{"id":21817,"date":"2025-02-05T10:20:28","date_gmt":"2025-02-05T09:20:28","guid":{"rendered":"https:\/\/www.teamecho.com\/tom\/"},"modified":"2026-02-12T10:44:01","modified_gmt":"2026-02-12T09:44:01","slug":"tom","status":"publish","type":"page","link":"https:\/\/www.teamecho.com\/en\/tom\/","title":{"rendered":"TOM"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Technical and organizational measures (TOM)<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Confidentiality<\/h3>\n
    \n
  • Physical Access Control:<\/strong> Protection against unauthorized entry to data processing facilities through chip keys and electronic door openers, locked doors and windows<\/li>\n
  • System Access Control:<\/strong> Protection against unauthorized system use through passwords (including corresponding policy), automatic lock mechanisms, two-factor authentication, encryption of storage media<\/li>\n
  • Data Access Control:<\/strong> No unauthorized reading, copying, modification, or removal within the system, e.g., standard authorization profiles on a \u201cneed-to-know\u201d basis, a standard process for granting permissions, logging of access, and periodic review of granted permissions, especially for administrative user accounts<\/li>\n
  • Pseudonymization:<\/strong> Wherever feasible for a given data processing activity, primary identifiers in personal data are removed within the respective application and stored separately.<\/li>\n<\/ul>\n\n

    Integrity<\/h3>\n
      \n
    • Transmission Control:<\/strong> No unauthorized reading, copying, modification, or removal during electronic transmission or transport through encryption<\/li>\n
    • Input Control:<\/strong> Identification of whether and by whom personal data was entered, modified, or deleted in data processing systems, through logging and document management<\/li>\n<\/ul>\n\n

      Availability and Resilience<\/h3>\n
        \n
      • Availability Control:<\/strong> Protection against accidental or malicious destruction or loss through backup strategies, antivirus software, firewall, alert channels, and emergency plans; security checks at the infrastructure and application level, a multi-tier backup concept with encrypted off-site storage in an alternative data center, and standard processes for when staff change roles or leave the organization<\/li>\n
      • Rapid Recoverability<\/strong><\/li>\n
      • Retention and Deletion Periods:<\/strong> Applicable both to the data itself and to metadata such as log files<\/li>\n<\/ul>\n\n

        Procedures for Regular Review, Assessment, and Evaluation<\/h3>\n
          \n
        • Data protection management, including regular employee training<\/li>\n
        • Incident response management<\/li>\n
        • Privacy-friendly default settings<\/li>\n
        • Contract Control:<\/strong> No commissioned processing within the meaning of Art. 28 GDPR without corresponding instructions from the Controller, ensured by clear contractual arrangements, formalized contract management, rigorous selection of the Processor (ISO certification, ISMS), obligation to conduct due diligence in advance, and subsequent audits<\/li>\n<\/ul>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

          Technical and organizational measures (TOM) Confidentiality Physical Access Control: Protection against unauthorized entry to data processing facilities through chip keys and electronic door openers, locked doors and windows System Access Control: Protection against unauthorized system use through passwords (including corresponding policy), automatic lock mechanisms, two-factor authentication, encryption of storage media Data Access Control: No unauthorized […]<\/p>\n","protected":false},"author":4,"featured_media":0,"parent":0,"menu_order":91,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-21817","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.teamecho.com\/en\/wp-json\/wp\/v2\/pages\/21817","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.teamecho.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.teamecho.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.teamecho.com\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.teamecho.com\/en\/wp-json\/wp\/v2\/comments?post=21817"}],"version-history":[{"count":1,"href":"https:\/\/www.teamecho.com\/en\/wp-json\/wp\/v2\/pages\/21817\/revisions"}],"predecessor-version":[{"id":23937,"href":"https:\/\/www.teamecho.com\/en\/wp-json\/wp\/v2\/pages\/21817\/revisions\/23937"}],"wp:attachment":[{"href":"https:\/\/www.teamecho.com\/en\/wp-json\/wp\/v2\/media?parent=21817"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}