Skip to content
Varmo
DeutschSign inRequest a demo
SOLUTIONS · PUBLIC SECTOR

Information security for municipalities, cantons and the Confederation.

Public bodies have to justify and document their decisions. Varmo maps protection requirements analysis, security procedures, approvals and logs so that every step remains traceable.

Request a demoTry it free
WHAT YOU GET
  • Protection requirements analysis with an approval workflow
  • Security procedure per system, e.g. with NIST SP 800-53
  • FADP obligations for federal bodies and private organisations
  • ICT baseline protection (Switzerland) as a framework from Pro
  • Your body’s own rules, e.g. cantonal ones, as a custom framework

1. Determine protection requirements

First the protection requirements of the information, then the systems that process it. Owners answer check questions for each protection goal, and the analysis is approved through a defined approval workflow.

  • Protection requirements analysis with check questions
  • Inheritance along the dependencies
  • Confirmation by the data protection advisor for personal data
Protection requirements assessment of the CAD and PDM system with confidentiality, integrity and availability, and the approval workflow.
Protection requirements per security objective with a justification; valid only once approved.

2. Security procedure per system

Each system is subject to the requirements that match its protection requirements. The owner documents implementation with evidence; deviations are handled with a measure or a time-limited exception. Where requirements are elevated, a risk analysis follows, optionally to BSI Standard 200-3.

Baseline check of a system: requirements from NIST SP 800-53 matching its protection requirements, with implementation status.
Which requirements apply follows from the category and protection requirements of the system.

3. Data protection under the FADP

In the organisation profile, you specify whether your organisation is a federal body. For federal bodies, Varmo checks the legal basis for the processing and the obligations under the Data Protection Ordinance, such as logging; you create the data protection impact assessment directly in the system.

  • Check question on the legal basis (Art. 34 FADP)
  • Obligations under the DPO as measures of the system
  • DPIA with approval by the data protection advisor
Approved data protection impact assessment of the HR and payroll system with the result “Possible increased risks” and the description of the processing under Art. 22 FADP: purpose, data subjects, recipients and retention.
Result, description of the processing under Art. 22 FADP and risks for the data subjects in one place.

Traceable decisions

Approvals follow defined approval workflows under the four-eyes principle. Completed analyses, audits and reviews cannot be changed, and every change is logged without gaps.

Need-to-know and hosting in Switzerland

Responsibility grants access: people see their own objects, and roles are only for overview tasks. The data is stored in Switzerland, and the operator only sees it with your time-limited approval. You can require a second factor for the whole organisation.

Related

Frequently asked questions

Do municipalities need an ISMS?

The ISA applies to federal authorities and to organisations that access federal information or systems; cantons and municipalities have their own rules. Regardless of that, data protection law requires appropriate technical and organisational measures. An ISMS is the usual way to manage them in a traceable manner.

Does Varmo cover the Information Security Act (ISA)?

For the baseline protection security level, Varmo includes the Confederation’s ICT baseline protection – directive Si001 “IT baseline protection in the Federal Administration”, based on the ISA and ISO – as a framework from the Pro plan. You record other rules of your body, for example for elevated protection requirements or cantonal regulations, as a custom framework (from Starter also via CSV import) and implement them like any other requirement.

Can several offices work separately?

Yes, from the Pro plan. Under one account you run several organisations, for example one per office; the data stays strictly separate.

How close are you to ISO/IEC 27001?

In a personal demo, we show you the way to the readiness report, with no obligation. Or try it free for 30 days with every feature.

Request a demoTry it free