{"id":9842,"date":"2023-07-06T19:38:09","date_gmt":"2023-07-06T17:38:09","guid":{"rendered":"https:\/\/netsurit.com\/en-za\/?page_id=9842"},"modified":"2026-08-07T14:54:03","modified_gmt":"2026-08-07T12:54:03","slug":"technical-and-organizational-measures","status":"publish","type":"page","link":"https:\/\/netsurit.com\/en-za\/technical-and-organizational-measures\/","title":{"rendered":"Netsurit Technical and Organizational Measures"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Netsurit Technical and Organizational Measures<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Trusted By<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t
\"Galderma\"<\/figure><\/div>
\"eurolux\"<\/figure><\/div>
\"Turnkey-Partners\"<\/figure><\/div>
\"Eqstra\"<\/figure><\/div>\t\t\t<\/div>\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
<\/a>Effective date: 1 March 2021 | Last reviewed: 4 August 2026 | Version: 3<\/div>
Prepared for Netsurit (Pty) Ltd by: Morn\u00e9 Fourie, Deputy Information Officer,\u00a0<\/span>mornef@netsurit.com<\/u><\/a><\/span><\/div>
\u00a0<\/div>
\u00a0<\/div>

1.1 Introduction<\/h3>
This page describes technical and organizational security measures and controls implemented by Netsurit to protect the data customers entrust to us as part of the Netsurit service.<\/div>
Within this, the following definitions apply:<\/div>
\u201cCustomer\u201d means any subscriber to Netsurit services.<\/div>
\u201cNetsurit Service\u201d means the Technical and Advisory Services provided by Netsurit to our Customers.<\/div>
\u201cConfidential Data\u201d means any information provided, submitted or stored by the Customer that is processed by Netsurit as part of our service delivery and includes Personal Data.<\/div>
\u201cPersonal Data\u201d means any information relating to an identified or identifiable legal and natural person.<\/div>
\u201cPersonnel\u201d means Netsurit employees and authorized individual contractors\/vendors.<\/div>
\u201cStrong Encryption\u201d means the use of industry standard encryption measures.<\/div>
This document is a high-level overview of Netsurit\u2019s technical and organizational measures. Netsurit may change these measures from time to time to adapt to the evolving security landscape and where required will notify customers of these changes.<\/div>
\u00a0<\/div>

<\/a><\/a><\/a>1.2 Organization of Information Security and Privacy<\/h3>
Objective:\u00a0<\/strong><\/div>
\u00a0<\/div>
To outline Netsurit\u2019s information security and privacy structure.<\/div>
\u00a0<\/div>
Measures:\u00a0<\/strong><\/div>
  1. Netsurit is committed to deploy trained\/certified security Personnel responsible for information security and privacy.<\/li>
  2. The information security function and privacy function report directly to a Netsurit senior leadership team member, independent to operational management.<\/li>
  3. Netsurit has a comprehensive set of information security and privacy policies, approved by senior management and disseminated to all Personnel.<\/li>
  4. Netsurit security and privacy policies are reviewed at least annually and updated when needed.<\/li>
  5. All Netsurit Personnel have signed legally reviewed confidentiality agreements that apply during and post-employment.<\/li>
  6. Failure of personnel to follow information security and privacy policies can be treated as a disciplinary matter and lead to sanctions, including dismissal.<\/li>
  7. All Netsurit Personnel are given training in information security and privacy, and complete ongoing awareness training.<\/li>
  8. Netsurit is committed to continual improvement of its security and privacy posture.<\/li><\/ol>
    \u00a0<\/div>

    <\/a><\/a><\/a>1.3 Information Security and Privacy Management System<\/h3>
    Objective:\u00a0<\/strong><\/div>
    \u00a0<\/div>
    Netsurit has established an ISMS (information security management system – ISO 27001), and a \u00a0PIMS (privacy information management system \u2013 ISO 27701) to evaluate risks to the security of Confidential Data and Privacy, to manage the assessment and treatment of these risks and to continually improve its information security and privacy measures.<\/div>
    \u00a0<\/div>
    Measures:\u00a0<\/strong><\/div>
    1. Netsurit has deployed an ISMS (information security management system) and PIMS (privacy information management system) that serve as the foundation of our information security and privacy practices.<\/li><\/ol>
      \u00a0<\/div>

      <\/a><\/a><\/a>1.4 Physical Access<\/h3>
      Objective:\u00a0<\/strong><\/div>
      \u00a0<\/div>
      To protect the physical assets that contain Confidential Data.<\/div>
      \u00a0<\/div>
      Measures:\u00a0<\/strong><\/div>
      1. Netsurit operates from several industry certified third-party production data centres with a defined and protected physical perimeter, strong physical controls including access control mechanisms, controlled delivery and loading areas, surveillance, and security guards.<\/li>
      2. Only authorized Personnel have access to the data centre premises housing Confidential Data and access is controlled through a security registration process requiring a government issued photo ID.<\/li>
      3. Power and telecommunications cabling carrying Confidential Data or supporting information services at the production data centres are protected from interception, interference and damage.<\/li>
      4. The production data centres, and their equipment are physically protected against natural disasters, unauthorized entry, malicious attacks, and accidents.<\/li>
      5. Equipment at the production data centre is protected from power failures and other disruptions caused by failures in supporting utilities and is appropriately maintained.<\/li>
      6. When Confidential Data is copied electronically by Netsurit outside the production data centre, appropriate physical security is maintained, and the data is Encrypted at all times.<\/li><\/ol>
        \u00a0<\/div>

        <\/a><\/a><\/a>1.5 System Access<\/h3>
        Objective:\u00a0<\/strong><\/div>
        \u00a0<\/div>
        To ensure systems containing Confidential Data are used only by approved, authenticated users.<\/div>
        \u00a0<\/div>
        Measures:\u00a0<\/strong><\/div>
        1. Access to Netsurit systems is granted only to Netsurit Personnel and access is strictly limited as required for those persons to fulfil their function.<\/li>
        2. All users access Netsurit systems with a unique identifier (UID).<\/li>
        3. Netsurit has established a password policy that prohibits the sharing of passwords, strong passwords to be used and default passwords to be changed.<\/li>
        4. A second factor of authentication is required for access to online systems containing Confidential Data.<\/li>
        5. Remote access to systems containing Confidential Data are only possible through a secure VPN tunnel and require a second factor of authentication.<\/li>
        6. Netsurit has a process to deactivate users and their access when Personnel leaves the company or a function, and to review and update access rights when Personnel change roles within the company.<\/li>
        7. All access or attempted access to systems is logged and monitored.\u00a0System and Security logs are retained for a period of at least 6 months.<\/li>
        8. Any WiFi networks used by Netsurit in processing of Confidential Data will have Strong Encryption enabled and require user authentication.<\/li><\/ol>
          \u00a0<\/div>

          <\/a><\/a><\/a>1.6 Data Access<\/h3>
          Objective:\u00a0<\/strong><\/div>
          \u00a0<\/div>
          To ensure Personnel entitled to use systems gain secure access only to the Confidential Data that they are authorized to access.<\/div>
          \u00a0<\/div>
          Measures:\u00a0<\/strong><\/div>
          1. Netsurit restricts Personnel access to files and programs on a \u201cneed to know\u201d basis and perform regular reviews of user accounts and access rights on systems that store Confidential Data.<\/li>
          2. Netsurit ensures that appropriate personnel receive alerts and notifications from system software vendors and other sources of security advisories and installs system software patches regularly.<\/li>
          3. Netsurit uses up-to-date anti-virus software on all appropriate computers and servers.<\/li>
          4. Netsurit uses well-configured firewalls, including host-based firewalls, to protect access to the network, computers and servers.<\/li>
          5. Netsurit conducts regular vulnerability scanning to identify and resolve weaknesses in the network, servers, workstations and applications.<\/li>
          6. Remote access and its subsequent operations on Customer networks are logged and monitored.<\/li>
          7. Customer network credentials are saved in an encrypted repository, and only authorised Personnel are provided access to the credentials.<\/li>
          8. Personnel training covers access rights to and general guidelines on definition and use of Confidential Data.<\/li>
          9. Secure baseline configurations are developed for systems that access and\/or process Confidential Data, including software versions, security patch levels, managed anti-virus detection, encryption level, TPM module requirements and security settings for audit.<\/li>
          10. An automated audit process that documents system security events will be implemented for systems that process Confidential Data.<\/li>
          11. Netsurit implements appropriate controls to safeguard against data leakage, enable remote wipe of mobile devices and to ensure that mobile devices comply with the security baseline configuration.<\/li>
          12. Where Netsurit uses contractors to assist with processing of Confidential Data, an appropriate Operator\/Processor agreement will be signed with the third party that clearly indicates the responsibilities of the third party to safeguard Confidential Data, including the Technical and Organization Measures that the third party has to comply with.<\/li><\/ol>
            \u00a0<\/div>

            <\/a><\/a><\/a>1.7 Data Transmission\/Storage\/Destruction<\/h3>
            Objective:\u00a0<\/strong><\/div>
            \u00a0<\/div>
            To ensure Confidential Data is not read, copied, altered or deleted by unauthorized parties during transfer\/storage.<\/div>
            \u00a0<\/div>
            Measures:\u00a0<\/strong><\/div>
            1. Access to the Netsurit Service portals are protected by the most current version of Transport Layer Security (TLS).<\/li>
            2. Netsurit uses Strong Encryption in the transmission of Confidential Data outside the production data centres.<\/li>
            3. Confidential Data stored outside the production data centre is protected by Strong Encryption, regardless of media type.<\/li>
            4. Upon Customer\u2019s request, Confidential Data will be promptly deleted.<\/li>
            5. Netsurit equipment or disk media containing Confidential Data are not physically removed from the production data centre unless securely erased prior to such removal or being transferred securely for destruction at a third-party site.<\/li><\/ol>
              \u00a0<\/div>

              <\/a><\/a><\/a>1.8 Confidentiality and Integrity<\/h3>
              Objective:\u00a0<\/strong><\/div>
              \u00a0<\/div>
              To ensure Confidential Data remains confidential throughout processing and remains intact, complete and current during processing activities.<\/div>
              \u00a0<\/div>
              Measures:\u00a0<\/strong><\/div>
              1. Netsurit has a formal background check process and carries out background checks on all new Personnel in critical roles with access to Confidential Data.<\/li>
              2. Netsurit trains its Personnel in application security practices.<\/li>
              3. All changes to software are via a controlled, approved release mechanism within a formal change control program.<\/li>
              4. All encryption and other cryptographic functionality used within Netsurit uses industry standard encryption and cryptographic measures.<\/li><\/ol>
                \u00a0<\/div>

                <\/a><\/a><\/a>1.9 Availability<\/h3>
                Objective:\u00a0<\/strong><\/div>
                \u00a0<\/div>
                To ensure Confidential Data is protected from accidental destruction or loss, and there is timely access, restoration or availability to Confidential Data in the event of an incident.<\/div>
                \u00a0<\/div>
                Measures:\u00a0<\/strong><\/div>
                1. Each production data centre has multiple power supplies, generators on-site and with battery back-up to safeguard power availability to the data centre.<\/li>
                2. Each production data centre has multiple access points to the Internet to safeguard connectivity.<\/li>
                3. Each production data centre is monitored 24x7x365 for power, network, environmental and technical issues.<\/li>
                4. Netsurit has a business continuity plan in place that is regularly updated.<\/li>
                5. Netsurit tests elements of its business continuity plan regularly and learns from the results of such tests.<\/li>
                6. Netsurit makes a reasonable effort to create frequent, encrypted backup copies of Confidential Data, and these are stored in a geographically separate location to the data centre.<\/li>
                7. Netsurit has a process in place to ensure that backup failures are flagged and dealt with.<\/li>
                8. Netsurit performs restore tests of backups on at least a quarterly basis.<\/li>
                9. Netsurit keeps an up-to-date register of Personnel who are authorised to request access to backup media and restore of data.<\/li>
                10. Netsurit monitors server, service and resource availability via a network monitoring system.<\/li><\/ol>
                  \u00a0<\/div>

                  <\/a><\/a><\/a>1.10 Data Separation<\/h3>
                  Objective:\u00a0<\/strong><\/div>
                  \u00a0<\/div>
                  To ensure each Customer\u2019s Data is processed separately.<\/div>
                  \u00a0<\/div>
                  Measures:\u00a0<\/strong><\/div>
                  1. Netsurit uses logical separation within its multi-tenant architecture to enforce data segregation between customers.<\/li>
                  2. Customers only have access to their own Confidential Data.<\/li><\/ol>
                    \u00a0<\/div>

                    <\/a><\/a><\/a>1.11 Incident Management<\/h3>
                    Objective:\u00a0<\/strong><\/div>
                    \u00a0<\/div>
                    In the event of any security incident of Confidential Data, the effect of the incident is minimized, and the Customer is promptly informed.<\/div>
                    \u00a0<\/div>
                    Measures:<\/strong><\/div>
                    1. Netsurit maintains an up-to-date incident response plan that includes responsibilities, how information security events are assessed and classified as incidents and response plans and procedures.<\/li>
                    2. Netsurit regularly tests its incident response plan with \u201ctable-top\u201d exercises and learns from tests and potential incidents to improve the plan.<\/li>
                    3. In the event of a security incident, Netsurit will notify Customers without undue delay after becoming aware of the security incident.<\/li><\/ol>
                      \u00a0<\/div>

                      <\/a><\/a><\/a>1.12 Audit<\/h3>
                      Objective:\u00a0<\/strong><\/div>
                      \u00a0<\/div>
                      To ensure Netsurit regularly tests, assesses and evaluates the effectiveness of the technical and organizational measures outlined above.<\/div>
                      \u00a0<\/div>
                      Measures:\u00a0<\/strong><\/div>
                      1. Netsurit conducts regular internal audits of its security and privacy\u00a0practices.<\/li>
                      2. Netsurit ensures that Personnel are aware of and comply with the technical and organizational measures set forth in this document.<\/li>
                      3. Netsurit maintains a register of security incidents and unscheduled outages.<\/li><\/ol>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
                        \n\t\t\t
                        \n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

                        Trusted By Effective date: 1 March 2021 | Last reviewed: 4 August 2026 | Version: 3Prepared for Netsurit (Pty) Ltd by: Morn\u00e9 Fourie, Deputy Information Officer,\u00a0mornef@netsurit.com\u00a0\u00a0 1.1 Introduction This page describes technical and organizational security measures and controls implemented by Netsurit to protect the data customers entrust to us as part of the Netsurit service.Within […]<\/p>\n","protected":false},"author":16,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"_acf_changed":false,"nf_dc_page":"","content-type":"","footnotes":""},"class_list":["post-9842","page","type-page","status-publish","hentry"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t