Our security concept

Our ISO 27001 certification on the basis of IT-Grundschutz from the Federal Office for Information Security rests on a large number of clear rules and processes that we actually live by.

The BSI ISO 27001 certification covers the data centre network in Hanover and its management. It includes all systems and processes required to run the data centre infrastructure, manage customers and deliver colocation services.

Applying ISO 27001 on the basis of IT-Grundschutz from the Federal Office for Information Security (BSI) covers the control objectives and controls from Annex A of ISO 27001 and the associated implementation advice and guidance on generally accepted practices from ISO/IEC 27002.

As a prerequisite for certification, kyberio went through a multi-stage audit covering the data centre and the organisational processes that go with it. This audit is repeated in a regular cycle.

In essence, the audit covers:

• The business requirements of the company
• Technical infrastructure
• Management responsibility
• Organisational processes
• Risk management
• Data protection

With kyberio, our customers also secure their own position with regard to IT security legislation. Since May 2018, the EU General Data Protection Regulation has further tightened data protection requirements and the associated liability risks. It provides for even harsher penalties for breaches of data protection law than the former German Federal Data Protection Act.

In fact, certification is not only a legal safeguard: together with improved security it also brings many business advantages. In summary:

• Improved security of the IT infrastructure
• Greater security awareness, from management to staff
• Legal protection and reduced liability risk
• Improved competitiveness
• Cost savings by outsourcing security-relevant services that would take considerable effort to provide in-house
• Building trust with customers and the public
• The option of certifying your own applications on the basis of kyberio''s existing certification

PCI DSS stands for “Payment Card Industry Data Security Standard”. The PCI standard is a set of rules that defines the security requirements for credit card payments. It is binding for all companies, institutions and organisations that process cardholder data.

Companies and organisations that process cardholder data (CHD) electronically in a cardholder data environment (CDE) must secure this environment against data misuse and unauthorised access in line with the PCI guidelines and protect its ongoing operation. The standard also requires a clear assignment of responsibilities for the different areas and tasks within the CDE. All access and every work step must be traceable. An important part of running such an environment is physical security and the processes needed to ensure it in data centre operation.

These requirements cover 12 areas:

• Firewall concept
• Security settings for passwords
• Protection of cardholder data
• Encryption of data
• Virus protection
• Maintenance of systems and applications
• Restriction of access
• User-based access control
• Restriction and security of physical access to the server
• Logging of access to data
• Regular review of the systems
• Compliance with information security policies

Traceability of entry to and access to the environment is ensured by professional entry controls and procedures, continuous video surveillance around the clock, the logging and unambiguous identification of everyone in the data centre, and data reconciliation with plausibility checks.

As a colocation customer in our data centre, you benefit from a service already PCI-certified by a qualified security assessor (“QSA”), which extends up to your own rack. This lets you concentrate on the compliance of the infrastructure you run in the rack and have the physical security of your rack (essential parts of requirements 9 and 12 of the PCI requirements catalogue and requirement 11.1 on wireless access points) attested through our certification. These points drop out of your own audit, because you build your certification on the certified PCI compliance of the data centre operator.

E-commerce providers, content providers, institutions and organisations of all kinds that offer services or products online by credit card, or accept donations, can therefore do so in a PCI-certified data centre environment in their own individually lockable 19" rack (with 21 or 42 height units). We will gladly provide you with our Attestation of Compliance (“AOC”) for this purpose.