4. Context of the organization
4.1 Understanding the organization and its context
Section titled “4.1 Understanding the organization and its context”d-centralize develops, hosts and manages SaaS products for its customers: Appsemble, Pro6PP and ITSLanguage. These internal and external issues shape what the ISMS must achieve.
Internal issues:
- Core business: development, hosting and management of SaaS products and the customer projects built on them.
- Organization: a small team of mostly software developers who work on more than one product, organized in roles. The products share the same processes, tooling and infrastructure.
- Technology: cloud hosting, open-source frameworks, containerized services, infrastructure as code, and GitLab for code, issues and documentation.
- Way of working: remote first, every change reviewed in a merge request, security work planned in the same sprints as other work.
External issues:
- Laws and regulations: the GDPR (AVG) for the personal data our products process.
- Customers: Dutch municipalities and other organizations that work under the BIO (Baseline Informatiebeveiliging Overheid) or NIS2 and require ISO 27001 certification from their suppliers, often as a tender requirement.
- Threats: attacks on the software supply chain, on open-source dependencies and on public APIs.
4.2 Understanding the needs and expectations of interested parties
Section titled “4.2 Understanding the needs and expectations of interested parties”| Interested party | Needs | Expectations | Communication |
|---|---|---|---|
| Employees | Secure tools and clear security rules | Training on security, protection of their own personal data | Handbook, Mattermost, team meetings |
| Customers | Protection of their data and of their users’ data | Agreed availability and security in contracts and SLAs, ISO 27001 certification, breach reporting | Contracts and SLAs, support pages, e-mail, calls |
| Regulators | Compliance with data protection law | Records of processing, timely notification of personal data breaches | Their web forms and e-mail |
| Suppliers | Clear agreements on what they process and how | Data processing agreements and security requirements that are met | Contracts, e-mail |
The requirements of these parties that the ISMS addresses are the contracts and SLAs with customers, the GDPR, and the certification itself.
4.3 Scope of the ISMS
Section titled “4.3 Scope of the ISMS”d-centralize obtains this certificate for the holding KHM van den Broek Beheer B.V. and its companies d-centralize B.V., Appsemble B.V. and d-centralize geo B.V., and the products they run: Appsemble, Pro6PP and ITSLanguage, which is part of d-centralize B.V. The scope covers all customer-facing systems, including the hosting, development and management of the software we deliver.
4.4 Information security management system
Section titled “4.4 Information security management system”The ISMS consists of the pages in this section, the policies they link to, and the registers in GitLab listed on the ISMS overview. It runs in the same GitLab where we manage all our work, so security tasks are planned, reviewed and recorded like any other issue.