Step 1: in this first step, we assess whether we understand our client and focus on the requested specialty. Do we have the in-house expertise for this? Many organizations operate within a specific market segment. For Fundaments, this means the organization we are assisting has needs and requirements that we can fulfill with our solutions. Take a company like TriOpSys; they build and manage Mission Critical IT systems for clients including the government. Think of emergency response centers and traffic control centers. These systems must never fail, as this could cause major economic damage or even human suffering.
Rob Timman, Managing Director of TriOpSys, says the following about the partnership with Fundaments: “Responding quickly, understanding that these are essential systems, providing high quality: these are essential matters for us, and Fundaments delivers that. They do a really great job.
Step 2: next, we hold a discussion with the Data Officer, Security Officer, and CISO. What policies are in place, and which parties are involved in managing the applications? By mapping out the total governance on the client side, Fundaments can, with its own management organization, fully guarantee the processing of data that lands on a platform. If this is not entirely possible, clarifying the demarcation of responsibilities and risks is also part of this step.
Step 3: in this third step, it is important to examine what data exists and how it is classified. Think of classifications such as ‘public’, ‘internal’, ‘confidential’, or ‘secret’. Additionally, a classification can be made based on the impact on business processes: if data is unavailable, what is the impact on the organization? Also: what happens if data falls into the wrong hands? All these characteristics are identified in this step.
Step 4: based on the data classification from the previous step, and especially from the policies regarding data management, an analysis is conducted in this fourth step to determine where data may be stored and processed.
Step 5: besides storing data and knowing its value based on classification, it is important to know who processes the data and how. Who is the exact management organization protecting the data and ensuring its availability? Which individuals work with the data, and which processes ensure proper processing? By establishing the management organization and determining the jurisdiction in which it operates, a risk profile can be established.
Step 6: in this step, we look at how continuous compliance is ensured. Protecting and maintaining the availability of data is a continuous process that must always receive attention within a Deming cycle. This is embedded in many certifications. For Fundaments, this means that it is made transparent through our ISAE3402 type I and II statements in a report on our process improvements. Innovation policy, research into product security, and improving knowledge through employee training also fall under this part of the framework.
Step 7: all previous steps reveal which Cloud can be chosen. For public data, a hyperscaler may be a solution, but for government applications, it must be clear throughout the entire chain where data is hosted and who processes it. Furthermore, technical requirements can play a role; consider the physical distance between the user and the processing of their data. Fundaments also looks closely at data portability between Clouds; especially when an exit strategy is explicitly desired, the migration to and from a Cloud is examined in detail.
Step 8: with the growth and dependency on data, protection and availability are requirements, but the set of applications and the underlying platform are also constantly changing. Keeping up with developments is an important part, precisely because security methods in this evolution are often becoming more diverse and stronger. The chosen Cloud platform must also be able to facilitate this.“Nowadays, making data available and protecting it online is the central issue; Cloud is a means to that end, not the goal itself.”Larik-Jan Verschuren - CTO at Fundaments.
By going through the framework, all relevant matters for your data are mapped out. With the Fundaments sovereign Cloud platform, you can find all the ingredients to make the right choices. Additionally, the Cloud Experts at Fundaments ensure a solid, well-reasoned strategy for your business-critical data.
