Attachment 1

Technical and organizational measures for data processing security

The following describes which technical and organizational measures are defined to ensure data protection and data security. The aim is to ensure in particular the confidentiality, integrity and availability of the information processed in the company. The structure is based on the internationally recognized standard DIN ISO/IEC 27002.

01. Guideline

The data protection guideline of WiredMinds GmbH contains the guiding statements of the management regarding the handling of personal data in the company. All employees, freelancers and supporting companies are obliged to observe these central regulations. The achieved IT security level of the organizational units, processes and systems is monitored by a combination of of periodic audits and continuous controls. 

Monitoring of ongoing operations is carried out in coordination with the security officer. A review of the security policy is conducted at least annually, unless an essential change requires it earlier.

This ensures the ongoing adequacy, suitability and effectiveness of the policy. The Safety Officer is the person responsible for the safety policy and has the responsibility to develop, revise, and review it. 

02. Information security organization

The managers of WiredMinds GmbH are responsible for the full implementation of the IT security principles in their organizational unit and for fulfilling the IT security tasks assigned to them. tasks assigned to them.

Information security roles and responsibilities are defined in the IT security organization. Conflicting roles and responsibilities are segregated to reduce the potential for unauthorized or unintended modification or misuse of our company’s assets. 

We have a process in place to determine when and by whom relevant authorities are notified and identified data privacy and information security incidents are reported in a timely manner. We also maintain ongoing contact with special interest groups to keep abreast of changes and improvements in the area of data privacy and information security.

In our projects, data privacy and data security is part of all phases of our project methodology. Through our respective policies and processes on teleworking and the use of mobile devices, we ensure data privacy and data security in these areas as well.

03. Personnel security

We have carefully selected our employees and reviewed their suitability for their roles in the company. We have defined their responsibilities in job descriptions and regularly check whether the employees comply with them. Before starting their employment, all employees sign a confidentiality and data protection agreement which remains in force after the end of their employment. Employees are trained in data privacy and data security, and in particular training courses are refreshed when they change functions. They are therefore aware of their responsibilities in this regard.

In a documented process for the period before, during and after termination of the employment relationship, we ensure that personal data is protected and data security is guaranteed. This also includes measures in the event of a data protection breach.

04. Management of values

We inventory and maintain all assets (such as equipment, notebooks, smartphones) and information related to personal data. 

We have designated responsible parties to protect these assets, who are responsible for the lifecycle of an asset.

Documented rules have been established for the permissible use of our assets. The return of these assets is documented. 

Our information and data are classified and labeled based on legal requirements, their value, criticality, and sensitivity to unauthorized disclosure or modification. 

In accordance with this classification scheme, we have developed and implemented documented procedures for handling our assets. We do not usually transfer data on removable media, but only in encrypted form via verified communication channels. In exceptional cases, we can only deviate from this practice if instructed to do so in writing by the client. 

We dispose of data carriers that are no longer required securely, using a documented procedure and obligated certified service providers.

05. Access control

We have regulated and documented measures in place to ensure that authorized persons only have access to personal data for which they are authorized to view and process.

Authorizations to access IT systems are granted via a regulated procedure based on a documented and restrictive authorization concept. We have regulated and implemented access to networks and network services.

It is ensured that only authorized users have access to systems and services and that unauthorized access is prevented; in particular, there is a formal process for registering users that enables the assignment of access rights. We grant our administrative rights in a restricted and controlled manner.

We have a documented and regulated process for handling passwords.

Actual and target status of user access rights are regularly compared. If necessary, these are withdrawn or adjusted.

We restrict access to our data as needed and control access to our systems and applications through a secure login process. We employ a system for using strong and secure passwords.

The use of utilities that may be capable of circumventing system and application protections is restricted and closely monitored.

06. Cryptography

The appropriate and effective use of cryptography to protect the confidentiality, authenticity, or integrity of information is ensured. To this end, we have implemented a policy on the use of cryptography within the company, including the management of cryptographic keys, which is appropriate to the need for protection.

07. Physical and environmental security

We have documented and regulated measures in place to prevent unauthorized persons from gaining access to data processing equipment used to process or use personal data. These include, but are not limited to:

• The business premises are located on the 3rd floor of an office building and are used exclusively
• The central entrance is monitored
• Doors to secure areas are always closed
• Visitors or external service providers are admitted individually
• Fire protection is provided by our hosting partner
• There are security areas to which only specially authorized persons have access
• IT rooms are locked separately and can only be opened by authorized persons
• Supply facilities are protected against power failures and malfunctions
• The security of cabling is observed
• Maintenance of systems is planned and implemented
• Removal and changes to systems and information are regulated
• The security of off-premises systems is observed
• Disposal or reuse of equipment is regulated
• Unattended user devices are protected via an automatic screensaver and automatic hard drive encryption
• Clean desk and screen lock policies are implemented

08. Operational security

We have regulated and documented measures in place to ensure the proper and secure operation of information and data processing facilities. These include, among other things, control in the event of a change to the information-processing facilities, as well as control and regular measurement of our capacities and resources to ensure the availability of the required system performance. For example, the following values, among others, are continuously monitored on an up-to-date basis:

• Hard disk status and available memory
• Raid status
• Services and status of all virtual machines
• Failed login attempts
• Memory usage of the storages and main memory
• Ethernet utilization
• Number of RDP sessions of the individual terminal servers
• Throughput and utilization of the firewall
• Checking the accessibility of all servers is possible via monitoring
• Accessibility and throughput of the switches

A protected procedure for data backup has been implemented by us and is documented.

Standard maintenance windows are defined. Additional necessary windows are announced at least 10 days in advance.

In our company, it is essential to separate development, test and operating environments, so we pay special attention to this.

Measures for detection, prevention and recovery to protect against malware have been taken and are regularly updated.

We have centrally monitored and protected event logging and have privacy measures in place in the event that sensitive personal data is stored. All logging equipment and logging information, including administrators and operator logs are protected from tampering and unauthorized access.

Our clocks are synchronized centrally with a single reference time source.

We have a centralized procedure for the controlled installation of software on systems in our company.

There is a list of our technical assets and regulated, documented handling in the event of a technical vulnerability, which includes our patch management with defined responsibilities.

We have centrally implemented regulations for restrictions on software installations.

In the event of an audit review of our information systems, we have defined measures to minimize disruptions to business processes as far as possible. 

09. Communications security

The security of our personal data and information stored in networks and network services is imperative. Therefore, we have implemented documented measures that manage, control and secure our networks.

Information services, users and information systems are kept separate as needed.

We have policies and procedures in place for information and data transfer, as well as information transfer agreements with external entities (e.g., CRM vendors).

Our electronic messaging is appropriately protected. For example, among other things, we have measures in place to protect messages from unauthorized access, alteration, or denial of service that comply with the classification scheme adopted by the organization (protection class 1_E2).

To protect our data, we enter into confidentiality or non-disclosure agreements as needed, which we review regularly.

It is ensured that data and information security is an integral part throughout the lifecycle of our systems. This also includes the requirements for and securing of information systems that provide services via public networks. Transaction protection for application services is performed on an as-needed basis. In addition, we have established a system change management process to ensure the integrity of the system, applications, and products from the early design phases through any subsequent maintenance.

When changes are made to operating platforms, business-critical applications are reviewed and tested to ensure there is no negative impact on organizational security and customer applications. We have a managed process for analyzing, developing, and maintaining secure IT systems.

Acceptance testing programs and associated criteria are established for new information systems, upgrades, and new releases. Our test data is carefully selected, protected and controlled.

10. Acquisition, development and maintenance of systems

Ensuring that data and information security is an integral part throughout the lifecycle of our systems. This also includes the requirements for and securing of information systems that provide services via public networks. Transaction protection for application services is performed on an as-needed basis. In addition, we have established a system change management process to ensure the integrity of the system, applications, and products from the early design phases through any subsequent maintenance.

When changes are made to operating platforms, business-critical applications are reviewed and tested to ensure there is no negative impact on organizational security and customer applications. We have a managed process for analyzing, developing, and maintaining secure IT systems.

Acceptance testing programs and associated criteria are established for new information systems, upgrades, and new releases. Our test data is carefully selected protected and controlled.

11. Supplier relations

We carefully select our suppliers in advance and review their suitability with regard to maintaining data and information security protection.

Documented agreements ensure the protection and confidentiality of our assets and data. Suppliers are required to take technical and organizational measures to ensure this.

There is a regulated and user-defined access authorization to the values and data that are absolutely necessary for the respective supplier.

Suppliers may only engage additional suppliers with our consent in order to ensure a secure supply chain.

We regularly conduct a review of our suppliers’ data protection and data security measures to maintain the agreed level. Assigned authorizations are also subject to continuous documented monitoring.

After termination of the supplier relationship, they are obliged to destroy the data and assets received from us. In addition, the maintenance of confidentiality applies indefinitely.

12. Information security and data privacy incident handling

Our company has a regulated, documented process for handling information security and data privacy incidents to ensure a consistent and effective approach in this regard. Employees are required to report all data privacy and security incidents immediately and receive regular training in this regard. We have installed a reporting system that forwards events to an intervention team to ensure a rapid response. All events are documented, classified and evaluated. The implemented intervention team has precise guidelines on how to respond to an event.

Together with the management, improvement measures resulting from the findings and the collected evidence of an event are discussed and implemented on a regular basis..

13. Information security aspects of business continuity management

As part of information security, the intended availability of systems is specifically assessed and documented. From the requirements, we derive the technical and organizational specifications, such as redundant systems / connections or corresponding planning, and implement them in a consistent and controlled manner.

An overarching emergency plan forms the framework with regard to the corresponding instructions for action for selected documented emergency scenarios.

Continuously updated exercise plans for testing the measures implemented and documentation of the execution of corresponding tests round off the emergency management. All servers and storage systems are leased from a selected data center. Based on the contractual agreements, there is a permanent claim to availability against the service provider.

14. Compliance

We have identified, documented, and keep up-to-date all relevant legal, regulatory, self-imposed, or contractual requirements, as well as our company’s procedures for complying with these requirements.

Appropriate procedures have also been implemented to ensure compliance with legal, regulatory, and contractual requirements relating to intellectual property rights and the use of proprietary software products.

In accordance with legal, regulatory, contractual and business requirements, we protect records and personal data as needed. Annual activity reports by the data protection officer document the measures taken.

We observe the regulations on cryptographic measures for this purpose.

To ensure the protection of our information and data, we regularly conduct independent audits of our information security and data privacy levels, our security and data privacy policies, and our compliance with technical requirements.