Confidentiality
Sensitive information is accessible only to authorised people and for agreed purposes.
Information security & data protection
Information Security & Data Protection Principles
This public summary describes the principles NP4 applies to protect information and personal data, manage risk and continuously develop its information security and data protection framework.
Trust depends on information being appropriately protected throughout its lifecycle. NP4 combines legal, regulatory and contractual requirements within a risk-based management framework.
Protection objectives
Three protection objectives guide our approach.
Integrity
Information remains complete, accurate and protected against unauthorised alteration.
Availability
Systems and information remain reliably and securely available within the agreed scope.
ISMS and security framework
NP4 operates an Information Security Management System based on the requirements of ISO/IEC 27001. It provides a defined framework for responsibilities, risk management, controls and continuous improvement.
Risk-based approachDefined responsibilitiesContinuous review and improvement
Protection of information and personal data
Information and personal data are processed and protected according to their protection needs and the applicable legal, regulatory and contractual requirements.
Controlled access
Access to sensitive information is governed through defined roles, permissions and access controls.
Classification by protection need
Information is classified according to its protection needs. Appropriate safeguards are derived from that classification.
Security throughout the lifecycle
Information security and data protection requirements are considered when information-processing systems are planned, developed, procured, operated and changed.
Clear responsibilities
Responsibilities for information security and data protection are clearly defined within the organisation and integrated into the management framework.
Appropriate security measures
NP4 applies technical, organisational, personnel and physical security measures according to the relevant protection needs and risks. These measures are reviewed regularly for relevance, effectiveness and appropriateness.
Data protection and transparency
Personal data is processed in accordance with applicable data protection requirements. Transparency and respect for data subject rights form part of NP4's data protection framework.
Further information is available in our Privacy Notice.Awareness and continuous improvement
Employees receive regular information security and data protection awareness and training. Findings from reviews, changes and risks contribute to continuous improvement.
Review
Regularly reviewed and continuously developed.
NP4 regularly reviews the underlying principles and measures for relevance, effectiveness and appropriateness and adapts them when legal, contractual or technical conditions change.