ISO 27001 / FSQS / SOC 2

ISO 27001 / FSQS / SOC 2

The security of your data is paramount. We have deployed a wide range of controls and measures to manage risk, monitor, assess and respond to emerging threats and mitigate vulnerabilities. Both Mavim and our cloud-hosting partner are ISO 27001:2022 certified. Find Mavim's ISO 27001 scope statement of applicability. Our Information Security Management System (ISMS) utilizes best practices based on ISO 27001:2022 (ISMS in an integrated solution based on the Mavim application, D365 customer service hub, SharePoint and Azure DevOps). Some of the key measures we deploy include:

• Logically isolated customer-specific network regions ensuring separation of each customer’s data;
• Data encryption in transit and at rest, using strong encryption methods;
• Secure encryption key management, including customers to use their own encryption keys if desired;
• Access control based on user role and authentication, with integration to identity and directory services available (e.g. Active Directory, SAML, etc.);
• Secure service operations based on least privilege principles with operational access protected by multi-factor authentication and encrypted VPNs;
• Active vulnerability management via infrastructure hardening, frequent software patch management and application code analysis with our software development life cycle (SDLC), using best practices such as the open web application security project (OWASP);
• Regular penetration tests on our infrastructure and applications (including customer penetration tests with prior arrangement;
• Secure activity monitoring and logging for audit trail purposes;
• Secure media disposal and no use of tapes or removable media in our SaaS service infrastructure;
• Invalidates session ID after logout or session timeout. We also close sessions within 30 minutes after idle timeout, absolute timeout (within 4 hrs) and user logout button;
• We secure our application sessions by using "Secure" and HttpOnly cookie attributes, changing session ID's, validating security related cookies and sessions ID's;
• We periodically audit and remove unnecessary accounts from all components of our infrastructure. To ensure immediate removal of system access which is no longer necessary, we have rigorous HR joiner, mover, leaver processes in place as well as an escalation process in case of an urgency;
• To connect to our infrastructure, our system and database admins use Multi Factor Authentication (MFA) with One Time Passwords (OTP). System passwords are periodically changed (without the need of a service outage). Role-based access control (RBAC) is used to authorize users on our administration API;
• Data return and secure destruction at contract end.

FSQS

Mavim: Your Trusted Partner in the Financial Sector, Backed by FSQS-NL Certification

In the intricate landscape of the financial sector, Mavim stands out as a trusted ally, fortified by the prestigious FSQS-NL (Financial Services Qualification System-Netherlands) certificate.

What is FSQS-NL? It's a collaborative network of esteemed financial institutions including banks and insurers. Together, they've forged a standard, simplifying the complex realm of third and fourth parties entrusted with managing sensitive information.

Originally hailing from England through Hellios, the FSQS certificate has garnered significant traction in the Netherlands. Renowned financial institutions such as a.s.r., NN, Achmea, Triodos, and De Volksbank have embraced this system to uniformly assess their suppliers. Why? To fortify risk management and ensure compliance. Simultaneously, they showcase their dedication to regulators, policymakers, and auditing bodies, affirming their adherence to pertinent laws and regulations.

Mavim's attainment of the FSQS certification is a testament to our unwavering commitment. We meet all criteria related to data security, and we comply meticulously with local regulations and codes of conduct in the financial sector.

Here's what this certification means for you, our valued (and potential) customers:

• Validation of supplier data.
• Streamlined procurement processes, saving both time and costs by engaging reliable third parties through pre-qualification, assurance, and ongoing compliance.
• Enhanced identification and management of supply chain risks, bolstering brand reputation.

Our FSQS certification isn't just about transparency in risk management for stakeholders; it's about providing enhanced security, compliance, and responsible business practices. Every bit of data necessary for financial institutions to collaborate with third or fourth parties has been meticulously vetted and validated. This crucial step can be bypassed by your procurement department, simplifying the engagement process significantly.

By virtue of our FSQS-NL certification, partnering with Mavim becomes a seamless endeavor for (potential) customers. It's a testament to our reliability, making it easier for you to entrust us as your steadfast partner in the financial landscape.

For deeper insights into our FSQS-NL certification or to explore how the Mavim Platform can elevate Continuous Improvement, tackle Compliance challenges, or empower with Process Mining for financial institutions, please reach out. We're enthusiastic about providing you with more detailed information.
 

* FSQS (Financial Services Qualification System) is a community of financial institutions including banks, building societies, insurance companies and investment services, collaborating to agree a single standard for managing the increasing complexity of third and forth-party information needed to demonstrate compliance to regulators, policies and governance controls. Mavim maintains FSQS registration.

SOC 2 

Mavim is a software company building transformation management software. We do not process/contain any e.g. financial or PII data and we have no direct impact on our customers financial statements. We also do not carry out any business processes for our clients (e.g. covered in ISAE 3402) or build bespoke stuff. Identity management is firmly in the hands of our customers through federation. Having our information security organization in order implies our principles, processes and policies are in good standing (SOC focus) and information security is most important for our customers knowing that we do not impact their financial statements directly. We have many customers in highly regulated business and geographies and have decided SOC 2 assurance complements our security standing so from 2024 we decided to include SOC 2. 

• Mavim is in possession of ISO27001. Contact us for our certificate and our Statement Of Applicability (SOA). This gives you an idea about our security baseline.
• Mavim has implemented DevSecOps. This means that we have implemented security in our DoD (Definition of done, a.o. 4 eyes policy on coding and testing), but we also have a secure release pipeline and continuous scanning on our environments and code (e.g. SonarCloud, WhiteSource Bolt, Roslyn analyzers, CredScan, Checkmarx (also code bashing), etc.). This, besides the advanced security and security baselines we switched on at MS Azure.
• Mavim is GDPR compliant.
• Mavim has an annual Security Maturity cycle. Meaning we have a specialized external 3rd party performing a security maturity assessment annually and full vulnerability scanning and pen testing on our environments. We also have customers that request to perform their own pen testing. We happily cooperate with this as it makes us better, we do however have a security assessment agreement we then would need to have filled in and signed by an authorized person.
• Mavim has a bi-weekly internal security cycle where the Security team discuss progress on (potential) security issues.
• Our baseline can also be found on our Trustcenter. 

The platform is hosted on Azure. Microsoft follows strict protocols for operating, managing, and monitoring Azure. Comprehensive audits for frameworks such as ISO, SOC, FISMA and FedRAMP are conducted by accredited third-party firms that provide attestations to how data protection requirements are met.

SOC and ISO 27001 are very similar. E.g.

SOC has the so called 5 Trust Services Criteria (or, trust service principles):

• Security: Protecting information from vulnerabilities and unauthorized access
• Availability: Ensuring employees and clients can rely on your systems to do their work 
• Processing integrity: Verifying that company systems operate as intended
• Confidentiality: Protecting confidential information by limiting its access, storage, and use
• Privacy: Safeguarding sensitive personal information against unauthorized users and up to 64 controls(requirements).

ISO 27001, Annex A has 11 (from 1 May 2024 when the new ISO 27001/2022 has become effective). And up to 114 controls (requirements)