The security posture offered to our Clients is the result of constantly improved management policies, honed through years of experience in the most ambitious sectors, and a continuous search for and implementation of the most advanced security measures. All of this is aimed at providing Clients with a simple and transparent solution in terms of compliance.

Below are some of the policies and procedures that make up the Information Security and Privacy Management System adopted by Diennea:

• General Information Security Policy: regularly reviewed by top management, this policy defines strategies to achieve security goals through the appropriate management of assets, processes, roles, and responsibilities.
• IT Usage Policy: this policy establishes controls to regulate the use of devices (PCs, laptops, tablets, smartphones, USB devices, etc.), including remote usage, such as enforcing configurations that protect information and prevent the installation of unauthorized software.
• Information Classification Policy: This policy provides a categorization framework to help DLP (Data Loss Prevention) systems precisely intercept the potential transmission of confidential content.
• Clear Desk & Clear Screen Policy: Aimed at enhancing the security and confidentiality of information, particularly those classified as confidential or secret.
• Security Incident Management Policy: Aligned with industry regulations, this policy ensures thorough analysis of every event, organizational processes, and includes a real-time Status Page to display the service status.
• Physical and Environmental Security Policy: Applies to both primary and secondary data centers as well as operational offices, defining physical security measures for protecting company assets.
• Cooperation with Authorities Policy: This policy defines the procedures the company follows during inspections, information requests, and audits conducted by regulatory authorities.
• System Administrator Policies and Operational Procedures: This policy governs the management of system administrators and their access logs, in accordance with the provisions of the resolution of Italian Data Protection Authority of 27/11/2008 (and subsequent amendments).
• Background Check Policy and Procedure: Defines how background checks are conducted for incoming personnel, in compliance with applicable laws, regulations, and ethical standards.
• Malware and External Intrusion Protection Policy: Involves the adoption of specific anti-malware and anti-ransomware solutions on both client and server systems, with automatic updates and scans. This includes scanning of shared files, emails and attachments, downloads, and web pages.
• Cryptographic Control Policy: Requires the use of strong cryptographic algorithms on all devices, both for “at-rest” and “in-transit” information.
• Logging and Monitoring Policy: Active 24/7, in compliance with regulatory requirements, industry standards, and best practices, focusing on the centrality of information security.
• Network Management Policy: Includes control of connected devices, traffic restrictions, and resource allocation within the corporate office networks and data centers, through multiple VLAN levels, VPNs, and traffic management and analysis tools such as firewalls and IDS/IPS.
• Secure Development Policy: Specifies software development lifecycle in dedicated environments, including static code analysis, OWASP checks, test data usage, and a QA process, with 11 evolutionary and corrective releases per year.
• Vulnerability Assessment and Penetration Testing Policy: Involves periodic, independent, and objective testing by third parties, who are rotated over time to prevent familiarity with the system and avoid expectation biases.
• BCP & IT DRP Policy: Ensures the resilience of services in the event of disasters, guaranteeing predefined RTO and RPO.
• Patch Management Policy: Applies to workstations, servers, network devices, and other company-owned or managed hardware assets. It includes continuous monitoring of vulnerabilities (CSIRT, technology vendors) and the use of tools for centralized update management where possible, as well as specific update processes for individual assets based on criticality.
• Change Management Procedure: Manages and monitors changes that may impact information security, arising from business processes, systems, applicable technical regulations, or application features.
• Backup Management Policy: Defines how backups are executed, their frequency, storage, physical and cryptographic protection measures, and verification processes. Backup copies of information managed by Magnews are made daily, replicated across two data centers about 450km apart, and stored for up to 60 days.
• IT Systems Audit Policy: Involves periodic risk analysis (at least annually) and the execution of an audit program covering both internal organizational areas and suppliers, coordinated by the Audit Team, whose members hold specific ISO certifications.
• Third-Party Management Procedure: Involves a careful risk analysis of each supplier starting from the initial due diligence phase and continuing through the contractual relationship, including ongoing maintenance audits.
• Personal Data Transfer Policy: Regulates how personal data transfers are handled.
• Legal Basis for Processing Policy: Describes the legal principles underlying the processing of personal data by the organization and lists the legal bases that Diennea may use to justify the purposes pursued.
• Personal Data Retention Policy: Provides for transparent retention of various types of data processed by the organization, with customizable parameters based on client requests.
• Governance and Accountability Policy: Ensures the organization aligns with applicable data protection laws and, in particular, establishes Diennea’s governance structure, describing roles, responsibilities, objectives, risks, documents, and operational controls to implement the accountability principle introduced by the GDPR.
• Data Breach Management Procedure: Provides practical guidelines to follow in the event of a personal data breach affecting the organization, both as a Data Controller and Data Processor.
• Credential and Authorization Profile Management Procedure: Regulates the secure use of access credentials and proper management of information access according to the principle of least privilege.
• Exercise of Data Subject Rights Procedure: Provides operational guidelines to ensure the exercise of data subject rights under the GDPR.

Simplicity and reliability for the Client

• Certified Guarantees.
• A prepared partner focused on security and data protection, with staff undergoing continuous training programs and attack simulations.
• Attention to the supply chain, limiting the number of sub-processors involved and avoiding transfers of personal data outside the EEA.
• Direct management of the IT infrastructure, without the use of subcontractors or reliance on CSPs (Cloud Service Providers).
• Phone and email support, available in both Italian and English.
• Bug Bounty Sessions that subject the platform to testing by ethical hacker communities.

Optional support upon request

• Availability to conduct periodic maintenance audits by the Client.
• Availability to submit the Platform to PT/VA (Penetration Testing / Vulnerability Assessment) by the Client.
• Availability for direct involvement of the Security Team staff.
• Support during the exit phase for service internalization or migration to another external platform.