Security of processing
Art. 32
-
Last updated
Mandatory
Catalog reference
Implement technical and organisational measures appropriate to the risk — e.g. encryption and pseudonymisation, ensuring ongoing confidentiality, integrity, availability and resilience of systems, the ability to restore data after an incident, and a process to regularly test and evaluate the effectiveness of those measures.
Narrative — how we satisfy this requirement
The technical and organisational measures are set out in the ISMS and tested by the yearly penetration test and the quarterly external vulnerability scan.