Simacan works with an ISO 27001-certified Information Security Management System (ISMS). An ISMS supports a systematic approach to managing sensitive information so that it remains secure. The ISMS covers people, processes and IT systems by applying a risk management process. The governing principle behind the ISMS is the design, implementation and maintenance of a coherent set of policies, processes and systems (controls) to manage risks to information assets, thus ensuring acceptable levels of information security risk.
To establish these controls, we have listed all possible risks related to the information we process on a daily basis. We deploy countermeasures against these risks by developing and implementing four different types of controls: technical controls, administrative controls, legal controls and managerial controls. Technical and legal controls are aimed at ensuring information security in the short to medium term, while administrative and managerial controls are aimed at ensuring information security in the medium to long term. Examples of such controls include identity & access management, event monitoring, asset management and disaster recovery.