partially automated evaluation of log files
• Logging of all work in an ITIL-compliant ticket system
• New personal data can only be entered by authorised persons
• Access to the data processing system is logged (see data access control)

Availability and resilience

Availability control

Measures to ensure that personal data are protected against accidental destruction or loss:

• RAID (redundant writing of data to hard disks)
• Backup copies are created, if commissioned by the Client, in the form of backups in accordance with the backup concept – frequency: daily or as requested by the Customer; retention period: redundant, 1–5 weeks or as requested by the Customer; file format: binary, proprietary encrypted
• Storage location: depending on the order, dedicated storage or server systems of the Client in its own or a third-party data centre, or global storage systems of the Contractor with internal fault tolerance and access controls
• Depending on the order: configuration of the server systems with hardware RAID (mirroring of the hard disks), redundant power supply units
• Regular testing of the backups for functionality
• Implementation of a disaster and recovery concept, emergency concept and recovery plan
• Data centre: uninterruptible power supply (UPS), emergency diesel generator, redundant air conditioning, early fire detection system, regular firefighting training for employees

Procedures for regular review, assessment and evaluation

Data protection management

• Annual review of the risk assessment for the processing of personal data
• Annual review of the technical and organisational measures for appropriateness and state of the art
• Maintenance of a central data protection management system
• Regular internal data protection audits
• Regular training and awareness-raising measures on data protection and information security

Order control

Measures to ensure that personal data processed on behalf of the Client can be processed only in accordance with the instructions of the Client:

• Orders from customers that require the processing of personal data are logged in a ticket system; access control is configured for the ticket system
• Orders can be placed electronically only from verified contact addresses (email and fax)
• Orders can likewise be placed by post in written form only from verified addresses
• Persons placing orders must have been authorised by the contracting party to place orders