Proximus obtains the “ISAE 3000/SOC 2 - Type II” attestation

What is ISAE?

ISAE stands for “International Standard on Assurance Engagement”. With an ISAE 3000 attestation, organizations show that their IT security and privacy measures are operationally well structured. To obtain this attestation, an audit must be conducted. The audit evaluates the controls and processes of an organization using so-called Trust Services Criteria (TSC). The five criteria are security, availability, processing integrity, confidentiality, and privacy.

Two types of ISAE 3000 reports

There are two types of ISAE 3000 reports. The two reports are very similar, but the audit for Type II is much more comprehensive than for Type I.

• Type I gives a snapshot of a specific time at which the internal control systems and measures of an organization are being tested. Proximus obtained this Type I report in April 2023.
• In Type II, the operation of the measures is tested over a predetermined period of at least six months.

Difference between ISO 27001 and ISAE 3000

ISO 27001 is internationally recognized as the standard for information security and is the best possible way to manage information security in an organization. To obtain the certificate, an organization must satisfy a complete list of requirements.

ISAE 3000 is an assessment of whether the organization also actually implements the internal processes, with management of and reporting on (new) technological risks and control practices. It concerns the IT security and confidentiality of an organization, and the handling of integrity and customer privacy.

The ISAE 3000 standard is the combination of a heightened guarantee of operational execution of the internal processes with a careful focus on cybersecurity as in ISO 27001. And so it combines the best of both worlds.

Guarantees for our customers

After the Type I audit in April 2023, the Type II audit was conducted in October and November 2023 by an independent audit firm within our organization. In view of customer demands for end-to-end services, our affiliates Davinsi Labs and Proximus Ada were also involved in the audit.

The resulting SOC 2 Type II report gives an evaluation over a period of six months of the Managed Security services we provide to our customers:

• Managed Detection and Response (MDR)
• Vulnerability Management Services (MVS)
• Managed Full Care on security devices

The audit confirms that we process our customers’ data with the utmost care. And that we can always guarantee reliable IT security and privacy.

In addition, we have already had the ISO 27001 certificate for several years.