When a private or public sector organisation entrusts its critical business processes and sensitive data to an external provider, this comes with significant responsibility.
Customers need to be able to trust not only that the solution works, but also that the provider takes a systematic approach to information security, risk management and the regulatory requirements that customers themselves are subject to.
It is in this context that SOA People Denmark views its recertification to the ISO/IEC 27001 standard.
“ISO certification is not simply a competitive differentiator and a mark of quality. For our customers, it provides documented assurance that, as a provider, we take a systematic approach to security, quality, compliance and risk management. This builds confidence in our SAP deliveries and reduces the risk our customers take on when choosing us as their business partner,” says Ivan Juhl Nielsen, Account Manager at SOA People Denmark.
From Supplier Requirements to Tangible Customer Value
Information security is relevant to both private companies and public sector organisations. Public sector customers in particular must comply with extensive requirements for security, documentation and supplier management – not least in the healthcare sector, where the protection of personal and health data is critical.
For SOA People, information security must therefore be an integral part of how the company delivers its services and works with its customers.
Senior Sales Executive
”When we work on our deliveries, we also work to protect our customers’ business-critical information. This includes securing customer data and preventing vulnerabilities. That is why we take a structured approach to risk management. It cannot be left to chance.”
Compliance Must Work in Practice
In recent years, information security requirements have become more extensive and more specific. GDPR, NIS2 and the increasing use of AI, which is now regulated by the EU AI Act, mean that security and compliance are increasingly becoming part of customers’ requirements for their suppliers.
These requirements may include areas such as data sovereignty, security and EU regulation. For SOA People, the aim is therefore not to manage the different regulatory frameworks as separate disciplines, explains Kristina Zeemann, Nordic General Counsel at SOA People Denmark:
“We have created a very simple and intuitive system for managing all aspects of compliance. We do not have separate silos for NIS2, GDPR, the AI Act and the ISO system. Instead, we have integrated everything into our day-to-day business processes. In this way, compliance becomes an embedded and natural part of how we work.”
The Supplier’s Role in the Customer’s Risk Management
For organisations responsible for critical data, the consequences of inadequate security can be significant – financially, legally and reputationally.
It is therefore important to be able to demonstrate that the suppliers an organisation works with take a structured approach to security and compliance.
“When customers purchase a cloud solution, they are naturally concerned about how they can manage their risks. By demonstrating how we structure our approach to risk management, we hope to give customers greater peace of mind when choosing us as their supplier,” says Ivan Juhl Nielsen.
For public sector customers, certification may be a specific requirement, while for private sector customers, it can provide documented assurance that the supplier supports their own security and governance requirements.
Security Is Also About Where Data Is Located
ISO 27001 does not stand alone. The security of a cloud service depends on the entire chain – from processes and employees to technology, infrastructure and partners.
Both SOA People’s partnership with SAP and SOA People’s own European set-up play an important role in this regard.
“SAP has extensive expertise in information and data security, while SOA People’s ‘Made in Europe’ concept enables us to offer our customers a European-based service with a focus on areas such as data sovereignty,” explains Ivan Juhl Nielsen.
Data security is therefore not only about how data is protected, but also about where data is physically located – and the regulatory frameworks under which it is processed.
According to Ivan Juhl Nielsen, this has become an increasingly important issue in light of geopolitical developments and customers’ growing focus on maintaining control over critical data.
Recertification Is Part of an Ongoing Process
An ISO 27001 certification is not a one-off exercise. The annual recertification is an external assessment of whether SOA People’s approach to information security continues to be firmly embedded across the organisation.
Nordic General Counsel & Senior Director
”We improve each time, and we continuously work to get better. Most recently, we received a great deal of positive feedback for the work we have done to make compliance a natural part of our day-to-day operations. For us, the certification is both important documentation for the market and a motivating professional recognition within our own organisation. Our customers need to be able to see that information security is not just a promise, but something we work with systematically as an IT provider. This creates a stronger foundation for trust – and makes security a natural part of the SAP solutions we deliver.”
ISO/IEC 27001 in Brief
ISO/IEC 27001 is an international standard for information security management systems.
The standard supports a systematic approach to:
- risk assessment and risk management
- protection of information
- processes and responsibilities
- documentation and controls
- continuous improvement of information security
For customers, the certification can be an important way of demonstrating that a supplier takes a structured approach to information security, compliance and risk management.
You may also be interested in
Keep exploring to discover more from SOA People!
