Information security
ISO 27001: what it is and what it means for you
Good automation starts with trust. That is why information security at VionA is not an afterthought, but is anchored in the international ISO 27001 standard. On this page, we explain what the standard entails, how certification works, and what it means for you as a client.
VionA is ISO 27001 certified
What is ISO 27001?
ISO 27001 is the international standard for information security. The standard was established by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) and is used worldwide by organizations that want to demonstrate their commitment to handling information with care.
Important to know: ISO 27001 is not a checklist of isolated technical measures. The standard describes an information security management system, often abbreviated as ISMS. This is a structured way of working that allows an organization to identify risks, implement appropriate measures, and continuously evaluate and improve those measures.
The three pillars of information security
Everything in ISO 27001 revolves around protecting three properties of information:
Confidentiality
Only those who need it have access to information.
Integrity
Information is accurate and complete, and is not altered unnoticed or without authorization.
Availability
Information and systems are available when they are needed.
For automation, all three are directly relevant: an automated system works with confidential data, must transmit it accurately and completely, and must remain reliable in its operation.
How the standard works
The core of ISO 27001 is risk management. An organization identifies the information it manages, the associated risks, and the severity of those risks. Based on this, it selects appropriate measures. These choices are documented in a statement of applicability: an overview of which measures apply and why.
The standard provides a set of 93 controls for this purpose, divided into four themes:
Organizational
Policy, roles, supplier management, and incident response.
People
Screening, awareness, and confidentiality.
Physical
Security of offices, equipment, and workspaces.
Technological
Access management, encryption, logging, and secure development.
Furthermore, the standard requires continuous improvement. Measures are periodically evaluated, internal audits are conducted, and management regularly reviews whether the system is still functioning effectively.
How the certification process works
An organization can work according to ISO 27001 without being certified. Certification means that an independent, accredited institution has verified that the organization truly meets the standard.
Certification audit
The institution first assesses the design and documentation, and then verifies whether the organization operates in practice as described.
Annual surveillance audits
The certificate is valid for three years. During that period, it is checked annually to ensure the organization remains compliant.
Recertification
After three years, a full new audit is conducted to renew the certificate.
ISO 27001 at VionA
A certificate always applies to a specific scope. At VionA, that scope covers exactly what we do for you: information security in the advising, development, and management of process automations. These are the three phases of our approach.
Strategy · advising
During the process analysis, we identify exactly which data an automation requires. We incorporate your industry's compliance requirements from the very first draft.
Implementation · developing
We carefully configure access to systems and integrations. An automation is granted only the permissions necessary for its task. [CHECK]
Management & growth · managing
After going live, we continuously monitor the automations and handle any deviations or incidents according to established procedures.
Questions about security? We prefer to discuss them beforehand rather than afterwards.
