What your ISMS platform knows about you
Consider what sits in an ISMS platform after a year of use: the risk register with every weakness you know of, incident reports, results of penetration tests, supplier assessments, the systems behind your critical services and, with ISO 42001, an overview of every AI system you use. For an attacker, or for anyone with legal access to the provider, it is one of the most informative data sets in the organisation.
That makes the platform vendor a supplier you have to assess like any other. NIS2 requires essential and important entities to address supply chain security in their risk management measures. DORA requires financial entities to manage ICT third-party risk and to keep a register of information on all contractual arrangements with ICT third-party service providers. And under the GDPR, personal data in incident reports or user records may only leave the EU under the conditions of Chapter V.
Four checks
- 1Which jurisdiction does the vendor fall under?
Where data is stored is only half the question. A provider subject to US law can be required under the US CLOUD Act to produce data in its possession, custody or control, wherever that data is stored. Ask where the company and its parent are established.
- 2Is EU hosting the default?
An EU region that you can request during onboarding is an option, not a default. Ask where your data is hosted on day one, including backups and support access.
- 3Where is AI processed?
If the platform uses AI, your data may travel to a model provider. Ask which models are used, where they run, whether your data is used for training, and whether you can use your own provider or key.
- 4Are European frameworks part of the core?
Ask how NIS2, DORA, the GDPR, the AI Act and ISO 42001 are handled in the product, and whether national requirements such as the Dutch BIO for government organisations are supported.
Proportionate, not maximal
None of this means every organisation needs the strictest possible setup. NIS2 asks for measures that are appropriate and proportionate, taking into account the state of the art, the size of the entity and the likelihood and severity of incidents. The point is that you make the assessment, record it and can explain it, including for the tool you use to record all your other assessments.
How Basenorm meets the checks
Basenorm is a Dutch company. Customer data is hosted on Microsoft Azure in the West Europe region in the Netherlands, with a database per organisation. ISO 42001 and ISO 27001 lead, with NIS2, DORA, the GDPR, the AI Act and the BIO on the same control library. For AskNorman you can use Basenorm-managed models or your own API key. The security page explains how we protect your data.