Technical and Organisational Measures (TOMs)

These technical and organisational measures apply to Netstream AG and Netstream Cloud AG.

Subject matter of this document

This document summarises the technical and organisational measures within the meaning of Art. 8 para. 1 FADP. It describes the measures by which the controllers protect personal data.

The measures are embedded in a certified information security management system (ISMS) in accordance with ISO/IEC 27001:2022 and are guided by the protection objectives of confidentiality, integrity, availability and resilience.

1. Confidentiality

1.1 Physical access control

Measures that prevent unauthorised persons from gaining physical access to data processing facilities.

• Automatic access control system with electronic locking system and individual authorisation management
• Biometric access barriers in data centres
• Video surveillance in security-relevant areas
• Doorbell system with camera at office premises
• Restrictive access policies and security personnel
• Key management with a documented key register
• Visitors accompanied exclusively by authorised employees
• Alarm systems at all relevant entrances
• Contractual safeguards with service providers, including non-disclosure agreements
• Careful selection of cleaning staff and contractual safeguards
• Remote working policy with defined security requirements

1.2 System access control

Measures that prevent data processing systems from being used by unauthorised persons.

• Personal authentication with user name and password in accordance with recognised industry standards
• Central password policy with complexity requirements and regular changes
• Two-factor authentication (2FA) for all supported systems
• Central password manager for the secure management of all access credentials
• Endpoint Detection and Response (EDR) on all managed end devices
• Use of firewalls and network segmentation
• Encrypted Wi-Fi in accordance with the current standard, with a separate guest network
• Mandatory VPN for all remote access
• Full encryption of mobile data carriers and notebooks
• Remote wipe capability for mobile end devices in the event of loss or theft
• Automatic screen lock in the event of inactivity
• Automatic account lockout after failed login attempts
• Deactivation of inactive accounts
• Separate accounts for administrative tasks

1.3 Data access control

Measures that ensure that only data for which an authorisation exists can be accessed.

• Role-based access control with a documented authorisation concept
• Minimal granting of rights according to the need-to-use principle
• Logging of access to applications, in particular when data is entered, modified and deleted
• Regular review of access authorisations
• Professional destruction of data carriers and files
• Physical erasure of data carriers before their reuse
• Secure storage of data carriers in accordance with the Clean Desk / Clear Desk Policy
• Regulated withdrawal of access rights upon departure or change of role

1.4 Separation control

Measures that ensure that data collected for different purposes is processed separately.

• Strict separation of production and test environments
• Logical client separation in all relevant applications
• Network segmentation with defined security zones
• Differentiated authorisation concept with specification of database rights

1.5 Pseudonymisation and data minimisation

• Principle of data minimisation for every collection of data
• Anonymisation/pseudonymisation of personal data upon disclosure or after expiry of the retention period
• Data masking for test data; exceptions are documented in exception management

2. Integrity

2.1 Transfer control

Measures that ensure that data cannot be read, copied, modified or removed without authorisation during transmission or storage.

• Encrypted data transmission in accordance with current industry standards
• Encryption of data at rest in accordance with recognised cryptographic standards
• VPN tunnels for remote access to internal resources
• Provision of data exclusively via encrypted connections
• No transmission of sensitive data by e-mail; use of secure file-sharing platforms
• Documentation of data recipients and retention periods
• Supplier management in accordance with ISO 27001 with regular reviews
• Automated monitoring of cryptographic configurations

2.2 Input control

Measures that ensure that it can subsequently be verified whether and by whom data has been entered, modified or removed.

• Logging of the entry, modification and deletion of data
• Traceability through individual user names
• Central logging infrastructure with tamper-proof storage
• Defined minimum retention periods for logs
• Access to logs exclusively for authorised persons
• Regular review and analysis of logs

3. Availability and resilience

3.1 Availability control

Measures that ensure that personal data is protected against accidental destruction or loss.

• Data centres whose design is based on the Tier IV standard, with full redundancy
• Fire and smoke detection systems and automatic fire extinguishing systems
• Climate monitoring in server rooms
• Uninterruptible power supply (UPS) with emergency power system
• Redundant network connections
• Redundancy architecture for all business-critical services
• Monitoring and planning of system capacities to avoid bottlenecks
• Regular automated backups with encrypted storage
• Storage of data backups at a secure, off-site location
• Documented backup and recovery concept with regular tests
• Automated monitoring systems with early warning and escalation processes
• On-call organisation for prompt response to system faults
• Documented emergency plan with regular tests
• Incident management process with defined escalation levels

4. Procedures for regular review, assessment and evaluation

4.1 Information security and data protection

• Certified ISMS in accordance with ISO/IEC 27001:2022
• Internal Chief Information Security Officer (CISO)
• External data protection advisor
• Obligation of all employees to maintain data secrecy
• Regular training in data protection and information security
• Regular awareness campaigns, including simulated phishing tests
• Maintenance of a record of processing activities (Art. 12 FADP)
• Systematic risk management with documented risk analysis and risk treatment
• Classification of all information according to a defined scheme
• Policy on the secure use of AI systems
• Regular internal and external audits
• Annual management review with definition of objectives and KPI measurement
• Compliance with the duties to inform under Art. 19 et seq. FADP

4.2 Incident response management

• Documented incident management with defined escalation levels
• Reporting process for data security breaches to the FDPIC (Art. 24 para. 1 FADP) and to the data subjects (Art. 24 para. 4 FADP)
• Involvement of the data protection advisor in data protection incidents
• Endpoint Detection and Response (EDR) on managed end devices
• Firewalls with network segmentation
• Regular updating of all systems and applications
• Vulnerability management with systematic recording, assessment and remediation
• Preservation of evidence in a tamper-proof environment
• Lessons learned after security incidents

4.3 Data protection by default

• Training of employees in Privacy by Design and Privacy by Default
• Data collection limited to the minimum required for the purpose
• Requirements for secure software development and code review
• Data masking and anonymisation for test data

4.4 Control of processing on behalf

• Written instructions to contractors by means of data processing agreements
• Careful selection of contractors with documented assessment
• Ongoing review and regular auditing of suppliers
• Non-disclosure agreements for suppliers with access to confidential information
• Ensuring the destruction of data after termination of the engagement
• Obligation of contractors to maintain data secrecy