Harmony's communication platform, CCM in the Cloud, has been running to the full satisfaction of various clients for years. The focus of CCM in the Cloud (now: CustomerConnect) is not only on the functionality it offers; information security is at least as important a factor. We explain how we make sure the security of our CCM in the Cloud platform stays guaranteed.
Penetration test reporting
The architecture of CCM in the Cloud is designed so that the functionality is covered and, at the same time, the necessary security principles are met. A third party tests this security with a penetration test. This penetration test consists of several phases:
- The 'black box' test: the pentest party has no access at all to the CCM platform and tries to break in by exploiting possible vulnerabilities.
- The 'white box' test: the pentest party tests whether, with the authorisations it has been given (comparable to the authorisations that customers or supporting parties receive), it can gain access to parts of the platform for which no authorisations were granted.
- These intensive tests are repeated every year, and Harmony follows up or resolves any recommendations or findings. As a customer of CCM in the Cloud, you can receive the management summary of these tests every year.
ISO27001 certification
Harmony has an information security management system (ISMS). Not only for CCM in the Cloud, but for all its managed services. With this ISMS, the management board oversees and checks that it works properly. This means that:
- Information security policies and procedures have been defined in line with ISO27001.
- These have been assigned operationally to the right people.
- Every quarter, the management board carries out a review to establish whether the information security objectives have been met.
- An internal audit takes place every year. In this way, Harmony goes through the Plan-Do-Check-Act cycle frequently and ensures continuous improvement in information security.
Since 2019, Harmony's ISMS has been ISO27001 certified. Every year, an independent external auditor assesses whether Harmony's ISMS meets all requirements. The ISMS and the 114 controls in the annex to ISO27001 (Annex A) are then tested. By certifying, the ISO27001 auditor states that the ISMS meets the requirements. As a customer of CCM in the Cloud, you can always request the current certificate and statement of applicability.
The new ISO27001:2022 was published in 2022. Harmony will conform to this new version in good time and has already carried out an impact analysis for it.
ISAE3000 assurance report for CCM
An ISO27001 certification gives a lot of insight into a working information security management system, but it sometimes still gives customers too little certainty about the controls that have been carried out. An assurance report (ISAE3000) does provide demonstrable proof of this.
Harmony has an ISAE3000 report based on the 50 most important controls in the annex (Annex A) to ISO27001. Every year, Harmony is audited by an accountant who tests the design, existence and operation of the controls specifically for CCM. An ISAE3000 audit looks back over a period (a calendar year) at whether CCM has complied with the 50 selected ISO27001 Annex A controls. This is done with intensive sampling that gives a realistic picture of what has taken place. This allows Harmony to give its customers the certainty ('assurance') that processing by CCM is carried out securely. The ISO27001 certification that Harmony has held for years covers all Annex A controls. As a customer of CCM in the Cloud, you can obtain the ISAE3000 report every year.
Do you have any questions for us about information security after reading this article, or are you interested in our solution and services? Then get in touch with us, with no obligation, and we will be glad to look at the possibilities with you.
