Misuse of customer data by staff

Engineers have the technical ability to read customer data while they support customer systems. A person who looked at or copied data without a reason would break the trust of the customer and the agreement.

Measures

Accepted because the access cannot be removed without stopping the support work, and the likelihood stays low with access logging, confidentiality clauses, and a disciplinary procedure. The ISMS Manager samples the access logs every quarter.