DOCSEARCHbyAlgolia
Submit Docs

Andrea Cloud Information Security Management System (ISMS)

website·Indexed 32 days ago

https://isms.andrea-cloud.com

Documentation for Andrea Cloud's Information Security Management System, featuring control overviews, compliance strategies, and objectives related to NIS2 and general security controls, including patching SLAs and effectiveness metrics.

Tokens
139.5K
Snippets
66
Records
943
Agent score
54%

What's inside Andrea Cloud ISMS

  1. Overview of the SATRE Standard Architecture for Trusted Research Environments

    The SATRE project defines a Standard Architecture for Trusted Research Environments (TREs), consolidating best practices from various UK institutions and sectors. It covers information governance procedures, computing technology, and data management to standardize TRE capabilities. This framework is intended for TRE Operators seeking to evaluate or improve their environments, and for Developers/Builders requiring guidance on the design and decision-making process for new TREs.

  2. Overview of anDREa Core Activities and myDRE Product

    anDREa develops, maintains, and commercializes myDRE, a cloud-native Digital Research Environment (DRE)-as-a-Service / Secure Processing Environment (SPE) delivered via a shared-tenant model.

    Target Audiences:

    • Primary: Organizations needing secure, compliant environments to ingress, process, analyze, and egress sensitive data while collaborating.
    • Secondary: Research consortia, multi-institutional projects, and independent researchers requiring collaboration capabilities without an enterprise-managed control plane.

  3. Overview of anDREa Platform Technical Controls (ISO/IEC 27001:2023 A.8)

    The anDREa B.V. platform employs technical countermeasures, cryptographic defenses, and logical boundaries aligned with ISO/IEC 27001:2023 (Control A.8) and NIS 2 cyber hygiene directives. The framework focuses on confidentiality, integrity, and availability through system configurations, access management (via the Workspaces Entitlement Matrix), and threat containment (via the Emergency User Isolation 'Emergency Brake').

  4. Use ISMB Meeting Notes for governance and compliance tracking

    The ISMB Meeting Notes serve as the standardized 'Way of Working' for active governance control. They are the central mechanism used to track, document, and legally approve all adjustments related to the platform's security and compliance posture.

  5. Apply secure architecture and design principles

    Software concepts must be designed defensively using both standard user stories and anti-user stories (abuse cases). Key requirements include:

    • Defense-in-Depth: Features must be isolated so they can be deactivated without destabilizing the platform.
    • Access Control: Enforce Least Privilege, Role-Based Access Control (RBAC), and multi-factor authentication (MFA) at all entry points.
    • Workspace Configurations: User-initiated changes must be restricted by role, transparent regarding security impact, and reversible to platform defaults.

  6. Understand anDREa's Acceptable Use and Information Asset Policy Framework

    anDREa implements a unified framework for the acceptable use and handling of corporate information assets, technical infrastructure, and cloud resources to satisfy ISO/IEC 27001 Annex A.5.10. Instead of a single document, the mandates are distributed across specialized domains:

    • Behavioral and Endpoint Acceptable Use: Governs employee/contractor interaction with assets, remote environments, personal devices, and system boundaries (detailed in A.06.07 - Remote working).
    • Procedural Asset Handling: Defines rules for data processing, marking obligations, encryption baselines, and storage restrictions based on sensitivity (detailed in A.05.12 - Classification of information and A.05.13 - Labelling of information).

  7. Understand the objectives of the ISMS Performance Evaluation framework

    The ISMS control framework for performance evaluation aims to establish systematic processes for reviewing the ISMS through three primary activities: monitoring and evaluating security framework effectiveness (Clause 9.1), executing a rigorous internal audit program at defined intervals (Clause 9.2), and conducting structured management reviews by Top Management to ensure continuing suitability and adequacy (Clause 9.3).

  8. Understand the myDRE contractual and compliance framework

    The myDRE platform utilizes a standardized enterprise agreement framework to ensure cross-institutional compliance and multi-tenant collaboration. This architecture is designed to support compliance verification for ISO 27001:2023 (specifically A.05.19 Information Security in Supplier Relationships and A.05.20 Addressing Information Security within Supplier Agreements) and NIS 2 (Supply Chain Security).

  9. Understand the CIA-AA Security Dimension Framework

    anDREa B.V. utilizes an expanded security framework based on ISO/IEC 27000 and the Spanish National Security Framework (ENS, Royal Decree 311/2022) to manage sensitive healthcare data and intellectual property. The five core pillars are:

    • Confidentiality (C): Ensuring information is not disclosed to unauthorized entities (ISO/IEC 27000).
    • Integrity (I): Safeguarding the accuracy and completeness of assets (ISO/IEC 27000).
    • Availability (A): Ensuring information is accessible and usable on demand by authorized entities (ISO/IEC 27000).
    • Auditability / Traceability: Ensuring actions can be uniquely and indisputably attributed to an entity (ENS Spain).
    • Authenticity (A): Ensuring an identity or system entity is genuine and verified (ENS Spain).

  10. Understand the purpose and scope of anDREa B.V. Supportive Documents

    The Supportive Documents section defines the operational procedures, technical specifications, and controls required to execute anDREa B.V.’s Information Security Strategy. These documents ensure compliance with the ISO/IEC 27001 standard and the NIS 2 Directive (SC-30). The scope of these documents is aligned with the overall ISMS scope as defined in Clause 4.3.

  11. Track macro-level process effectiveness for ISMS

    In alignment with Clause 9.1 and a risk-based approach, the ISMS tracks macro-level process effectiveness rather than individual control KPIs. These metrics are reviewed dynamically in conjunction with the Risk Register and Issues and Risk Logging to drive continuous improvement. Key effectiveness areas include:

    • Availability
    • Patching Performance
    • Reports to Authorities
    • Report to Clients

  12. Understand myDRE platform resiliency and fault tolerance

    The myDRE platform employs several architectural strategies to ensure availability:

    • Decoupled Architecture: Workspace storage is independent of VM compute cycles; VM failure does not corrupt research data shares.
    • Cloud Redundancy: Uses Microsoft Azure geo-redundant data centers and automated fault-domain failover.
    • Monitoring: Real-time health checks dispatch telemetry alerts to engineering on-call rotations.
    • CI/CD: Updates are pushed via automated pipelines to test restoration and codebase integrity.
    • Escrow: Core source code is updated every three months in an independent ESCROW Portal.