GDPR processor security controls

Cerri.com information security policies are written to take account of the specific needs of providing cloud services, including:

• Extensive use of virtualization
• Risks from authorized insiders
• Protection of cloud customer data
• The need for effective communication with our customers

All policies are version-controlled, authorized and communicated to all relevant employees and contractors.

Roles and responsibilities for the management of the cloud environment are clearly defined as part of contract negotiation, so that customer expectations are aligned appropriately with the way the service will be delivered.

In addition, a clear split of responsibilities between Cerri.com and our suppliers, including cloud service providers that supply supporting services, is established and maintained.

Cerri.com operates from several geographical regions and adopts a zone approach to the storage of customer data, so that it will always be located in the country or countries required by the customer.

A comprehensive program of awareness training is delivered on an ongoing basis to all Cerri.com employees to emphasize the need to protect customer cloud data appropriately. We also require our contractors to provide appropriate awareness training to all relevant employees.

Functionality is provided where possible within our cloud services to allow our customers to reflect their own information classification and labeling schemes.

An audited procedure is in place for the return and removal of cloud customer assets when appropriate. This procedure is designed to assure the protection of customer data in general, and personal data in particular.

We provide a comprehensive, user-friendly administration interface to authorized customer administrators that allows them to control access at the service, function and data level. User registration and deregistration and access rights management are achieved via this interface, access to which can - by customer demand - be protected if required by, for example, multi-factor authentication and other modern and established technologies.

Documented procedures for the allocation and management of secret authentication information, such as passwords, ensure that this activity is conducted in a secure way.

The use of utility programs within the customer cloud environment by Cerri.com employees is strictly controlled and audited on a regular basis.

Where we operate a single and physically separated customer installation, cloud customer resources are subject to strict segregation from each other, so that no access is permitted to any aspect of another customer's environment, including settings and data.

Virtual machine hardening, including the closing of unneeded ports and protocols, is implemented as standard practice, and each virtual machine is configured with the same degree of protection for malware as physical servers.

Transactions between the user (including administrators) and the cloud environment are encrypted using SSL by default and can be extended with IP filtering, customer AD directory authentication (SSO) and organisation-based encryption. Customer data is encrypted at rest using keys managed by Cerri.com. Encryption is possible down to single-field level in the application.

Cerri.com has procedures in place for the secure disposal and re-use of resources when no longer required by the cloud customer. These procedures will ensure that customer data is not put at risk.

Cerri.com makes customers aware of planned changes that will affect the customer cloud environment or services. This information is provided via email to affected customer administrators and will include the type of change, scheduled date and time and, where appropriate, technical details of the change being made. Further notifications will be issued at the start and end of the change.

The capacity of the overall cloud environment is subject to regular monitoring by Cerri.com engineers to ensure that our capacity obligations can be fulfilled at Cerri.com working time.

Encrypted backups of customer environments are taken to a standard Cerri.com frequency and are retained for a default period of three months. Backups are stored at a separate location to the main location of customer data, at a distance considered sufficient to represent a reasonable business continuity precaution. Backup samples are verified on a regular basis to confirm their integrity. Restoration from backup can be requested by the customer on a next business day basis.

Activity and transaction logs are recorded in the cloud environment and may be accessed by customer administrators. These include details of logins/logouts, data access and amendments/deletions.

All system and device clocks within the cloud environment are synchronized (via designated servers) to an external time source, details of which are available upon request.

The customer cloud environment is subject to regular vulnerability scanning using industry-standard tools. Critical security patches are applied in accordance with software manufacturers' recommendations.

Operational activities deemed critical and in some cases irreversible (such as deletion of virtual servers) are subject to specially controlled procedures that ensure adequate checking is performed prior to completion. We also recommend that customers put their own procedures in place in these areas.

The Cerri.com internal network operates in isolation from all customer networks and environments.

The configuration of virtual network resources is subject to the same level of control as that for physical network devices, according to our documented network security policy.

Secure development procedures and practices are used within Cerri.com, including separation of development, test and production environments, secure coding techniques and comprehensive security acceptance testing.

In the delivery of certain services, Cerri.com makes use of peer cloud service providers in a supply chain arrangement. These suppliers are subject to regular second party audit to ensure that they have defined objectives for information security and carry out effective risk assessment and treatment practices.

All supplier relationships are covered by contractual terms which meet the requirements of the GDPR.

Where Cerri.com believes it is appropriate to inform the customer of an information security event (before it has been determined whether it should be treated as an incident), we will do this to the nominated customer administrator or deputy. Similarly, the customer may report security events to our support desk where they will be logged and the appropriate action decided. Information about the progress of such events may be obtained from the support desk.

Cerri.com will report information security incidents to the customer where it believes that the customer service or data has been or will be affected. We will do this to the nominated customer administrator or deputy as soon as reasonably possible and will share as much information about the impact and investigation of the incident as we believe to be appropriate for its effective and timely resolution. An incident manager will be appointed in each case who will act as the Cerri.com point of contact for the incident, including matters related to the capture and preservation of digital evidence if required.

We prioritize incident management activities to ensure that the timescale requirements of the GDPR for notification of breaches affecting personal data are met.

Cerri.com plans for and regularly tests its response to various types of disruptive incident that might affect cloud customer service. The architecture of our cloud services is designed to minimize the likelihood and impact of such an incident, and we will make all reasonable efforts to avoid any impact on customer cloud services.

The legal jurisdiction of the cloud service provided will depend upon the country in which the contract is made. Where the data of EU citizens is held, Cerri.com will comply with the requirements of the General Data Protection Regulation. International data transfers are governed by Standard Contractual Clauses as approved by the European Commission. Evidence of our compliance with these requirements is available on request.

Records collected by Cerri.com as part of its provision of the cloud service will be subject to protection in accordance with our information classification scheme and asset handling procedures.