TOM-Checklist

I. Confidentiality pursuant to Art. 32 Para. 1 lit. b GDPR

1. Entry surveillance
   
   Measures suitable for preventing unauthorised persons from gaining access to data processing systems with which personal data are processed or used. Access control measures that can be used to secure buildings and rooms include automatic access control systems, the use of chip cards and transponders, control of access by gatekeepers and alarm systems. Servers, telecommunications systems, network technology and similar equipment should be protected in lockable server cabinets. In addition, it makes sense to support access control through organisational measures (e.g. service instructions that provide for the locking of service rooms during absences).

2. Equipment access control
   
   Measures suitable for preventing data processing systems (computers) from being used by unauthorised persons. Access control refers to the unauthorised prevention of the use of systems. Possibilities are, for example, boot password, user identification with a password for operating systems and software products used, screen saver with a password, the use of chip cards for logging in as well as the use of call-back procedures. In addition, organisational measures may also be necessary, for example, to prevent unauthorised access (e.g. guidelines for setting up screens, issuing guidance to users on how to choose a “good” password).

3. Access authority supervision
   
   Measures to ensure that those authorised to use a data processing system can only access the data subject to their access authorisation and that personal data cannot be read, copied, modified or removed without authorisation during processing, use and after storage. Access control can be ensured, among other things, by suitable authorisation concepts that enable differentiated control of access to data. In doing so, it is important to differentiate both the content of the data and the possible access functions to the data. Furthermore, suitable control mechanisms and responsibilities must be defined in order to document the granting and withdrawal of authorisations and to keep them up to date (e.g. in case of hiring, change of job, termination of employment). Special attention should always be paid to the role and possibilities of administrators.

4. Segregation control
   
   Measures that ensure that data collected for different purposes can be processed separately. This can be ensured, for example, by logical and physical separation of data.

5. Pseudonymisation (Art. 32 para. 1 lit. a GDPR; Art. 25 para. 1 GDPR)
   
   The processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information provided that this additional information is kept separately and is subject to appropriate technical and organisational measures.

II. Integrity (Art. 32 (1) (b) GDPR)

1. Transfer control
   
   Measures to ensure that personal data cannot be read, copied, altered or removed by unauthorised persons during electronic transmission or during their transport or storage on data carriers, and that it is possible to verify and establish to which bodies personal data are intended to be transmitted by data transmission equipment. Encryption techniques and virtual private networks, for example, can be used to ensure confidentiality in electronic data transmission. Measures to be taken when transporting or forwarding data media include transport containers with locking devices and regulations for the destruction of data media in accordance with data protection requirements.

2. Input control
   
   Measures to ensure that it is possible to check and establish retrospectively whether and by whom personal data have been entered into, modified or removed from data processing systems. Input control is achieved through logging, which can take place at various levels (e.g. operating system, network, firewall, database, application). It must also be clarified which data is logged, who has access to logs, by whom and on what occasion/at what time these are checked, how long storage is required and when deletion of the logs takes place.

III. Availability and resilience (Art. 32 (1) (b) GDPR)

1. Availability control
   
   Measures to ensure that personal data are protected against accidental destruction or loss. This involves issues such as an uninterruptible power supply, air conditioning, fire protection, data backups, secure storage of data media, virus protection, RAID systems, disk mirroring, etc.

IV. Procedures for regular review, assessment and evaluation (Art. 32 Para. 1 lit. d GDPR; Art. 25 Para. 1 GDPR)

1. Data protection management
   
   Measures that enable data protection processes to be managed and demonstrably ensure compliance with data protection requirements.

2. Incident response management
   
   Measures to support the response to security breaches.

3. Data protection-friendly default settings (Art. 25 para. 2 GDPR).

4. Order control
   
   Measures that ensure that personal data processed on behalf of a client can only be processed in accordance with the client’s instructions. In addition to data processing on behalf, this item also includes the performance of maintenance and system support work both on site and via remote maintenance. If the contractor uses service providers in the sense of commissioned processing, the following points must always be regulated with them.