What does the ISO/IEC 27001 standard involve?
Fiabilis Consulting Group is committed to a data protection process. ISO 27001 certification confirms our ability to protect any data and information that is essential to our analyses.
We provide our clients, partners and staff with complete security for their data through the implementation, updating and maintenance of an integrated global information security management system (ISMS).
The certification demonstrates that Fiabilis is able to assess its capacity to respond to every category of risk involved, whether posed by infrastructure, people or processes.
ISO 27701, a complement to ISO/IEC 27001
Alongside ISO 27001, Fiabilis obtained ISO 27701 certification in 2022. This international certification standard extends the scope of 27001 to the governance and security measures to be put in place to protect personal data. It takes account of the main applicable texts on personal data protection, and of the GDPR in particular.
This standard allows us, in line with the accountability principle, to demonstrate that our internal practices for processing personal data are aligned with the basic principles set out by the GDPR (lawfulness, fairness, transparency; purpose limitation; minimisation; accuracy; storage limitation; integrity and confidentiality).
External review and renewal of the ISO certifications
An overview of the measures taken to protect your data
- Signature of an IT charter and a confidentiality undertaking
- Training, awareness-raising and regular assessment of information security knowledge
- Direct supervision of visitors by a Fiabilis employee for the whole duration of the visit
- Controlled and restricted access to the premises
- Automated, decentralised management of the asset inventory
- Policy for managing, tracking and disposing of entrusted assets throughout their lifetime
- Device security policy (automatic locking, password complexity and rotation, real-time protection against malware, firewall, disk encryption, restricted software installation, automatic updates, and so on)
- Centralised access rights management policy with regular independent reviews
- Policy for managing service providers and suppliers, with a mandatory confidentiality undertaking and an annual audit of their security
- Development control policy, code review, vulnerability testing
- All our assets fall within the scope of our ISO 27001 certified ISMS
- Appointment, in each country, of a personal data protection specialist to check that our activities comply with the GDPR and other privacy legislation, and to give specific opinions (DPO or Privacy Champion)
- All client and internal data hosted on our own internal infrastructure
- Strict policy on exchanging or sharing files, using only our own internally hosted tools
- Pseudonymisation of data as soon as it is downloaded from the social security website
- No transfer of sensitive data to any subcontractor
- Mandatory user authentication by login and password, with mandatory multi-factor authentication (MFA) for remote access (VPN)
- Centralised archiving of data access logs
- Strict data lifecycle in application of the regulations in force (GDPR) and of local recommendations (the ISO 27001 and ISO 27701 standards)
- Backup policy that clearly defines the encryption and the storage location of data internally (on our premises) and at a secure external site.
- The entire infrastructure is hosted locally in our own physical offices
- Fiabilis operates several internal networks, allowing fine-grained access management and separation of environments
- Access to data, reserved for Fiabilis staff, is only possible over a local physical connection or via the VPN protected by multi-factor authentication (MFA)
- Every year, in accordance with our ISO 27001 certification, the independent body Aenor audits, reviews and certifies our ISMS, in addition to reviewing our PIMS under ISO 27701.
- An internal audit plan ensures the PDCA (Plan, Do, Check, Act) consistency that is essential across all our processes
- Every year, three internal penetration tests are carried out by the in-house IT teams. They are supplemented by one external, independent penetration test and vulnerability scan.
Data protection compliance – FAQ
1) What is the role of Fiabilis in processing client data?
Fiabilis processes its clients' personal data as a processor in principle. Before an analysis begins, we sign an appropriate personal data processing agreement (DPA) with each client. This agreement sets out precisely the principles under which the processing will take place, as well as our obligations during that process, in accordance with Article 28 of the GDPR.
2) How is data transferred to Fiabilis?
We have created a secure, individual data exchange platform for each client, through which the client can send its data directly to our server. The client may also opt for a data transfer that meets its own requirements, for example through a dedicated internal infrastructure that it provides.
3) Where and for how long is the data stored?
Your data is stored and processed exclusively on our secure servers in Europe. In accordance with the terms of the DPA, it is kept for the agreed period and then permanently deleted at the end of that period.