Vercom S.A. public company, to which the EmailLabs project belongs, has successfully completed the ISO 27001 Surveillance Audit and ISO 27018 Certification. Both audits confirm that organization’s information security management system aligns with the most recent information security best practices and apply the international standard for protecting personal data in the cloud.
The scope examined by the auditor is creation and development of CPaaS solutions that enhance customer communications management, including email, SMS and PUSH. The Statement of applicability dated 05.08.2022 applies. The certification process of the information security management system was carried out by LLC-(Certification) Czech Republic a.s, Prague.
Vercom implements the information security policies, procedures and guidelines specified in ISO/IEC 27001 and ISO/IEC 27018. One of the most important is the formal procedures we have implemented for granting access to data. In our daily work, we follow the principle that only authorized employees have access to data. It’s the principle of least privilege that we always have in mind, minimizing the necessary and legitimate access, which is always restricted due to employee’s job function. For each access, an identifiable person or automated process is responsible.
We have a business continuity plan with relevant sections on incident and crisis management, resilience, backups and disaster recovery procedures. The BCP plan is undergoing annual testing. This year, the subject of these tests was data restoration process during which we refined and approved the latest version of the backup management procedure, that complies with ISO 27018.
Vercom conducts a risk assessment at least once a year to identify, evaluate and prevent information security issues. This year, the organization’s risks included data management processes in cloud computing. EmailLabs’ services were identified as compliant with the public cloud requirements, and its various elements were described – with reference to the PFSA’s cloud announcement by a law firm. A risk management plan was defined and approved.
At Vercom, we have a formal process for managing change, involving IT changes in particular. More than a year ago, we have also introduced a vulnerability management procedure with regular updates to ensure continuous system integrity and timely mitigation of emerging security threats. The organization requires strict data separation of production from development or test environments. We implement periodic penetration tests both within the organization as well as performed by third-party companies.
Vercom continuously raises user awareness and implements appropriate audits and policies for virus detection and prevention, as well as for data recovery. Apart from annual GDPR and ISO training, we conduct employee workshops run by our pentester and security engineer on the most recent risks of personal data. This year, we introduced additional cybersecurity training sessions delivered on a weekly basis to raise employees’ awareness on cyber threats. The organization is subject to regular internal and external audits to improve its practices.
Email Authentication, Security
DMARC is an email authentication protocol that is designed to give domain owners the ability to protect their domain from unauthorized use, commonly known as email spoofing. Spoofing occurs...
Cybercriminals are thriving in their attacks, using communication channels such as sms, push and email. Day by day, attacks aimed at obtaining sensitive information related to these channels are...
The Council of Ministers, Republic of Poland, has adopted the draft of the Act on combating abuses in electronic communication. Proposed solutions should combat the most popular forms of...
With the emergence of the Covid-19 pandemic, many brands have been challenged to adapt in a short period to the changed reality and new consumer attitudes. That meant reorganizing...
How Apple Mail privacy updates affect email open rates? Although the new privacy policy for Apple users was already introduced in September 2021 (with the launch of iOS 15...
Google has announced the release of a new feature to help users differentiate messages from verified senders from those trying to impersonate them. Google Workspace users and Gmail owners...
Although the term “return path” might seem self-explanatory, many companies aren’t familiar with the process it denotes. Simply put, the return path is a hidden header that indicates where the...
