Staff training and professional development

All employees receive regular information security awareness training. These training sessions serve to refresh and update knowledge on current topics. New employees receive appropriate training during their induction period. In addition, employees receive needs-based training to raise awareness of information security objectives and risks.

Emergency management and system audits

In order to be able to respond quickly to security incidents and limit the potential damage, emergency response concepts have been developed and documented in emergency response manuals. In addition, annual system audits are carried out to ensure a structured security review of all IT services. The focus here is on risk assessment, access rights and encryption.

Data protection and information security management

Projektron uses a data protection management system (DSMS) in accordance with the EU General Data Protection Regulation (EU GDPR). A special team, consisting of ISMS officers, works actively on information security and the associated processes. This team continuously ensures compliance with the security objectives. In addition, a team of experts has been put together in the company to deal with current topics in IT security and security in development.

Central software distribution and endpoint security

Central software distribution

The software required on the operating computers is distributed centrally and kept up to date.

Antivirus and antimalware software

The antivirus and antimalware programs that are always in use on all end devices are regularly updated.

Patch management

Security updates and patches for operating systems and applications are regularly installed.

Network and perimeter security

Redundant network technology

Internet lines, firewalls and central switches are redundant.

Firewalls

Firewalls are used to control data traffic.

Network segmentation

Networks are segmented into different segments to restrict access to critical systems and prevent attacks from spreading.

VPN

VPN access is available to employees for mobile working. VPNs are used for secure remote access to internal systems.

Monitoring / security monitoring

Access control and authentication

Least Privilege Principle

Access rights are granted based on the principle of minimal authorization, so that users can only access the resources they actually need.

Role-Based Access Control (RBAC)

Role-based access controls have been implemented to restrict access to sensitive information.

Data encryption and security

Cryptography

The recommendations of the BSI Technical Guidelines (BSI TR-02102) are audited annually.

Internal certification authority

Internal services are encrypted via their own certification authority.

Encryption during transmission

Encryption technologies are used to protect data during transmission.

Email security and backups

E-mail

Incoming mail traffic is monitored and, in case of doubt, initially placed in quarantine.

Backup & recovery

Internal services are backed up daily and can be quickly restored to the state of the last backup. The recovery process is tested every six months.

Organizational measures

Regular training

We provide training for IT staff and end users on the latest security threats and best practices.

Security awareness programs

We run continuous programs to raise employee awareness of information security.

Documented security policies

Security policies and procedures are created, documented and regularly updated.

Compliance

We ensure compliance with relevant legal and regulatory requirements as well as internal security policies.

Procedural measures

Incident response and emergency management

We have emergency plans in place that include measures to restore systems in the event of an incident. We regularly conduct exercises to prepare for security incidents and review the effectiveness of our emergency plans.

Risk and vulnerability management

We regularly conduct risk assessments to identify and evaluate potential threats. We have implemented a process to detect, assess and rectify vulnerabilities in the IT infrastructure.

Support portal and configuration management

Support portal

The support portal for customers is used for the secure exchange of information and the transfer of data. Communication takes place via tickets with an internal system storage for the data exchange.

Configuration versioning service (CVS)

The configuration versioning service (CVS) is a central configuration store for customers and Projektron itself. The configurations are managed within an SVN repository.

Authentication and access control

Access authorization

The customer's contact persons have personalized access to the support portal.

Strong authentication

A two-factor authentication (2FA) is used to access the support portal.

Role-based access control (RBAC)

Access rights are assigned based on the roles of the users in order to restrict access to sensitive information.

Secure password policies

We have implemented secure password policies, including minimum length, complexity, and regular change.

Encryption and data protection

Encryption

Access to the support portal is only possible via encrypted access.

Data minimization

Only the customer data necessary for order processing is collected and stored in the system.

End-to-end encryption

It is ensured that data is encrypted during the entire communication between customers and support staff via the support portal.

Data protection compliant processes

Processes have been implemented in accordance with the General Data Protection Regulation (GDPR) and other relevant data protection laws. These processes are consistently adhered to.

Staff training and security information

Security information for customers

We regularly provide security-related information for customers within the support portal.

Further training for our employees

Our support staff receive regular and needs-based further training on the security of the software used and interfaces to third-party systems that can be connected to Projektron BCS.

Regular training

Support staff receive regular training on the topics of information security, data protection and the secure handling of customer data and are made aware of the issues.

Awareness programs

We continuously implement programs to promote security awareness and compliance with security policies.

Procedural measures and emergency management

Logging and monitoring

All activities in the support portal are logged in detail and the logs are regularly checked for suspicious activities.

Security policies and procedures

Policies and procedures for information security in the support portal are consistently enforced and continuously adapted. In addition, security reviews and audits are regularly carried out to ensure compliance with security standards.

Incident response and emergency plans

We follow a clear process for reporting, analyzing and rectifying security incidents. We have emergency plans in place in the event of a security incident, which are regularly updated.

Customer data management and anonymization

To increase the protection of customer data, we anonymize or pseudonymize data wherever possible.