Security
ISO/IEC 27001: security that can be seen in practice
Certified information security management system (ISMS) according to ISO/IEC 27001. Concrete processes, regular audits, documented controls — not just paper on the wall.
ISO/IEC 27001 is an international standard for information security management systems. The certification confirms that the organization identifies risks, implements adequate controls and regularly reviews these controls by external auditors.
Here at datatek, spol. s r. o., ISMS is a living system — not a file in a cabinet. Regular internal audits, risk reviews and training ensure that processes work in practice, not just on paper.
Scope of certification
The certification covers software development, IT infrastructure management, IT outsourcing and client data management.
Regular audits
External certification audit once a year, internal audits quarterly. The results are the basis for updating risks and measures.
Risk management
List of assets, assessment of threats and vulnerabilities, prioritization of measures according to impact and probability.
ISO Annex A controls
Implemented relevant controls from Annex A of the standard — from access policies to physical security and cryptography.
Statement of Applicability
Documented list of applicable and excluded controls with justification — transparency for both clients and auditors.
Continuous improvement
PDCA cycle (Plan-Do-Check-Act) — each audit brings specific measures for the next year.
Why ISO 27001 matters to your company
IT supplier certification is not a luxury — it is becoming a basic condition for business partnerships. Companies in healthcare, the financial sector, public administration and the automotive industry require evidence of the security maturity of suppliers. ISO/IEC 27001 is an internationally recognized answer to this requirement.
What we manage in practice
Access control
The principle of minimum authorizations, two-factor authentication, regular revision of accesses.
Backup and restore
3-2-1 rule, off-site copies, regular recovery tests with RPO and RTO measurement.
Incident response
Defined roles, escalation path and playbooks — from ransomware to accidental data deletion.
Risk assessment
Regular risk assessment with an updated list of assets, threats and measures — a living document, not a one-time workshop.
What this means for you as a client
When you entrust us with infrastructure management, application development or access to company data, you are guaranteed:
- your data does not travel outside the approved environment,
- approaches are documented and regularly revised,
- incidents are resolved according to a defined process,
- during the audit (GDPR, NIS2, ISO) we can provide the required records.
ISMS: the system that manages security every day
ISMS is not a one-time project. It is a living system that is regularly reviewed, updated and improved. The basis is the PDCA cycle — plan, implement, check, improve — repeated every year.
In practice, this means that we can answer the question at any time: who has access to what data, such as backups, when was the last incident, how was it resolved and what have we changed to prevent it from happening again.
Security policy
A written document approved by management that defines the obligations, responsibilities and framework for all security activities.
Asset inventory
Catalog of all information assets (servers, applications, data, people) with sensitivity classification and responsible persons.
Risk assessment
Structured process of identification of threats and vulnerabilities, assessment of impact and probability, selection of measures.
Risk management plan
For each accepted risk, a measure, a responsible person, a deadline and a method of verification are defined.
Internal audits
Quarterly internal audits verify the real functioning of controls — not just the paper status, but also actual practice.
Managerial review
Company management reviews ISMS inputs and outputs once a year — decides on resources and priorities for the next year.
Key areas of our ISMS
Human Resources and Training Every employee goes through safety onboarding and annual training. Phishing simulations, secure coding, password management — not mandatory clicks, but practical scenarios.
Physical Security Access to server rooms and offices is controlled. Visitors are accompanied. Devices go through an approved data disposal process when they leave the company.
Communication and data transfer Encryption in transit and storage for sensitive data. Approved channels for sharing information with clients and suppliers.
Continuity of operation Defined plans for maintaining critical services in the event of an outage — BCP with regular scenario testing.
We will also help you get certified
If your company is considering the implementation of an ISMS and the path to ISO/IEC 27001, we can help:
- Gap analysis — where are you now vs. where you need to be
- Implementation plan — prioritized measures with cost and time estimates
- Technical implementation — backup systems, access management, monitoring
- Internal audit — preparation for certification audit
Contact us and we will arrange a non-binding call.
Let's talk it through
Write to us — we will get back within one business day with a concrete next step.