Harmony's communication platform, CCM in the Cloud, has been operating to the full satisfaction of various customers for years. The focus of CCM in the Cloud is not only on the functionality offered; information security is just as important a factor. We explain how we ensure that the security of our CCM in the Cloud platform remains guaranteed.

‍

Penetration test report

‍

The architecture of CCM in the Cloud has been designed in such a way that the functionality is covered and at the same time that the necessary security principles are met. A third party tests this security by means of a penetration test. This penetration test consists of several phases:

‍

• The “black box” test: the pentest party has no access to the CCM platform and tries to penetrate by taking advantage of possible vulnerabilities.
• The “white box” test: the pentest party tests whether they can access parts of the platform for which no authorizations have been given with authorizations obtained (similar to authorizations received by customers or supporting parties).
• These intensive tests are repeated annually and any recommendations or findings are addressed or remedied by Harmony. As a customer of CCM in the Cloud, you can receive the management summary of this annually.
  ‍

ISO27001 certification

‍

Harmony has a information security management system (ISMS). Not just for CCM in the Cloud, but for all management services. With the help of this ISMS, the management supervises and controls its proper functioning. This means that:

• Information security policies and procedures in accordance with ISO27001 have been defined.
• These are operationally invested in the hands of the right people.
• A quarterly assessment by the management takes place to determine whether the goals of information security have been achieved.
• An internal audit takes place annually. In doing so, Harmony goes through the Plan-Do-Check-Act cycle on a frequent basis and ensures continuous improvement in the field of information security.
  ‍

As of 2019, Harmony's ISMS has been ISO27001 certified. An independent external auditor annually assesses whether Harmony's ISMS meets all requirements. The ISMS and also the 114 measures in the Annex to ISO27001 (Annex A) will then be reviewed. By certifying, the ISO27001 auditor makes a statement that the ISMS meets the requirements. As a customer of CCM in the Cloud, you can always request the current certificate and statement of applicability.
‍

The new ISO 27001:2022 was released in 2022. Harmony will comply with this new version in time and has already done an impact analysis on this.
‍

ISAE3000 Assurance statement CCM

An ISO27001 certification provides a lot of insight into a working information security management system, but sometimes still provides customers with insufficient certainty about the measures taken. An Assurance Statement (ISAE3000) does provide demonstrable proof of this.

‍

Harmony has an ISAE3000 statement based on the 50 key measures of the Annex (Annex A) to ISO27001. Harmony is audited annually by an accountant who assesses the design, existence and operation of the measures specific to CCM. An ISAE3000 audit looks back over a period (calendar year) of whether CCM has complied with the 50 selected ISO2700 Annex A measures. This is done with intensive partial observation that provides a real reflection of what has taken place. This allows Harmony to give its customers the certainty (“Assurance”) that the processing by CCM takes place in a safe manner. The ISO27001 certification that Harmony has had for years covers all Annex A measures. As a customer of CCM in the Cloud, you can obtain the ISAE3000 statement annually.

In response to this article, do you have questions for us regarding information security or are you interested in our solution and services? Then take feel free to contact us and we would be happy to look at the possibilities with you

‍