{"accentColor":"#50005e","backlink":"https://omnifact.ai","companyName":"Omnifact","complianceFrameworks":[{"designation":"UNSET","icon":"https://imagedelivery.net/aMzOL2BTX2KWwvYdF6NLpA/410fc7da-0306-4110-48d6-44288ae5fb00/public","id":"iso27001_v1","name":"ISO 27001","status":"COMPLIANT"}],"controls":[{"category":"ACCESS_CONTROL_AND_AUTHORIZATION","controls":[{"description":"Implement a formal access granting process that ensures new access privileges are assigned based on the principle of least privilege, and require at least one employee to endorse the granting of new access.","frameworks":[{"id":"iso27001_v1","notes":"Make sure to include the following points in this process:\n\n- Maintain audit trail of all access requests and approvals\n- Conduct regular (at least quarterly) access rights reviews\n- Implement stricter requirements for access requests to more sensitive data and infrastructure"},{"id":"gdpr_v1"}],"name":"Access granting process used","status":"PASSING"},{"description":"Systematic controls are established in the access management policy for managing user access rights, ensuring appropriate, authorized access to systems and data.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Access management policy established","status":"PASSING"},{"description":"An inventory of user accounts on critical and high-risk vendors that have access to in-scope systems and services is maintained, including essential details such as account owners, access privileges, associated roles, and vendor relationships where applicable. The inventory is reviewed and updated at least annually.\n","frameworks":[{"id":"gdpr_v1"},{"id":"iso27001_v1"}],"name":"Account inventory maintained","status":"PASSING"},{"description":"Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user’s primary, non-privileged account.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Dedicated administrator accounts used","status":"PASSING"},{"description":"Employee access is reviewed at least annually to ensure that access privileges are appropriate and that former employees or users do not retain unauthorized access.\n","frameworks":[{"id":"iso27001_v1"},{"id":"gdpr_v1"}],"name":"Employee access regularly reviewed","status":"PASSING"},{"description":"Multi-factor authentication (MFA) is required for administrative access to critical systems and services unless a documented exception is in place where MFA is not supported.\n","frameworks":[{"id":"iso27001_v1"}],"name":"MFA required for administrative access","status":"PASSING"},{"description":"Require multi-factor authentication (MFA) for accessing sensitive infrastructure. MFA adds an extra layer of security by requiring users to provide additional authentication factors beyond their passwords.\n","frameworks":[{"id":"iso27001_v1"}],"name":"MFA required for infrastructure access","status":"PASSING"},{"description":"Strictly enforce the organization’s password management policy to guarantee compliance with security standards. Enforcing this policy includes implementing technical controls, monitoring adherence, and responding to non-compliance.\n","frameworks":[{"id":"gdpr_v1"},{"id":"iso27001_v1"}],"name":"Password management policy enforced","status":"PASSING"},{"description":"A password management policy is enforced that mandates strong, complex passwords and prohibits the reuse of previous passwords.\n","frameworks":[{"id":"gdpr_v1"},{"id":"iso27001_v1","notes":"Consider these key requirements:\n\n1. Complexity: enforce strong passwords (mix of characters, length)\n2. Multi-Factor Authentication (MFA): implement, especially for remote and privileged access\n3. Account lockout: enable after defined failed attempts\n4. Password history: prevent reuse of recent passwords\n5. Secure storage: use strong hashing algorithms\n6. Change process: verify user identity for password changes\n7. Unique identifiers: avoid shared accounts\n8. Password managers: encourage or provide for secure password generation/storage\n9. Regular review: update policy based on current threats and standard"}],"name":"Password management policy established","status":"PASSING"}]},{"category":"DATA_MANAGEMENT_AND_PROTECTION","controls":[{"description":"Implement and maintain procedures to securely delete data when it is no longer needed, in compliance with data protection regulations and company policies.","frameworks":[{"id":"iso27001_v1"}],"name":"Data deletion enforced","status":"PASSING"},{"description":"All sensitive data is encrypted when stored on systems or devices.\n","frameworks":[{"id":"iso27001_v1"},{"id":"gdpr_v1"}],"name":"Data encrypted at rest","status":"PASSING"},{"description":"All data is encrypted when transmitted over networks, both within the organization's internal network and external connections.\n","frameworks":[{"id":"iso27001_v1"},{"id":"gdpr_v1"}],"name":"Data encrypted in-transit","status":"PASSING"},{"description":"An accurate and up-to-date inventory of all data assets is maintained, covering data stored in databases, file shares, or cloud storage.\n","frameworks":[{"id":"gdpr_v1","notes":"Create and maintain a comprehensive inventory of all processed personal data (Data Record of Processing Activities, RoPA), including:\n\n- Processing activity,\n- Types of data,\n- Purposes of processing,\n- Categories of data subjects,\n- Recipients,\n- Retention periods, and\n- Security measures.\n\nEspecially consider the processing of special categories of personal data such as\n\n- Racial or ethnic origins\n- Religious or philosophical beliefs\n- Genetic data\n- Health, sex life, or sexual orientation data\n- Political opinions\n- Trade union membership\n- Biometric data that could uniquely identify someone\n\nThis inventory is crucial for GDPR compliance and helps with data subject requests.\n"},{"id":"iso27001_v1"}],"name":"Data inventory maintained","status":"PASSING"},{"description":"A data management and retention policy is established, outlining guidelines for how long data should be retained and how it should be managed throughout its lifecycle.\n","frameworks":[{"id":"iso27001_v1","notes":"Make sure to include the following requirements in your policy:\n\n- Data inventory: identify and catalog all data types within the organization.\n- Data ownership: identify and document data owners for each data type or category.\n\nAdditional requirements for IP and PII:\n\n- For Intellectual Property (IP): Identify and classify IP assets, and establish specific protection measures including access controls, encryption, and training for handling IP data.\n- For Personally Identifiable Information (PII): Implement data minimization principles, establish procedures for managing data subject rights, and define breach response protocols for PII-related incidents."},{"id":"gdpr_v1","notes":"Explicitly address data minimization and purpose limitation principles. For each category of personal data collected, document the specific purpose(s) and establish criteria for determining the minimum necessary data for each purpose. Implement a regular review process (e.g., annually) to reassess the necessity of collected data and the continued validity of processing purposes.\n\nDefine how long you'll keep every different type of personal data. Specify when and how data will be deleted. Establish that you only keep data as long as necessary for its original purpose, as required by GDPR. Include procedures for secure deletion to respect the data subject's 'right to be forgotten'.\n"}],"name":"Data management and retention policy established","status":"PASSING"},{"description":"Establish and maintain a system for handling all privacy-related inquiries, including general questions, complaints, disputes, and specific requests for personal information access and correction.  ","frameworks":[{"id":"gdpr_v1","notes":"Consider the following points for GDPR:\n\n- Establish a dedicated channel (e.g., email, web form) for receiving privacy inquiries.\n- Develop procedures to verify the identity of individuals making requests.\n- Create response templates for common inquiries (access, rectification, erasure, etc.). Establish escalation procedures for complex inquiries.\n- Implement a tracking system to ensure timely responses (within one month as per GDPR).\n- Train staff on handling various types of data subject requests.\n- Maintain a log of all inquiries and responses for accountability.\n\nRegularly review inquiry patterns to improve privacy practices and FAQs.\n"}],"name":"External privacy inquiries managed","status":"PASSING"},{"description":"Implement a key management system covering the entire lifecycle of cryptographic keys.","frameworks":[{"id":"iso27001_v1"}],"name":"Key management process implemented","status":"PASSING"},{"description":"A privacy policy is developed, regularly updated, and made accessible to all relevant parties. The goal is to enable transparent communication of data handling practices and to protect individuals' privacy rights. ","frameworks":[{"id":"gdpr_v1","notes":"Create a clear, concise privacy policy in plain language, easily accessible to data subjects.\nInclude the following points:\n\n- Identity and contact details of the controller\n- Purposes of the processing and legal basis\n- Recipients or categories of recipients of the personal data\n- Data retention periods or criteria used to determine that period\n- Existence of data subject rights (access, rectification, erasure, etc.)\n- Right to withdraw consent (if applicable)\n- Right to lodge a complaint with a supervisory authority\n\nMaintain version history of the policy and communicate significant changes to data subjects. Also publish the policy in all languages in which you offer services.\n"}],"name":"Privacy policy created and maintained","status":"PASSING"}]},{"category":"DISASTER_RECOVERY","controls":[{"description":"Automated backups are enabled for all high-risk data and critical systems.\n","frameworks":[{"id":"gdpr_v1"},{"id":"iso27001_v1"}],"name":"Automated backups enabled","status":"PASSING"},{"description":"A comprehensive business continuity and disaster recovery policy is established, outlining the organization's strategies for responding to disruptive incidents and supporting business continuity.\n","frameworks":[{"id":"iso27001_v1"},{"id":"gdpr_v1"}],"name":"Business continuity and disaster recovery policy established","status":"PASSING"},{"description":"Develop and maintain a backup and recovery policy that defines the your approach to protecting and preserving critical data.","frameworks":[{"id":"iso27001_v1"}],"name":"Data backup and recovery policy established","status":"PASSING"},{"description":"Establish a data recovery process that defines procedures for recovering data in case of data loss, corruption, or system failures. A robust data recovery process helps minimize downtime and data loss in critical situations.\n","frameworks":[{"id":"gdpr_v1"},{"id":"iso27001_v1"}],"name":"Data recovery process established","status":"PASSING"},{"description":"Regularly test the data recovery process to validate its effectiveness and ensure that data can be successfully restored from backups. Testing helps identify any issues or gaps in the data recovery plan.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Data recovery tested","status":"PASSING"},{"description":"Regularly test the organization's disaster recovery plans to ensure their effectiveness and identify areas for improvement. Testing helps validate the ability to recover critical systems and operations in the event of a disaster.\n","frameworks":[{"id":"iso27001_v1"},{"id":"gdpr_v1"}],"name":"Disaster recovery plans tested","status":"PASSING"},{"description":"Isolate the recovery data from the production environment to prevent accidental overwriting or corruption of backups. Keeping recovery data separate helps maintain the integrity and availability of backup copies.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Recovery data isolated","status":"PASSING"}]},{"category":"EMAIL_SECURITY","controls":[{"description":"DMARC (Domain-based Message Authentication, Reporting, and Conformance) policy and verification mechanisms are implemented to prevent email spoofing and phishing attacks.\n","frameworks":[{"id":"iso27001_v1"}],"name":"DMARC policy and verification used","status":"PASSING"},{"description":"Access to email accounts is restricted to administrators only, and isn't delegated to other non-admin users within the organization.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Email account access restricted","status":"PASSING"},{"description":"Email settings are configured to block malicious content, including malicious attachments, links, and scripts.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Email settings block malicious content","status":"PASSING"}]},{"category":"ENDPOINT_SECURITY","controls":[{"description":"Anti-malware or antivirus solutions are deployed on end-user devices, such as laptops and workstations.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Anti-malware deployed on end-user devices","status":"PASSING"},{"description":"Enforce automatic session locking to prevent unauthorized access to unattended devices. Automatic session locking helps protect sensitive data from unauthorized access and misuse.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Automatic session locking enforced","status":"PASSING"},{"description":"Data stored on end-user devices (e.g., laptops, mobile devices) is encrypted to protect it in case of device loss or theft.\n","frameworks":[{"id":"gdpr_v1"},{"id":"iso27001_v1"}],"name":"Data encrypted on end-user devices","status":"PASSING"},{"description":"Firewalls are installed and properly maintained on end-user devices, such as laptops and workstations.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Firewall maintained on end-user devices","status":"PASSING"},{"description":"A mobile device management (MDM) solution is used to manage and secure end-user devices.\n","frameworks":[{"id":"gdpr_v1"},{"id":"iso27001_v1"}],"name":"Mobile device management (MDM) used","status":"PASSING"}]},{"category":"INFRASTRUCTURE_SECURITY","controls":[{"description":"Restrict administrator access to critical systems and sensitive data based on the principle of least privilege, granting elevated permissions only when necessary for specific tasks and revoking them promptly after completion. Implement strong authentication mechanisms, such as multi-factor authentication, and regularly review and update administrator access rights to ensure they align with job responsibilities and maintain a secure environment.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Administrator access restricted","status":"PASSING"},{"description":"Deploy anti-malware or antivirus solutions on infrastructure components such as servers and network devices. This helps detect and prevent malware infections and other malicious activities targeting critical systems.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Anti-malware deployed on infrastructure","status":"PASSING"},{"description":"Automated security scanning software is deployed on all infrastructure components including servers and network devices.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Automated security scanning performed on infrastructure","status":"PASSING"},{"description":"Enforce clock synchronization across all systems and devices within the organization's network using a reliable and accurate time source, such as Network Time Protocol (NTP) or Precision Time Protocol (PTP). Regularly monitor and audit system clocks to ensure they remain synchronized and promptly address any discrepancies to maintain the integrity of time-dependent processes, such as logging, authentication, and transaction processing.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Clock synchronization enforced","status":"PASSING"},{"description":"Implement a configuration management system to manage and control the configuration of systems, applications, and infrastructure. Configuration management helps maintain consistency and security across the IT environment.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Configuration management system established","status":"PASSING"},{"description":"Firewalls are configured to restrict public access to the organization's infrastructure components.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Firewall restricts public access to infrastructure","status":"PASSING"},{"description":"Deploy high availability infrastructure across multiple availability zones or regions to ensure system redundancy and fault tolerance. Configure load balancing, automatic failover, and data replication mechanisms to minimize downtime and maintain uninterrupted service in the event of hardware, software, or network failures.\n","frameworks":[{"id":"iso27001_v1"}],"name":"High availability infrastructure used","status":"PASSING"},{"description":"Implement a review process for all proposed infrastructure changes before implementation. Reviews ensure that changes comply with security policies, do not introduce vulnerabilities, and align with the organization's requirements.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Infrastructure changes require review","status":"PASSING"},{"description":"Adopt an infrastructure-as-code (IaC) approach to deploy and manage the organization's infrastructure components. IaC tools enable consistent and version-controlled infrastructure deployment, reducing the risk of configuration errors.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Infrastructure deployed using an infrastructure-as-code tool","status":"PASSING"},{"description":"Establish a comprehensive key management policy that defines the processes for generating, storing, distributing, rotating, and revoking cryptographic keys used for data encryption, digital signatures, and secure communication. Ensure the key management policy aligns with industry best practices and regulatory requirements, and regularly review and update the policy to maintain its effectiveness in protecting the confidentiality, integrity, and availability of sensitive information.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Key management policy established","status":"PASSING"},{"description":"Develop and implement a network security policy that provides clear guidelines and requirements for securing your network infrastructure. ","frameworks":[{"id":"iso27001_v1"}],"name":"Network security policy established","status":"PASSING"},{"description":"Maintain separate, dedicated environments for testing and production systems, ensuring changes are thoroughly evaluated before implementation into the live production environment.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Production and test environments separated","status":"PASSING"},{"description":"Ensure that a process exists to address unauthorized assets on a periodic basis. This process should include regular audits of all assets and a procedure for handling unauthorized assets when they are discovered.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Unauthorized assets addressed and removed","status":"PASSING"},{"description":"Utilize Virtual Private Network (VPN) connections to secure remote communications between users and the organization's internal network. VPNs provide encrypted and authenticated tunnels, ensuring secure data transmission over untrusted networks.\n","frameworks":[{"id":"iso27001_v1"}],"name":"VPN used","status":"PASSING"}]},{"category":"MONITORING_AND_INCIDENT_RESPONSE","controls":[{"description":"Maintain a robust and up-to-date audit log management process. This process should include guidelines for capturing, storing, and monitoring audit logs, ensuring the availability and integrity of essential security event data.\n","frameworks":[{"id":"gdpr_v1","notes":"Set up a system to collect and store logs of all actions involving personal data. Define how long logs will be kept and who can access them.\n"},{"id":"iso27001_v1"}],"name":"Audit log management process maintained","status":"PASSING"},{"description":"A breach notification process is established that outlines procedures for detecting, assessing, and reporting security breaches.\n","frameworks":[{"id":"gdpr_v1","notes":"Develop procedures to detect, assess, and document all data breaches. Implement a risk assessment process to determine the potential impact on individuals' rights and freedoms. For breaches likely to result in a risk to individuals:\n1. Establish capability to notify relevant supervisory authorities within 72 hours of becoming aware of the breach.\n2. Prepare to notify affected EU and UK data subjects without undue delay if the breach is likely to result in a high risk to their rights and freedoms.\nDocument all breaches internally, including those that don't meet the threshold for external reporting. Include in your procedures the criteria for determining when notification is necessary and to whom (authorities and/or individuals). Design your process to account for the specific reporting requirements of different EU member states and the UK.\n"}],"name":"Breach notification process established","status":"PASSING"},{"description":"Define and implement comprehensive compliance monitoring processes to evaluate the performance and effectiveness of the information security management system (ISMS).","frameworks":[{"id":"iso27001_v1"}],"name":"Compliance monitoring processes defined and implemented","status":"PASSING"},{"description":"An incident response policy is established that outlines the organization's approach and procedures for detecting, responding to, and recovering from cybersecurity incidents.\n","frameworks":[{"id":"iso27001_v1","notes":"Include the following points in the incident response policy:\n\n- Define roles and responsibilities for incident management\n- Include mechanisms for assessing and classifying information security incidents\n- List your procedures for reporting information security events and weaknesses\n- List your procedures for responding to incidents, including evidence collection and forensics\n- List your procedures for identifying, collecting, and preserving information as evidence\n\nAdditionally, integrate the incident response process with your overall Information Security Management System (ISMS) and ensure regular testing and updates of the incident response plan."},{"id":"gdpr_v1"}],"name":"Incident response policy established","status":"PASSING"},{"description":"The performance of the organization's infrastructure components is monitored to detect potential issues or anomalies that may impact security or reliability.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Infrastructure performance monitored","status":"PASSING"},{"description":"Establish comprehensive system logging and monitoring requirements that enable detection of security events, support incident investigations, and maintain operational visibility across information systems.","frameworks":[{"id":"iso27001_v1"}],"name":"Logging and monitoring policy established","status":"PASSING"},{"description":"Implement monitoring mechanisms for the network infrastructure to detect and respond to suspicious or unauthorized activities. Network monitoring helps ensure the integrity and availability of network resources.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Network infrastructure monitored","status":"PASSING"},{"description":"Create and maintain a threat intelligence program to gather, analyze, and share information about potential threats to your information and systems. ","frameworks":[{"id":"iso27001_v1"}],"name":"Threat intelligence established","status":"PASSING"}]},{"category":"ORGANIZATIONAL_SECURITY","controls":[{"description":"Establish and maintain an acceptable use policy that outlines permissible activities, systems, and data access for all users, contractors, and third parties interacting with the organization's information assets and technologies.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Acceptable use policy established","status":"PASSING"},{"description":"Establish and maintain an accurate, detailed, and up-to-date inventory of all enterprise assets with the potential to store or process data. This can include end-user devices, network devices, IoT devices, and servers.","frameworks":[{"id":"iso27001_v1"}],"name":"Asset inventory maintained","status":"PASSING"},{"description":"Establish an asset management policy that outlines the guidelines for managing the organization's assets throughout their lifecycle.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Asset management policy established","status":"PASSING"},{"description":"Establish a change management policy that defines procedures for controlling and documenting changes to systems, applications, and infrastructure. ","frameworks":[{"id":"iso27001_v1"}],"name":"Change management policy established","status":"PASSING"},{"description":"A code of conduct is established that outlines the expected behavior and ethical standards for all employees.\n","frameworks":[{"id":"gdpr_v1"},{"id":"iso27001_v1"}],"name":"Code of conduct established","status":"PASSING"},{"description":"Establish and maintain a structured approach for internal and external communications related to your security program.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Communication procedure established","status":"PASSING"},{"description":"Key company security commitments and policies are externally communicated, including the Master Service Agreement (MSA), Security Information page, or Terms of Service.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Company security commitments externally communicated","status":"PASSING"},{"description":"Establish and maintain a structured approach for controlling documented information related to your security program to ensure availability, integrity, and protection.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Documentation procedure established","status":"PASSING"},{"description":"Ensure that you are using employment contracts for all of your employees. These contracts should include confidentiality and non-disclosure agreements, legal responsibilities and rights, responsibilities for data handling, and actions to be taken if employees disregard the organization's security requirements.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Employment contracts used","status":"PASSING"},{"description":"Develop and maintain a human resource policy that addresses information security responsibilities throughout the employment lifecycle, from recruitment to termination.","frameworks":[{"id":"iso27001_v1"}],"name":"Human resource security policy established","status":"PASSING"},{"description":"Stay connected with the broader security community by engaging with professional groups, industry forums, and security events to keep current with evolving threats and best practices.","frameworks":[{"id":"iso27001_v1"}],"name":"Information security communities identified","status":"PASSING"},{"description":"Incorporate information security considerations into all stages of project management. ","frameworks":[{"id":"iso27001_v1"}],"name":"Information security in project management integrated","status":"PASSING"},{"description":"Develop and maintain an information security policy that outlines your approach to protecting information assets and systems.","frameworks":[{"id":"iso27001_v1","notes":"The Policy has be be approved by top management as it sets out the organization’s approach to managing its information security."}],"name":"Information security policy established","status":"PASSING"},{"description":"An internal security audit is performed annually to evaluate the effectiveness of information security controls, verify compliance with security requirements, and identify areas for improvement.\n","frameworks":[{"id":"iso27001_v1","notes":"To maintain separation of duties, the internal security audit should be performed by someone who doesn’t work on implementing and maintaining the ISMS. "},{"id":"gdpr_v1"}],"name":"Internal security audit performed","status":"PASSING"},{"description":"Establish regular communication channels for internal security updates, alerts, and policies to keep employees informed about relevant security practices, potential threats, and compliance requirements. ","frameworks":[{"id":"iso27001_v1","notes":"Maintain a structured approach to internal security communications. Ensure that communications reach all relevant employees, covering both routine updates and urgent notifications for security incidents.."}],"name":"Internal security communication maintained","status":"PASSING"},{"description":"Your leadership team, including founders and board members, needs to demonstrate they're serious about security. This means actively overseeing and supporting your company's security efforts, not just delegating it to the tech team.","frameworks":[{"id":"iso27001_v1","notes":"To align with ISO 27001 requirements, make sure that your leadership:\n\n- Approves and reviews your Information Security Policy\n- Integrates information security objectives with business objectives\n- Provides necessary resources for information security\n- Communicates the importance of effective information security and ISMS conformance\n- Directs and supports staff to contribute to ISMS effectiveness\n- Promotes continual improvement of the ISMS"}],"name":"Leadership security commitment established ","status":"PASSING"},{"description":"Conduct regular management reviews to assess the effectiveness, adequacy, and alignment of the compliance framework with organizational objectives, risks, and regulatory requirements.","frameworks":[{"id":"iso27001_v1","notes":"Management review meetings must address ISMS performance, alignment with the organization’s risk context, and resource needs. Key topics should include recent audit results, control objectives, risk assessments, and incident records. Document each meeting's outcomes, including any strategic decisions or action items, to demonstrate ISO 27001 alignment and support continuous improvement."}],"name":"Management review implemented","status":"PASSING"},{"description":"Maintain an accurate and current visual representation of your organization's network architecture.","frameworks":[{"id":"iso27001_v1"}],"name":"Network diagrams maintained","status":"PASSING"},{"description":"Systematically identify, document, investigate, and address information security non-conformities through structured corrective actions that prevent recurrence and drive continuous improvement.","frameworks":[{"id":"iso27001_v1"}],"name":"Non-conformance and corrective action procedures established","status":"PASSING"},{"description":"Establish and maintain standardized operating procedures that ensure consistent, secure, and reliable operation of information systems and supporting infrastructure.","frameworks":[{"id":"gdpr_v1","notes":"Develop a system for organizing and maintaining all GDPR-related documentation. This should include:\n\n- Records of processing activities\n- Records of data protection impact assessments\n- All data protection policies and procedures\n- Records of consent, where applicable\n- Logs of data breaches and subsequent actions taken\n- Training materials and attendance records for staff data protection training\nEstablish version control and regular review processes for all documentation and make sure this documentation is readily available for demonstrating compliance to authorities.\n"},{"id":"iso27001_v1","notes":"Here’s what to consider when implementing this control:\n\n- Documentation scope\n    - Cover all operational activities associated with information security\n    - Include manual tasks and one-off system maintenance procedures\n- Content of operating procedures\n    - Operations management: system owners and responsibilities, and backup requirements\n    - Incident and recovery: error handling steps, support contacts/escalation, and recovery procedures\n    - Monitoring and maintenance: system monitoring, maintenance schedules, and capacity checks"}],"name":"Operational procedures maintained","status":"PASSING"},{"description":"Conduct regular performance evaluations for employees to assess their job performance, identify areas for improvement, and recognize exceptional contributions. Performance evaluations support talent development and performance management.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Performance evaluations conducted","status":"PASSING"},{"description":"Physical access to the organization's facilities, equipment, and systems is restricted to authorized personnel only.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Physical access restricted","status":"PASSING"},{"description":"Establish a physical security policy that outlines the organization's processes for protecting physical assets and resources. ","frameworks":[{"id":"iso27001_v1","notes":"Ensure your physical security policy addresses the following specific areas:\n\n- Secure areas: Define and implement a security perimeter, physical entry controls, and procedures for working in secure areas.\n- Equipment security: Establish guidelines for equipment siting and protection, supporting utilities, cabling security, and equipment maintenance.\n- Clear Desk and Clear Screen Policy: Include requirements for maintaining a clear desk for papers and removable storage media, and a clear screen for information processing facilities.\n- Removal of assets: Define procedures for the removal of assets from the premises, including authorization requirements.\n- Information classification: Ensure the policy addresses how physical documents and media are classified, labeled, handled, and stored based on their security classification."}],"name":"Physical security policy established","status":"PASSING"},{"description":"Security policies are formally acknowledged and signed by all relevant personnel, establishing accountability for security responsibilities.\n","frameworks":[{"id":"gdpr_v1"},{"id":"iso27001_v1"}],"name":"Policies signed by relevant personnel","status":"PASSING"},{"description":"Reference checks are conducted when hiring new employees to verify their qualifications, experience, and suitability for the role.\n","frameworks":[{"id":"iso27001_v1","notes":"If you hire someone for a specific information security role make sure the candidate:\n\n- has the necessary competence to perform the security role; and\n- can be trusted to take on the role, especially if the role is critical for the organization."}],"name":"Reference checks performed for employees","status":"PASSING"},{"description":"Maintain a clear record of which data protection authorities have jurisdiction over your operations, and establish reliable communication channels with them for compliance reporting and incident response.","frameworks":[{"id":"gdpr_v1","notes":"To comply with GDPR requirements regarding supervisory authorities:\n\n- Identify your lead supervisory authority (= Data Protection Authority, DPA) and other relevant authorities in EU countries where you operate.\n- Establish procedures for:\n  - Notifying authorities of data breaches within 72 hours\n  - Consulting authorities before high-risk processing\n  - Cooperating with investigations\n- Task your Data Protection Officer (if appointed) with authority liaison.\n\nMaintain a log of all authority interactions. Regularly monitor authority communications for regulatory updates.\n"},{"id":"iso27001_v1"}],"name":"Relevant authorities identified","status":"PASSING"},{"description":"Establish a remote work policy that outlines the requirements, guidelines, and best practices for securely working from outside the office. Ensure the policy covers topics such as approved devices, secure network connections, data protection measures, and communication protocols.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Remote work policy established","status":"PASSING"},{"description":"Demonstrate that sufficient resources are in place to support your ISMS. This can be done by showing external support, internal task tracking, or evidence of security tool usage.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Resources for ISMS available","status":"PASSING"},{"description":"Clearly define roles and responsibilities for all employees within the organization. Specifying roles helps establish accountability and ensures that employees understand their duties and expectations.","frameworks":[{"id":"gdpr_v1","notes":"To comply with GDPR, a company must:\n\n- Appoint a Data Protection Officer (DPO) if one of these points apply:\n  - You’re a public authority\n  - Your core activities require large-scale, regular monitoring of individuals\n  - You process special categories of data on a large scale\n- If appointed, the DPO must:\n  - Report to the highest management level\n  - Operate independently\n  - Not be dismissed for performing their tasks\n- Designate an EU representative if your company is not established in the EU but offers goods/services to or monitors EU residents, unless processing is occasional and low-risk. The representative:\n  - Must be based in an EU country where you have data subjects\n  - Act as a point of contact for supervisory authorities and data subjects\n\nClearly define and document these roles and establish that they have the authority and resources to carry out their responsibilities effectively.\n\nCommunicate these roles to all staff and ensure they're easily contactable by employees and external stakeholders.\n"},{"id":"iso27001_v1","notes":"Establish an ISMS Roles and Responsibilities Policy to create clarity around ISMS-related responsibilities. This includes appointing an ISMS Manager to lead and coordinate all ISMS activities.  "}],"name":"Roles and responsibilities specified","status":"PASSING"},{"description":"Establish a clearly defined scope for the compliance framework that identifies relevant business processes, IT assets, and organizational boundaries. This scope should align with regulatory, security, and operational requirements, enabling consistent application of compliance controls and efficient management of risk.","frameworks":[{"id":"iso27001_v1","notes":"The ISMS Scope Document must define all in-scope business units, functions, IT systems, and physical locations that impact information security. It is essential to document any exclusions and justify them with a risk-based rationale. Review the scope periodically, especially when organizational changes occur."},{"id":"gdpr_v1"}],"name":"Scope for compliance framework established","status":"PASSING"},{"description":"Security awareness training is conducted annually for all employees, covering cybersecurity threats, social engineering, authentication best practices, and handling of sensitive data.\n","frameworks":[{"id":"iso27001_v1"},{"id":"gdpr_v1"}],"name":"Security awareness training conducted","status":"PASSING"},{"description":"Designate a security official who is responsible for the development, implementation, and oversight of security policies and procedures, as well as management of the incident response process.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Security official assigned","status":"PASSING"},{"description":"A well-defined and documented development lifecycle is implemented for software and applications.\n","frameworks":[{"id":"iso27001_v1","notes":"Integrate security checks at each stage such as for example:\n\n- Requirements: Include security requirements\n- Design: Conduct threat modeling\n- Development: Use secure coding practices\n- Testing: Perform security testing (e.g., SAST, DAST)\n- Deployment: Secure configuration management\n- Maintenance: Regular security updates"}],"name":"Software development lifecycle established","status":"PASSING"},{"description":"Complete a formal document identifying relevant controls to your organization based on an ISO guideline.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Statement of applicability completed","status":"PASSING"},{"description":"Communicate relevant system changes, updates, or maintenance activities to external users or customers who may be impacted. External communication helps manage expectations and maintain transparency.\n","frameworks":[{"id":"iso27001_v1"}],"name":"System changes externally communicated","status":"PASSING"},{"description":"Ensure that system changes, updates, and maintenance activities are communicated internally to relevant teams and stakeholders. Internal communication helps coordinate efforts and minimize potential disruptions.\n","frameworks":[{"id":"iso27001_v1"}],"name":"System changes internally communicated","status":"PASSING"},{"description":"Establish clear and well-defined agreements with third-party vendors and partners that outline responsibilities, security expectations, and service-level commitments.","frameworks":[{"id":"gdpr_v1","notes":"All agreements with Vendors must include GDPR-specific clauses: establish and review data processing agreements with third parties. Cover topics like data breach notification and data subject rights.\n"},{"id":"iso27001_v1","notes":"Attach or link your Cloud Service Provider agreement(s) as evidence to demonstrate that security responsibilities are clearly defined and agreed upon. This may include your Terms of Service or Service Level Agreements.\n\nIn your agreements, make sure to specify data protection and privacy requirements and add provisions for incident reporting and breach notification. You also want to include a right to audit the supplier processes and controls related to the agreement.\n"}],"name":"Vendor agreements established","status":"PASSING"}]},{"category":"RISK_MANAGEMENT","controls":[{"description":"Establish an internal audit program to evaluate the effectiveness and compliance of the organization's Information Security Management System (ISMS).","frameworks":[{"id":"iso27001_v1","notes":"The implementation of this control will be closely coordinated with the Oneleet team. Once you’re ready for this step, please reach out via your dedicated Slack channel. "}],"name":"Internal audit program defined","status":"PASSING"},{"description":"Risk assessments are conducted at least annually to identify and evaluate potential threats and vulnerabilities that could impact the organization's assets.\n","frameworks":[{"id":"iso27001_v1"},{"id":"gdpr_v1","notes":"Regularly assess the risks to personal data in your systems. Consider things like cyber threats and human errors. Use the results to improve your security measures, as required by GDPR.\n"}],"name":"Risk assessments performed","status":"PASSING"},{"description":"A risk management policy is established that outlines the organization's approach to identifying, assessing, and mitigating information security risks.\n","frameworks":[{"id":"iso27001_v1","notes":"Make sure that your Risk Management Policy includes the following aspects:\n\n1. Risk acceptance criteria\n2. Risk management approach, incl. criteria for performing risk assessments\n3. Risk treatment options\n4. Responsibilities for risk owners"}],"name":"Risk management policy established","status":"PASSING"},{"description":"Assign ownership of identified risks to specific individuals within the organization to ensure accountability and effective risk management. Risk owners are responsible for monitoring, mitigating, and reporting on the risks assigned to them, enabling proactive management and alignment with organizational objectives.","frameworks":[{"id":"iso27001_v1","notes":"Assign risk owners who are accountable for the ongoing assessment, treatment, and reporting of risks within the ISMS. Document these assignments in the risk register and review them periodically, particularly when risks evolve or organizational roles change."}],"name":"Risk owners identified","status":"PASSING"},{"description":"Establish and maintain risk treatment plans to systematically address identified security risks through a documented approach of mitigation strategies, ensuring proper oversight and continuous monitoring of risk reduction efforts.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Risk treatment plans established","status":"PASSING"},{"description":"Software supply chain risks are monitored by assessing the security of third-party libraries and open-source components used in the organization's software development lifecycle.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Software supply chain risks monitored","status":"PASSING"},{"description":"An accurate and up-to-date inventory of all vendors is maintained, including details such as the services provided, contract terms, and the scope of access they have.\n","frameworks":[{"id":"iso27001_v1"},{"id":"gdpr_v1"}],"name":"Vendor inventory maintained","status":"PASSING"},{"description":"Develop and maintain a third-party management policy that defines the your approach to managing information security risks associated with external parties.","frameworks":[{"id":"iso27001_v1"}],"name":"Vendor management policy established","status":"PASSING"},{"description":"A vendor management policy is established to assess, monitor, and manage the risks associated with third-party vendors, ensuring that external partners meet security and compliance standards.\n","frameworks":[{"id":"iso27001_v1"},{"id":"gdpr_v1","notes":"As you collect and manage data from vendors, you must ensure that they have a program in place to manage their data processing activities. This includes ensuring that they have appropriate security measures in place to protect the data.\n\nAdditionally, you should mark the vendor as a subprocessor in your data processing agreement, or make it otherwise clear to the data subjects that the vendor is processing their data on your behalf.\n"}],"name":"Vendor management program established","status":"PASSING"}]},{"category":"VULNERABILITY_MANAGEMENT","controls":[{"description":"Vulnerabilities identified during penetration testing are promptly remediated.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Penetration testing findings remediated","status":"PASSING"},{"description":"Penetration testing is conducted at least every 12 months to identify potential vulnerabilities in the organization's systems, applications, and infrastructure.\n","frameworks":[{"id":"iso27001_v1"}],"name":"Penetration testing performed within the last 12 months","status":"PASSING"},{"description":"A vulnerability management policy is established that outlines the procedures for identifying, assessing, and remediating vulnerabilities in the organization's systems and applications.\n","frameworks":[{"id":"gdpr_v1"},{"id":"iso27001_v1"}],"name":"Vulnerability management policy established","status":"PASSING"}]}],"customDescription":"Privacy-first AI for secure knowledge access and workflow automation across your organization","customPageName":"Omnifact Trust Center","customTitle":"","documents":[{"auditId":"a282e9a0-f144-4e04-9450-f4c438e9bfba","downloadable":true,"fileExtension":"pdf","id":"bb9dd08f-c61a-48f3-be41-9fbcdf24e9c3","name":"Omnifact GmbH - ISO_IEC 27001 2022 Official Certificate","order":1,"tenantId":"6596e4a2-0a09-4c86-a8e3-2e461b1c072e","type":"AUDIT_REPORT","visibility":"PUBLIC"},{"downloadable":false,"evidenceId":"30539394-2fce-4e9f-bfb0-ca6d1ecd355c","fileExtension":"pdf","id":"b52e8992-1217-48b1-9547-c4673e4ba829","name":"Scaleway - AI Provider Data Processing Summary - Omnifact - v1.0","order":1,"tenantId":"6596e4a2-0a09-4c86-a8e3-2e461b1c072e","type":"EVIDENCE_LIBRARY","visibility":"REQUEST_ONLY"},{"downloadable":false,"evidenceId":"4f64abfd-d568-4115-9f24-a67e4bf71e2d","fileExtension":"pdf","id":"b33ec3ad-4dec-434c-a3c7-6860c4e1faaa","name":"STACKIT - AI Provider Data Processing Summary - Omnifact - v1.0","order":2,"tenantId":"6596e4a2-0a09-4c86-a8e3-2e461b1c072e","type":"EVIDENCE_LIBRARY","visibility":"REQUEST_ONLY"},{"downloadable":false,"evidenceId":"38c74249-583b-4503-acee-1198b07e01e2","fileExtension":"pdf","id":"f164db26-c554-4127-bd6a-7b1aa56f18a4","name":"OpenAI - AI Provider Data Processing Summary - Omnifact - v1.2","order":3,"tenantId":"6596e4a2-0a09-4c86-a8e3-2e461b1c072e","type":"EVIDENCE_LIBRARY","visibility":"REQUEST_ONLY"},{"downloadable":false,"evidenceId":"dbc3b5e9-7c22-45f9-a4b4-1f6af1f02c6b","fileExtension":"pdf","id":"e9ad645a-7c8d-477d-961f-544f239b0b7d","name":"Mistral AI - AI Provider Data Processing Summary - Omnifact - v1.2","order":4,"tenantId":"6596e4a2-0a09-4c86-a8e3-2e461b1c072e","type":"EVIDENCE_LIBRARY","visibility":"REQUEST_ONLY"},{"downloadable":false,"evidenceId":"c5eba861-0276-4506-ad5a-5f7d6f88e17a","fileExtension":"pdf","id":"106333c9-ac05-45ec-8116-4dc4f0be3ab3","name":"Google Gemini Enterprise Agent Platform - AI Provider Data Processing Summary - Omnifact - v1.2","order":5,"tenantId":"6596e4a2-0a09-4c86-a8e3-2e461b1c072e","type":"EVIDENCE_LIBRARY","visibility":"REQUEST_ONLY"},{"downloadable":false,"evidenceId":"6298e03b-75de-43a6-b52b-c394168e2e36","fileExtension":"pdf","id":"dcf820f9-bab9-47cd-9966-af51fd7ffad0","name":"Azure OpenAI - AI Provider Data Processing Summary - Omnifact - v1.2","order":6,"tenantId":"6596e4a2-0a09-4c86-a8e3-2e461b1c072e","type":"EVIDENCE_LIBRARY","visibility":"REQUEST_ONLY"},{"downloadable":false,"evidenceId":"2b793e98-0410-4357-9eda-79cd7aa7c4c0","fileExtension":"pdf","id":"d4d92ba2-2996-4a02-b179-fcb3948182c5","name":"Anthropic - AI Provider Data Processing Summary - Omnifact - v1.2","order":7,"tenantId":"6596e4a2-0a09-4c86-a8e3-2e461b1c072e","type":"EVIDENCE_LIBRARY","visibility":"REQUEST_ONLY"},{"downloadable":false,"evidenceId":"28b5997d-9579-445f-9cd3-b6d468a4a558","fileExtension":"pdf","id":"ffb072d9-4439-49d6-9726-cd1f5d480400","name":"Google Gemini API - AI Provider Data Processing Summary - Omnifact - v1.2","order":8,"tenantId":"6596e4a2-0a09-4c86-a8e3-2e461b1c072e","type":"EVIDENCE_LIBRARY","visibility":"REQUEST_ONLY"}],"email":"hello@omnifact.ai","faqs":[],"hasFavicon":true,"hasLogo":true,"lastUpdatedAt":"2026-10-27T10:04:01.11Z","subprocessors":[{"hasIcon":false,"id":"aea6d573-087e-4999-af34-1561c00dea85","name":"Anthropic","processesPii":true,"processingLocations":["US"],"services":["We use Anthropic’s Claude API under the Commercial Terms of Service to process text prompts and generate LLM responses.\n\nTypes of data processed:\n- Text prompts containing internal company information (e.g., knowledge base content, ticket texts, document excerpts, code snippets)\n- Generated model outputs (responses, summaries, classifications, code suggestions)\n- Technical metadata and logs (timestamps, request IDs, API key IDs, usage metrics, error logs, and potentially IPs/service identifiers)\n\nWe intentionally minimize sending highly sensitive information (e.g., personal data under GDPR, secrets, credentials) through technical and organizational measures (including data masking), but cannot exclude it entirely because user input can vary.\n"],"vendorUrl":"https://www.anthropic.com"},{"hasIcon":false,"id":"23c160ab-0b24-4821-87e3-600b14b0b280","name":"Azure","processesPii":true,"processingLocations":["DE","NL","SE","IE"],"services":["Azure is our primary cloud infrastructure platform. We use Azure to host our application backends, supporting services, and associated storage. This includes:\n  - Customer-owned data processed by Omnifact (e.g., workspace configuration, content indexed into Spaces, metadata, limited user account information and logs, and any customer documents/data we choose to store on Azure resources).\n  - Company-owned data (e.g., internal application configuration, technical logs and monitoring data, infrastructure metadata, backups, and internal service data).\n  The exact data stored depends on the specific Azure services in use (e.g., Azure VMs, Azure Storage, Azure SQL, Key Vault).\n"],"vendorUrl":"https://azure.microsoft.com"},{"hasIcon":false,"id":"a0d755e6-69f4-4e57-9349-03fa6c529ab8","name":"Cloudflare","processesPii":true,"processingLocations":["US","EU"],"services":["Cloudflare provides the content delivery network (CDN), DNS, web application firewall, and DDoS protection that sit in front of Omnifact's public websites and application endpoints. In this role, Cloudflare processes and temporarily stores network traffic metadata such as visitor IP addresses, requested URLs, request headers, and user-agent details, together with cached copies of public web and application assets and security logs used for threat detection, performance, and troubleshooting. It also holds our own account information (administrator names, emails, and roles) and billing data. Cloudflare does not store the documents or content managed within the Omnifact platform itself — that data resides in our primary cloud infrastructure (Microsoft Azure). Traffic is served from Cloudflare's global edge network, and the associated logs and metadata may be processed in the European Union and the United States."],"vendorUrl":"https://www.cloudflare.com"},{"hasIcon":false,"id":"9b7062fb-d6f0-4848-9700-e0c7843d14b2","name":"Google Cloud Platform","processesPii":true,"processingLocations":["US","EU"],"services":["We use Google Cloud Platform (GCP) – specifically Gemini APIs – to process prompts and context from our platform, and to return model responses.\n\nIt also stores configuration and metadata of our projects (API usage logs, service accounts, IAM roles, etc.).\n\nData retention and logging behavior is controlled via our GCP project configuration (including options with “zero data retention” for certain Gemini use paths, and standard log retention for reliability/security)."],"vendorUrl":"https://cloud.google.com"},{"hasIcon":false,"id":"cd47ded5-4a0e-49b8-91dc-8d7163248e85","name":"Mistral AI","processesPii":true,"processingLocations":["US","FR","SE","IE"],"services":["- Input (prompts),\n- Output (generated content)\n- Company Account data (professional contact details, user ID, workspace ID), API Key, and support request data."],"vendorUrl":""},{"hasIcon":false,"id":"8ad5c56c-0137-4877-8507-f90549e0ab68","name":"OpenAI","processesPii":true,"processingLocations":["US"],"services":["We use OpenAI only via their hosted LLM APIs, not via ChatGPT subscriptions.\nThrough the API, OpenAI may store:\n\n- Request content (prompts, system messages, tool calls, etc.)\n- Model outputs (responses)\n- Technical metadata (timestamps, IPs, model/endpoint identifiers, error logs, usage metrics)\n- Account-related data (organization ID, billing information, API key identifiers)\n\nAccording to OpenAI’s current business and enterprise documentation, API data is:\n\n- Encrypted in transit and at rest\n- Retained for a limited period (typically up to 30 days) for abuse monitoring and operational purposes, then deleted, unless stricter residency/retention options are configured.\n\nIn our use case, most end-user content is pre-processed by Omnifact (e.g., masking or pseudonymizing sensitive elements) before being sent to OpenAI, which reduces the amount of real personal or confidential data OpenAI actually sees."],"vendorUrl":"https://openai.com"}]}