To ensure the security of our customers' information, we have implemented an Information Security Management System (ISMS) in accordance with the requirements of ISO/IEC 27001:2022 standard.
All the company policies, terms, and operational procedures are organized into a set of interconnected documents.
These documents are internal, but we will be happy to show them to you and provide further details in a dedicated audit session.
Business Continuity Plan
The structured framework that defines how the organization ensures the continued delivery of critical services and operations during and after disruptive events.It includes risk assessments, business impact analysis, continuity strategies, cloud provider selection, and recovery priorities to minimize downtime and safeguard essential functions.
Security Plan
This document describes the organization's security objectives, policies, controls, and responsibilities.
It details how information assets are protected and describes access control procedures and monitoring activities.
It also includes the roadmap for maintaining and improving the company and software (DPS) security.Disaster Recovery Plan
This plan describes the procedures, resources, and responsibilities needed to restore IT systems, infrastructure, and data after a disruption event.
It covers backup strategies, recovery time objectives (RTO), recovery point objectives (RPO), and step-by-step restoration processes.Employment Conditions & Company Policies
The set of formal documents defining employee rights, responsibilities, roles, and expected behaviors within the organization.
They include terms of employment, confidentiality agreements, acceptable use policies, code of conduct, and disciplinary measures.
These documents ensure that personnel understand and comply with legal, contractual, and security requirements stated in the Security Plan.
Below you will find all the requirements of the ISO 27001:2022 standard, and for each of them, where the arrow “→” is present, you can see how Servity complies.
Main Clauses
1. Scope
Not relevant for describing the compliance.
2. Normative references
Not relevant for describing the compliance.
3. Terms and definitions
Not relevant for describing the compliance.
4. Context of the Organization
The organization and its context are identified. → Business Continuity Plan, Security Plan, Security Framework.
Internal and external issues that may affect security, reliability, and performance.
The needs and expectations of interested parties are well described. → Business Continuity Plan, Security Plan, SLA (Service Level Agreement).
Relevant stakeholders and their information security requirements.
The scope of the ISMS is determined. → Security Plan, DPS Architecture, Security Framework.
The boundaries of the ISMS, including what is included and excluded (with justification).
Processes, activities, sites, information systems, and data are covered.
The ISMS is established.→ Security Plan, Security Framework.
The ISMS is established, implemented, maintained, and continually improved in accordance with the standard.
5. Leadership
Leadership and commitment are demonstrated. → Security Plan
The ISMS is supported by top management and integrated into business processes.
Resources needed for the ISMS are provided, and a continuous improvement of the ISMS is promoted.
The information security policy is established. → Security Plan, Employment Conditions & Company Policies
An information security policy appropriate to the organization’s purpose is established and maintained.
The policy is communicated within the organization and made available to interested parties.
Organizational roles, responsibilities, and authorities are assigned. → Security Plan, Employment Conditions & Company Policies
Roles and responsibilities related to information security are assigned and communicated.
Authorities for ISMS performance and reporting are defined and acknowledged.
6. Planning
Actions to address risks and opportunities are determined. → Business Continuity Plan, Security Plan, Secure Development Practices.
Risks and opportunities relevant to the ISMS are identified and addressed.
Information security risks are assessed using established risk assessment criteria.
Information security risks are treated through selected and implemented risk treatment options.
Information security objectives and planning to achieve them are established. → Security Plan, Secure Development Practices.
Information security objectives consistent with the policy are defined and documented.
Objectives are monitored, communicated, and updated as appropriate.
Plans for achieving the objectives are established, including responsibilities, resources, timelines, and evaluation methods.
Planning of changes is carried out. → Security Plan
Changes to the ISMS are planned and implemented in a controlled manner.
7. Support
Resources are provided. → Business Continuity Plan, Security Plan
Necessary resources for establishing, implementing, maintaining, and continually improving the ISMS are provided.
Competence is ensured. → Security Plan, Secure Development Practices.
Personnel performing work affecting the ISMS are made competent through education, training, or experience.
Awareness is promoted. → Security Plan, Employment Conditions & Company Policies, Secure Development Practices.
Personnel are made aware of the information security policy, their contributions to ISMS effectiveness, and the implications of non-compliance.
Communication is managed. → Security Plan
Internal and external communications relevant to the ISMS are determined, implemented, and maintained.
What, when, with whom, and how to communicate is ensured.
Documented information is controlled. → Security Plan
Required documented information is created, updated, and controlled.
Documented information required by the ISMS and the standard is protected and made available as needed (audit).
8. Operation
Operational planning and control are implemented. → Security Plan, Secure Development Practices.
Processes needed for the ISMS are planned, implemented, and controlled.
Criteria for these processes are established and applied.
Risks associated with operations are addressed and managed.
Information security risk assessment is performed. → Security Plan, Secure Development Practices.
Information security risks are assessed at planned intervals and when changes occur.
Assessment results are documented and used to guide risk treatment.
Information security risk treatment is applied. → Security Plan, Secure Development Practices.
Risk treatment plans are implemented and maintained.
Residual risks are accepted and communicated as appropriate.
Controls selected from Annex A or other sources are implemented and monitored.
9. Performance Evaluation
Monitoring, measurement, analysis, and evaluation are performed. → Security Plan
The performance and effectiveness of the ISMS are monitored, measured, analyzed, and evaluated at planned intervals.
Internal audits are conducted. → Security Plan, Secure Development Practices.
Internal audits of the ISMS are planned and performed at defined intervals.
Audit results are documented and communicated to relevant management.
Management reviews are conducted. → Security Plan
The ISMS is reviewed by top management at planned intervals.
Opportunities for improvement and changes needed to maintain the ISMS are identified and acted upon.
10. Improvement
Nonconformities and corrective actions are addressed. → Security Plan, Secure Development Practices
Nonconformities are identified and addressed.
Corrective actions are implemented to eliminate causes of nonconformities.
The effectiveness of corrective actions is verified.
Continuous improvement is ensured. → Security Plan.
The ISMS is continually improved to enhance information security performance.
Annex A - Controls
A.5 – Organizational Controls
Information Security Policies → Security Plan, Employment Conditions & Company Policies, Security Framework
Information security roles and responsibilities → Security Plan, Employment Conditions & Company Policies
Segregation of Duties → Security Plan, Employment Conditions & Company Policies
Management responsibilities → Security Plan, Employment Conditions & Company Policies
Contact with authorities → Security Plan, Data Processor Agreement
Contact with special interest groups → Security Plan, Secure Development Practices
Threat intelligence → Business Continuity Plan, Security Plan, Secure Development Practices
Information security in project management → Security Plan, Employment Conditions & Company Policies, Secure Development Practices
Inventory of information and other associated assets → Security Plan, Secure Development Practices
Acceptable use of information and other associated assets → Security Plan
Return of assets → Security Plan
Classification of information → Security Plan
Labelling of information → Security Plan
Information transfer→ Security Plan, Security Framework, GDPR Compliance
Access control → Security Plan, Account and Identity Security
Identity management → Security Plan, Account and Identity Security
Authentication information → Security Plan, Account and Identity Security
Access rights → Security Plan, Account and Identity Security
Information security in supplier relationships → Security Plan, Employment Conditions & Company Policies
Addressing information security within supplier agreements → Security Plan
Managing information security in the ICT supply chain → Security Plan, Servitly Privacy Management
Monitoring, review, and change management of supplier services → Security Plan
Information security for the use of cloud services → Business Continuity Plan, Security Plan
Information security incident management planning and preparation → Security Plan, Data Processor Agreement
Assessment and decision on information security events→ Business Continuity Plan, Security Plan, Secure Development Practices
Response to information security incidents → Business Continuity Plan, Disaster Recovery Plan, Data Processor Agreement
Learning from information security incidents → Security Plan
Collection of evidence→ Security Plan
Information security during disruption → Security Plan, Continuous Improvements
ICT readiness for business continuity → Business Continuity Plan, Security Plan, Secure Development Practices
Legal, statutory, regulatory, and contractual requirements → Employment Conditions & Company Policies
Intellectual Property Rights → Employment Conditions & Company Policies, Terms and Conditions
Protection of records → Security Plan, Data Isolation
Privacy and protection of personally identifiable information (PII) → Security Plan, Account and Identity Security, GDPR Compliance
Independent review of information security → Security Plan, Continuous Improvements
Compliance with policies, rules, and standards for information security → Security Plan
Documented operating procedures → Security Plan
A.6 – People Controls
Screening → Security Plan
Terms and conditions of employment → Security Plan
Information security awareness, education, and training → Security Plan, Employment Conditions & Company Policies, Continuous Improvements
Disciplinary process → Security Plan
Responsibilities after termination or change of employment → Security Plan
A.7 – Physical Controls
Physical security perimeters → Business Continuity Plan, Security Plan
Physical entry controls → Business Continuity Plan, Security Plan
Securing offices, rooms, and facilities → Business Continuity Plan
Physical security monitoring → Business Continuity Plan
Protection against physical and environmental threats → Business Continuity Plan, Security Plan
Working in secure areas → Business Continuity Plan, Security Plan
Clear desk and clear screen → Business Continuity Plan, Security Plan
Equipment siting and protection → Security Plan
Security of assets off-premises → Security Plan
Storage media → Security Plan
Supporting utilities → Business Continuity Plan, Security Plan
Cabling security → Business Continuity Plan, Security Plan
Equipment maintenance → Security Plan
Secure disposal or re-use of equipment → Security Plan
A.8 – Technological Controls
Endpoint User Devices → Security Plan
Privileged Access Rights → Security Plan, Account and Identity Security
Information Access Restriction → Security Plan, Employment Conditions & Company Policies, Account and Identity Security
Access to Source Code → Employment Conditions & Company Policies, Security Plan
Secure Authentication → Employment Conditions & Company Policies, Account and Identity Security
Capacity Management → Security Plan, Scalability, SLA (Service Level Agreement)
Protection Against Malware → Security Plan
Management of Technical Vulnerabilities → Security Plan, Secure Development Practices
Configuration Management →Security Plan, DPS Configuration Console
Information Deletion → Security Plan, Rights for Individuals
Data Masking → Data Masking and Filtering
Data Leakage Prevention → Employment Conditions & Company Policies
Information Backup → Disaster Recovery Plan
Redundancy of Information Processing Facilities → Business Continuity Plan, Disaster Recovery Plan, DPS Architecture
Logging → Security Plan, Account and Identity Security
Monitoring Activities → Monitoring and Logging
Clock Synchronization → Microservices
Use of Privileged Utility Programs → Security Plan
Installation of Software on Operational Systems → Secure Development Practices
Network Security → Architectural Security
Security of Network Services → Architectural Security
Segregation of Networks → Architectural Security
Web Filtering → Architectural Security
Use of Cryptography → Disaster Recovery Plan, REST API Security, IoT Connectors Security, Secure Development Practices
Secure Development Life Cycle → Secure Development Practices, SLA (Service Level Agreement)
Application Security Requirements → Secure Development Practices
Secure System Architecture and Engineering Principles → Secure Development Practices
Secure Coding → Secure Development Practices
Security Testing in Development and Acceptance → Secure Development Practices
Outsourced Development → NOT in place