Certification over information security systems

Edited by the Processingtalk editorial team Jul 12, 2006

BASF IT Services is one of the first companies in Europe to be awarded the international standard ISO 27001, which specifies how a company should handle confidential information

As one of the first companies in Europe, BASF IT Services, the IT service provider, has been awarded the international standard ISO 27001.

This has been confirmed by the Swiss Union for Quality and Management Systems (SQS) on 11 July 2006.

The ISO 27001 Standard replaces the previous internationally recognised British Standard (BS) 7799 according to which, BASF IT Services has already been certified.

Both of the standards determine how a company should handle confidential information and demand that every single member of staff adheres to the safeguarding of information.

Furthermore, the company must also be able to prove that this is implemented in the internal processes and IT systems.

With this certification, SQS certifies that BASF IT Services has a set of rules and regulations concerning information security, a so-called 'Management System', which fulfils the internationally recognised standard.

This ensures that confidential data entrusted to the company is not lost or falsified and access is denied to unauthorised persons.

Not only the security level of the facilities - for instance, entry to the data centres - but also the protection of IT systems comes under examination.

Furthermore, decisive for a successful certification is that confidential information is not left openly visible by employees and they are aware of and adhere to legal requirements.

"With this certification, we have demonstrated the high level of importance given by our company to information security," says Wolfgang Erny, Managing Director of BASF IT Services.

"This is proof to our customer that we handle confidential data entrusted to us, very carefully".

The certification is not a single examination, the company must undergo an annual so-called 'repeat audit' to test its information security.

Every three years a completely new certification is required.