Step 1: In this first step, we check whether we understand our client and we put the focus on the required specialism. Do we have the expertise for it? Many organisations are in a particular market segment. For Fundaments, the organisation we are serving has wishes and requirements that we can fulfil through our solutions. Take a look at a company like TriOpSys, they build and manage Mission Critical IT systems for the government, among others. Examples include control rooms and traffic control centres. These systems must never fail, because this could cause major economic damage or even human suffering.
Rob Timman, Managing Director at TriOpSys, says the following about the partnership with Fundaments: “Responding quickly, the understanding that we are dealing with essential systems, and the offering of high quality: these are essential issues for us, and Fundaments provides them. They really do that extremely well."
Step 2: Next, we have a conversation with the Data Officer, Security Officer and CISO. Which policies are followed and which parties are involved in managing applications? By mapping out the total governance on the customer side, Fundaments can fully account for the processing of data landing on a platform with its own management organisation. Should this be partly impossible, clarifying the demarcation on responsibilities and risks is also part of this step.
Step 3: In the third step, it is important to look at which data is out there and how it is classified. Think of classifications such as ‘public’, ‘internal’, ‘confidential’ or ‘secret’. In addition, however, classification can also be done on the impact on business processes: when the data is not available, what is the impact for an organisation? As well as: what does it mean if data gets into the wrong hands? All of these properties are identified in this step.
Step 4: From the data classification in the previous step and especially from the policies on data management, in the fourth step there is an analysis on where data may be stored and processed.
Step 5: Alongside storing and knowing the value of the data from its classification, it is important to know who processes it and how. Who is the exact management organisation that protects the data and ensures its availability? Which people work with the data and which processes ensure correct processing? Identifying the management organisation and also determining the jurisdiction within which the organisation operates will help establish a risk profile.
Step 6: This step looks at how continuous compliance is ensured. Protecting and keeping data available is a continuous process that should always receive attention in a deming cycle. This is guaranteed within many certifications. For Fundaments, this means that from our ISAE3402 type I and II certifications, among others, this is made transparent in a report on our process improvements. In addition, policies on innovation, research on product security and improving knowledge by training employees also fall under this part of the framework.
Step 7: Based on all the previous steps, it is clear which Cloud can be chosen. For public data, a hyperscaler can be a solution, but for government applications, it must be clear throughout the chain where the data is hosted and who processes it. In addition, technical requirements may also play a role in this; think of the physical distance between user and processing of their data. Fundaments also looks at the portability of data between Clouds, especially when an exit strategy is very explicitly desired, the migration to and from a Cloud is examined in detail.
Step 8: In the growth and dependence of data, keeping it protected and available is a requirement, however, the set of applications and the underlying platform are also constantly changing. Keeping up with developments is an important aspect, especially because very often security methods also become more diverse and stringent in this development. The chosen Cloud platform should also be able to facilitate such developments."Nowadays, making data available online and protecting it is the central issue; Cloud is a means and no longer the goal."Larik-Jan Verschuren - CTO at Fundaments.
Going through the framework will identify all the relevant issues for your data. Fundaments' sovereign Cloud platform allows you to find all the components to make the right choices. In addition, Fundaments' Cloud Experts provide a solid, well-argued strategy for your business-critical data.
