5. Leadership
5.1 Leadership and commitment
Section titled “5.1 Leadership and commitment”Management Commitment to Information Security
At d-centralize, we are committed to the continuous improvement of our Information Security Management System (ISMS) in alignment with ISO 27001 standards. As a SaaS provider, we acknowledge the critical importance of safeguarding sensitive data and ensuring the highest levels of confidentiality, integrity, and availability of the systems and services we provide to our clients. Our leadership team is fully committed to the successful implementation, maintenance, and continual improvement of our ISMS.
Key Commitments:
- Leadership Involvement: The executive team of d-centralize.nl is directly involved in the development, review, and continuous improvement of our ISMS. We ensure that adequate resources, training, and expertise are allocated to our information security initiatives.
- Strategic Objectives for Information Security: We establish and regularly review strategic objectives that align with the overall business goals of d-centralize.nl. These objectives are aimed at maintaining an optimal level of security and mitigating risks that could potentially affect our SaaS services, client data, and internal operations.
- Risk Management: Our leadership is committed to identifying and assessing information security risks, ensuring that proper mitigation strategies are in place to minimize potential threats to our systems. We will continuously monitor risks and apply appropriate controls in line with our risk management framework.
- Compliance and Legal Requirements: We are committed to adhering to all relevant legal, regulatory, and contractual requirements related to information security. This includes data protection laws and industry standards, ensuring that our SaaS services meet the highest security benchmarks.
- Resource Allocation: We are dedicated to providing the necessary resources, both human and technological, to support the effective implementation and management of our ISMS. This includes investments in technology, staff training, and external consulting, when necessary, to strengthen our security posture.
- Employee Engagement and Awareness: Our leadership prioritizes a culture of security across all levels of the organization. We ensure that employees are well-trained in information security policies and procedures and are aware of their responsibilities in safeguarding data.
- Continuous Improvement: We are committed to continually improving the effectiveness of our ISMS through regular internal audits, reviews, and feedback mechanisms. The leadership team is committed to driving improvements based on audit results, risk assessments, and client feedback.
- Customer Focus: We recognize that maintaining the trust and confidence of our customers is paramount. As such, we strive to provide a secure, reliable, and transparent SaaS environment to ensure that our clients’ data is protected, and service uptime is optimized.
Accountability and Governance:
The responsibility for implementing and managing our ISMS rests with the leadership team of d-centralize. Our leadership team ensures that regular reviews are conducted to assess the effectiveness of the ISMS and initiate corrective actions as needed.
This management statement underlines our unwavering commitment to the highest standards of information security, ensuring that d-centralize remains a trusted and secure partner for our clients in the SaaS industry.
Signed,
CEO and founder
Kees van den Broek
d-centralize
Date: January 2, 2025
This statement is part of the onboarding and can be attached to tenders and quotations.
5.2 Policy
Section titled “5.2 Policy”The information security policy is the top-level policy. It sets the framework for the information security objectives and links to the topic-specific policies.
5.3 Organizational roles, responsibilities and authorities
Section titled “5.3 Organizational roles, responsibilities and authorities”Each role in the table is a Keycloak group under /isms/. Who holds it is recorded in the staff list,
onboarding/users.yaml
in the scripts repository, so every change of role holder is a reviewed merge request. The Internal auditor has no
account and is named in the internal audit issue. These roles carry the information security responsibilities:
| Role | Information security responsibilities | Competence |
|---|---|---|
| Management | Approves the policies and the ISMS scope, provides resources, chairs the yearly management review | Runs the companies and knows what the ISMS requires of Management |
| Information Security Officer | Owns the ISMS: makes sure it conforms to ISO 27001, keeps the registers, runs the ISMS security meeting, reports to Management | ISO 27001 training and experience with information security in software or hosting |
| Infrastructure | Hosting, networks, backups, monitoring, access to infrastructure | Experience running Linux servers, networks, backups and monitoring |
| Project lead | Secure development and the security of one SaaS product, its customer agreements and its incidents | Senior development experience on the product, the OWASP Top 10 and the GDPR basics |
| Office & HR | Contracts, onboarding, offboarding, office and assets | Dutch employment law and the GDPR rules for HR records |
| Internal auditor | Audits the ISMS independently; an external person, so nobody audits their own work | ISO 27001 auditor training and independence from the work audited |
Every Annex A control has an owning role in the Statement of Applicability. Roles that conflict are held by different people (control 5.3): the Internal auditor never holds another role in this table.