Security

A specification for an information security management system (ISMS).

An ISMS is a framework of policies and procedures that includes all legal, physical and technical controls involved in an organisation's information risk management processes.

TechnologyOne acquired this in 2011 to create a global policy framework that enabled us to include security as part of the design process.

It demonstrates that we are following international best practice to mitigate threats.

A cloud computing code of practice for information security.

This code of practice provides recommendations to assist with the implementation of cloud-specific information security controls.

TechnologyOne acquired this in 2016 to align our processes and controls with cloud specific providers.

It confirms for customers that we have adopted international best practice surrounding cloud specific threats and risks.

A code of practice for protection of personal information in the cloud.

TechnologyOne acquired this in 2016 to demonstrate to customers that we protect their personal identifiable information.

Our alignment with this internationally recognised code of practice demonstrates our commitment to the privacy and protection of customer information.

It demonstrates to our customers that we have a system of controls in place that specifically address the privacy protection of their content.

An assurance standard, designed to demonstrate that adequate internal controls are in place from a financial perspective. It supersedes SAS70.

TechnologyOne acquired this standard in 2012 as one that auditors of customers could rely upon, and that allowed us to streamline our operations.

This report assists the financial auditors of our customers to determine the robustness of their financial data stored in the TechnologyOne SaaS solution.

Existing SaaS customers of TechnologyOne are entitled to request the ISAE 3402 SOC 1 audit report*.

This report can be requested by sending a formal email request to the SaaS Compliance email: saas_compliance@technologyonecorp.com

*Restrictions apply, email SaaS Compliance for further information

An assurance standard, designed to prove that adequate internal IT controls exist. It relates to: security, availability, privacy, confidentiality and processing integrity.

TechnologyOne acquired this standard in 2017 to satisfy customer need for information and evidence on auto-scaling, security practices and the operational process for the TechnologyOne SaaS solution.

This standard demonstrates to customers that security practices are in place to: promote security and prevent unauthorised access, ensure system availability, enable processing integrity, protect confidentiality and protect privacy.

Existing SaaS customers of TechnologyOne are entitled to request the AT 101 SOC 2 audit reports*.

This report can be requested by sending a formal email request to the SaaS Compliance email: saas_compliance@technologyonecorp.com

*Restrictions apply, email SaaS Compliance for further information

IRAP provides the framework to endorse individuals from the private and public sectors to provide cyber security assessment services to Australian governments.

TechnologyOne sought this as a response to feedback from our Australian federal government customers, who indicated that this is an important part of their risk assessment process when considering cloud services.

TechnologyOne has completed SOA, Stage 1 audit, Stage 2 audit and has been recommended for certification in 2017 following an independent audit, performed by an accredited IRAP auditor. The level of certification we have been recommended for is: Unclassified DLM up to and including Sensitive.

Certification is achieved after ASD has performed a review of compliance, compensating controls, threats at the time of assessment and may recommend the introduction of additional security controls.

ASD is the certification authority for inclusion on the Certified Cloud Services List. There is no established timeframe or process that defines the steps that are followed after being recommended for certification and receiving certification.

This demonstrates to customers that the TechnologyOne SaaS solution has been assessed for the implementation, appropriateness and effectiveness of our security controls.

* Full certification is pending. Please refer to full details above.

The EU’s General Data Protection Regulation (GDPR) became effective on the 25th May 2018.

The GDPR is an EU regulation targeted at harmonising the hugely varied data protection laws across Europe.

The UK Government is currently reviewing the latest generation of Data Protection Laws that build on top of and extends the GDPR. The UK's third generation of data protection law has now received the Royal Assent and its main provisions commenced on 25 May 2018.

Shared Responsibilities for GDPR

The two main parties identified within the GDPR regulations are:

• Data Controllers - “A controller is the entity that determines the purposes, conditions, and means of the processing of personal data”
• Data Processor - “the processor is an entity which processes personal data on behalf of the controller.”

Both parties have responsibilities in maintaining the security and privacy of Personally Identifiable Information (PII).

TechnologyOne as Data Processor

In delivering our SaaS service to our customers, TechnologyOne has a built a class leading security and compliance program that is designed to provide customers with a high level of surety that their Security and Privacy needs are in good hands.

TechnologyOne audit reports and other materials are available for customers to request and use to meet their own compliance obligations. This compliance program is continually updated as additional guidelines or amendments to existing standards are released. Some of the key areas as they relate to GDPR are described below.

Security: TechnologyOne has developed a security framework that passes the highest levels of external verification, testing and scrutiny. There is a continual program of testing and audit by external third parties to verify the security of the system along with the integrity of the people and processes that manage that system.

Privacy: TechnologyOne has a robust Privacy and Security incident handling plan for the handling of issues related to Security or Privacy breaches and concerns. This handles all required notifications and communication with required regulatory bodies and has the customer (Data Controller) at the centre of process to ensure the fastest, most rigorous and least disruptive handling of reported incidents.

Continuous Improvement: The legislative landscape is shifting substantially with regard to privacy and is being updated regularly with country specific requirements. The TechnologyOne Compliance Program ensures that all changes and new requirements are incorporated in a timely manner. This is underpinned by a continual program or Privacy Impact Assessments (PIA) across all aspects of the Data Processor offering to our customers.

Customer as Data Controller

As well as leveraging the compliance capabilities TechnologyOne has as a Data Processor, Customers, (as Data Controllers) are able to utilise a range of capabilities and functions to meet their Data Controller obligations’:

Authentication and Access rights: TechnologyOne offers a suite of capabilities to help customers comply with the management of access rights under the GDPR. Data Controllers are able to manage and control their users’ access to the application and the data they are able to access once logged in. A key component of this is the implementation of role-based access along with the Data Controller determining and configuring their preferred authentication platform.

Data Subject rights: TechnologyOne offers a number of mechanisms by which the Data Controller can meet their GDPR obligations as it relates to data subject, such as ‘access, ‘rectification’, ‘erasure’, ‘portability’ etc.

TechnologyOne is committed to complying with the GDPR and all applicable privacy and data protection laws and regulations in its operations and delivery of services to its customers. We are also committed to supporting and assisting our customers to meet their GDPR and privacy obligations.

TechnologyOne has implemented a compliance program with assistance from external advisers to meet the "processor" obligations as described under the GDPR.

TechnologyOne has provided a GDPR Product Assistance paper that aims to assist our customers to comply with their obligations. This paper is available to customers on request by emailing privacy@technologyonecorp.com.

We note that there are currently no approved certification bodies that would provide external assurance that we comply with GDPR, as per the ICO's website. However, TechnologyOne will continue to monitor this.