Question 1

How do you document that you process sensitive personal data correctly?

Accepted Answer

As an organization, you and your suppliers commonly handle various types of data such as employee and customer data. However, it is your company's responsibility to ensure that data is processed correctly. Therefore, you must request documentation from your suppliers to confirm their compliance with GDPR.

Question 2

What are the control targets that you currently have in place?

Accepted Answer

When communicating with your supplier, it is essential to inquire about their control targets related to data security and IT infrastructure. These targets could include processes for managing GDPR incidents, as well as knowledge about which systems handle specific data, particularly personal data. ISAE 3402 emphasizes the establishment of documented control targets, which are monitored by a specialized auditor.

Question 3

When did you last evaluate your IT compliance?

Accepted Answer

It is important to ask your supplier how frequently they review, validate, and update their IT policy and security, given that companies often acquire new programs, IT tools, or apps that must be reflected in their processes and documentation. Merely creating an IT policy in 2018 when GDPR was introduced is insufficient; it must be updated continuously. Unlike ISO 2700X certifications, ISAE 3402 and ISAE 3000 control processes are performed annually. Although an ISO 2700X certification does not require renewal, it confirms that the conditions were met at the time of certification. Therefore, if your supplier has an ISO certification, it is crucial to ask when it was obtained.

Question 4

Do you review and update both your processes and procedures, as well as your physical and logistical security measures?

Accepted Answer

How frequently do you visit your supplier, especially if they are located partially or entirely in another country? Note that an ISAE 3402 statement entails a physical security audit.

Question 5

What is your protocol for handling sensitive personal data?

Accepted Answer

Before integrating a new system into your company, it is crucial to understand the entire process of how your supplier processes data, whether it pertains to you, your customers, or your employees. In Europe, all companies must adhere to GDPR regulations. Therefore, it is vital to familiarize yourself with the documentation that outlines how the company complies with these regulations.

Question 6

What is your protocol for handling a security breach?

Accepted Answer

Ask how the supplier manages a security breach, and ascertain whether they have a standardized and documented process in place. If your data is accessed without authorization, your supplier is required to notify you. Obtaining an ISAE 3000 statement ensures that this occurs because companies that receive an ISAE declaration establish processes that are periodically reviewed.

Question 7

What types of data do you process?

Accepted Answer

You may have an idea of the data that your supplier should be processing, but it is crucial to ensure that your supplier can provide documentation of the data they process, even if they utilize sub-suppliers or partners. Obtaining an ISAE 3000 statement provides an accurate overview of the data being processed, which eliminates the need for independent investigations.

Question 8

What risks have you considered regarding the processing of my data?

Accepted Answer

Being prepared is always beneficial. Thus, before collaborating with a new supplier, it is essential to request a comprehensive description of the risks associated with their data processing. With ISAE 3402, you can rest assured that data-related processes and procedures are managed and validated by an impartial specialist.

Question 9

How do you guarantee the coordination between your IT security and GDPR obligations?

Accepted Answer

Many companies may have a clear understanding of their compliance with GDPR regulations. However, it is equally important for IT security measures, such as systems, infrastructure, and processes, to align with GDPR requirements and to have proper documentation. GDPR measures hold no value without adequate IT security. To ensure maximum security, it is advisable to opt for a supplier who holds both ISAE 3000 and ISAE 3402 declarations.

Question 10

What measures do you have in place to demonstrate that your company's IT security is constantly evolving and improving?

Accepted Answer

It's crucial to have a supplier that values security as an integral part of their organization rather than just a buzzword. ISAE 3402 demands internal education on IT security and data processing. To ensure that employees incorporate IT security and GDPR into their daily work routines, ask your supplier what measures they take.

Datev Lohn und Gehalt

TimeLog and Datev Lohn und Gehalt

Slim down your salary process and gain full control over your data.

Easy payroll - accurate time tracking

Reduce the number of manual errors

The following data supported by TimeLog