Last updated: June 4, 2026
1. Scope
2. Important laws and regulations
Information security regarding the Supplier's service is regulated by a number of laws and regulations. These are some of the most important:
Personal Data Act / GDPR
Security Act
Regulations on the Security Act
3. Security objectives
The provider's information processing will comply with regulatory, internal, and contractual information security requirements. Personal and other protected information will be secured through physical, technical, and organizational measures.
3.1 Confidentiality
Personal information and other sensitive information processed by the Supplier will be protected against unauthorized access. Personal data is kept confidential and may only be shared with the Supplier's other employees to the extent necessary in relation to the service offered.
All of the Supplier's employees have signed a confidentiality agreement and will comply with this confidentiality agreement in accordance with relevant actions, employment agreements, and the like.
When an employment relationship terminates, all hardware provided by the Supplier to the employee in connection with the employment must be returned to the Supplier. The Supplier will then remove all information from said hardware.
3.2 Integrity
Information for which the Supplier is responsible is only made available, handled, and modified by employees, or by external authorities authorized to do so.
The Supplier shall take reasonable measures to prevent accidental modification of sensitive information.
3.3 Accessibility
The information system is available to authorized users when needed.
3.4 Resilience
When unwanted physical or technical incidents occur, emergency measures will be implemented to help limit the damage and assist the Supplier in quickly returning to normal operations. This includes restoring availability and providing access to personal information in a timely manner.
4 General Requirements – procedure
The supplier has their own documented procedures for key safety-related processes. The procedures mentioned in this section shall be subject to annual review and updating.
4.1 Regulatory requirements
The Supplier must at all times document and comply with applicable regulatory requirements in accordance with section 2 of this appendix.
4.2 Risk Assessment and management
The provider's information security requirements regarding ICT systems and the processes for line management and projects are based on a risk assessment. The risk assessment includes an evaluation of risks related to its own employees and individuals affected by the company's activities.
The service provider classifies – or quantifies – unwanted incidents based on two elements given a numerical value: probability and consequence. The product of these two elements defines the risk of the incident.
Both the probability and the consequence of an incident are assigned a number in the range of 1 to 5 based on definitions related to the incident. Higher numbers represent more probable and severe incidents.
Identified unwanted incidents must be assessed and quantified by a panel consisting of at least two people with sufficient knowledge of the probability and consequence of the incident. The reasons for selecting the probability and consequence levels must be documented. Risk that is difficult to evaluate may indicate that the incident is not specific enough and should be split into several separate incidents or rewritten.
The goal is not to eliminate all risk – as this is impossible – but rather to keep the Provider's current profile at an acceptable level. The reseller and end customers hereby accept the risk profile and the fact that the Provider is only liable for risks directly resulting from the Provider's own services.
4.3 Classification of systems and information
Depending on the system in question and the information being processed, the different aspects of security (confidentiality, integrity, availability, and robustness) will have different meanings. The following categorization is used for protection needs:
High – only assigned to systems and information with mission-critical protection needs
Moderate – systems and information with protection needs
Low (low security requirements) – can apply to all systems and information with little or no protection needs.
Different subsystems may have different protection needs.
4.4 Access control
Access to the Supplier's services and systems is based on roles and privileges. Access control – at least a quarterly review of users' and employees' rights in lists of systems, and rights that are no longer needed are revoked. The Supplier has implemented operational access to application data restricted to a monitored subset of the Supplier's employees, with multi-factor authentication enabled.
4.5 Technical security measures
The supplier has implemented the following technical security measures:
Measures that prevent employees from negligently or intentionally damaging the information system or the stored information.
Measures to prevent malicious software from entering the corporate information system.
Operational access to application data restricted to a monitored subset of the Supplier's employees, with multi-factor authentication.
All communication with applications through external endpoints is logged.
Minimum daily backup of all application data, with routines in place for restoration.
4.6 Organizational measures
The Supplier has implemented the following organizational measures:
Procedures for managing access to the Supplier's information system. This includes control of passwords, rights, and applications.
Procedures regarding employees' handling of portable storage media, such as laptops, to prevent information from being lost.
Procedures for locking the premises, handling visitors, and using alarms outside of working hours.
Procedures for placement and securing of components, storage devices, documents, or other components important for the Supplier's service.
4.7 Physical measures
The Supplier's premises are protected against, among other things, burglary, fire, water damage, etc. Furthermore, the Supplier will prevent unauthorized persons from gaining access to premises where sensitive information is stored. Machines, storage media, and central network components are physically secured so that unauthorized persons cannot remove them from the Supplier's premises. Portable devices to be taken outside the Supplier's premises must be secured with encryption.
4.8 Risk management
For both significant and unacceptable risks, risk-reducing tasks must be identified and placed in the backlog. For unacceptable risks, mitigating tasks must have a deadline.
Risk-reducing tasks receive a score based on how many risk points they reduce affected risks by, and tasks are prioritized so that the tasks that remove the most risk points are performed first. For mitigating tasks that affect multiple risks, the reduced risk points are aggregated.
Once risk-reducing tasks are completed, the affected risks must be updated to reflect their new likelihood and consequence scores, and further reducing measures evaluated.
4.9 The Supplier's role as data processor and use of subcontractors
Access to the Supplier's services and systems is based on roles and privileges. Access control – at least a quarterly review of users' and employees' rights in lists of systems, and rights that are no longer needed are revoked. The Supplier has implemented operational access to application data restricted to a monitored subset of the Supplier's employees, with multi-factor authentication enabled.
5 The Supplier's service as part of a larger ICT operation
The responsibility for information security lies with the owner of the ICT operation.
The Provider is only responsible for the part of information security that follows from the service offered by the Provider. The Provider is not responsible for risks regarding information security that exceed the Provider's service and these safety guidelines or other agreement between the contracting parties, as far as applicable laws permit.