Weagree complies with the Digital Operational Resilience Act (DORA) and where applicable in connection with our solutions and services, enables financial institutions to comply with the DORA requirements.
Governance and authorisation
We have established a detailed and exhaustive internal governance and control framework for managing ICT risks, including:
- Policies and procedures covering all aspects of information security and associated risks
- Clearly defined roles and responsibilities with respect to ICT-related functions
- Continuous monitoring of all security measures and regular management-level reviews
ICT risk management framework
A comprehensive risk assessment system underpins our ICT security, with hundreds of risk-based controls.
Our Security Officer is tasked with identifying potential new risks, periodically reviewing both our risk assessments and our ICT-related policies, procedures and concrete security measures, ensuring compliance and handling any information security incidents. Changes are planned and implemented as needed.
Both internal and external audits are conducted annually by independent certified experts.
ICT systems, protocols and tools
Weagree is hosted in the Netherlands by a premier, high-security and high-performance datacentre, which dynamically allocates resources to Weagree to provide uninterrupted service and maintain high system responsiveness.
Repeated penetration tests have resulted in a very high level of security of the Weagree Wizard itself, which is further safeguarded by extensive (GDPR-compliant) logging. Our online identity and presence are monitored continuously, resulting in a score A (usually at least 97% at Security Scorecard).
Identification
All ICT-related roles, responsibilities, information and hardware assets, suppliers (both critical and non-critical) and risk assessments are registered in our ISMS and kept up-to-date, reviewed or evaluated, as applicable and required pursuant to our ISO 27001, ISO 27017 and ISO 27018 certified policies and procedures.
Protection and prevention
Policies and procedures are in place for all aspects of ICT security throughout the organisation, such as use of hardware and cloud services, software development, HR, employee conduct, access rights, data confidentiality, integrity and retention, incident management, and ongoing compliance with laws and regulations applicable to us and our operations.
Detection
Extensive logging, geofencing and other automated monitoring systems at our datacentre and web hosting provider operate continuously to track, flag and control unusual network or user activity.
Response and recovery
We have adopted a detailed business continuity policy (BCP) identifying key operating principles and contingencies, and establishing a clear (BIA-based) order in which production services or data affected by any calamity must be restored. It is subject to periodical review and annual independent internal and external audits.
Backup and restoration
In accordance with our policy, our datacentre creates daily encrypted backups of all customer data, which backup services are tested periodically. Access to backups is highly restricted.
Furthermore, internal Weagree data (i.e. data that we receive and handle outside using the Weagree Wizard) are stored by reliable certified cloud services (e.g. Microsoft Azure) providing backup protection at least equal to our policy requirements.
Learning and evolving
ICT-security awareness training is mandatory for all staff, and a standard part of our employee onboarding procedure.
ICT-related incidents prompt reviews of our policies, procedures or concrete security measures. Such reviews may in turn prompt follow-up actions, including, if applicable, systemic changes that will be planned and implemented in accordance with our change management process.
Communication
In the event of an ICT-related incident, our ISMS details which internal and external communications should take place, when, how and with whom.
ICT-related incident management process
ICT-related incidents are handled on the basis of our incident management process. Any incident is recorded in our ISMS’ dedicated incidents register. Follow-up consists of multiple steps, resulting in corrective action, analysis, determination of scope, any preventive measures deemed necessary and finally an evaluation. Communication channels are defined for different types of incidents and stages of the process.
Classification of ICT-related incidents and cyber threats
We identified around 50 ICT-related risks and have assessed the general likelihood and impact of each.
Our incident management process applies to major incidents such as data leaks or breaches, but also to incidents classified as ‘events’ (threats that have not resulted in actual security violations or failures, such as failed phishing attempts) and ‘security weaknesses’ (unexploited vulnerabilities).
Reporting of ICT-related incidents and cyber threats
We report any major ICT-related incident to the competent authority in accordance with legal requirements and our incident management process.
Digital operational resilience testing
The Weagree Wizard is subjected periodically to integral penetration tests (pen-tests) by independent certified experts. Vulnerabilities identified during a pen-test are patched as quickly as possible. Another pen-test is then scheduled to confirm that the issues have been resolved.
To prevent security issues from arising in the first place, however, our Secure engineering policy, our Secure development policy, our Software development process, our Testing policy and our Upgrade-release policy prescribe planned-out, thorough testing of new or updated Weagree functionalities. Testing is done initially by our programmers and subsequently by our internal testers, always in secure, segregated environments.
Before updates are deployed on production environments, customers may also opt to conduct additional testing themselves on private, customer-exclusive test (acceptance) portals.
ICT third-party risks
Weagree requires the third-party ICT services it relies on for such purposes as software development, hosting and general operations to ensure an industry-standard, high level of security. This means adequate certifications or assurances (e.g. ISO 27001 or ISAE 3402 Type II, SOC2), contractual data processing arrangements and, where applicable, non-disclosure agreements.
Our subcontractors (sub-processors) that may, in connection with providing their services to us or to our customers, potentially be granted access to any information that we classify as ‘confidential’ or ‘sensitive’ are selected and contractually held to the same or higher ICT-security standards as Weagree. Acquiring a new third-party ICT service involves a full assessment of associated risks.
