Customer Interview: European Data Hub
How European Data Hub uses STREAM® to manage their ISO 27001 compliance and other regulatory requirements.
European Data Hub is a state-of-the-art data center situated in the heart of Luxembourg. It offers nearly 5,500 m² of IT space divided into private areas ranging from 20 m² to 1,000 m² each. Beyond being a Tier IV Data Center, it is entirely underground offering the highest level of security while integrating the most innovative technologies.
“After evaluating a number of different risk tools, STREAM® emerged as a clear favourite.”
The story in four lines
Customer
European Data Hub
Use Case
ISO 27001, ISO 22301, ISO 9001, GDPR compliance management
What Changed
Centralised repository for all risk and compliance with linked controls, KCIs, and assessments
Outcomes
Multi-standard compliance, automated reminders, one-stop-shop for all risk data
How did you find out about STREAM®?
Having freshly embarked on an ISO 27001 project, I entered a deep research phase to find a tool to help me. Being new to the topic, I looked for guidance and discovered STREAM® via a University of Twente master's thesis written by Dan Ionita called 'Current Established Risk Assessment Methodologies and Tools'. This thesis was one of the most valuable readings at that time. After evaluating a number of different risk tools, STREAM® emerged as a clear favourite.
What made STREAM® stand out?
What was it that made STREAM® stand out over the alternatives you explored?
The key reasons we chose STREAM® were the flexibility of the tool and availability of useful resources. A major appeal was the flexibility to manage not only the risks, but also compliance for any standard and regulation. This was very important because we already managed a number of standards but these are subject to change — we never know what standard or regulation will be required next. We didn't want to be restricted so we were pleased that STREAM® allowed us to go in our chosen direction, with the confidence that the platform could accommodate changes in the future.
STREAM® groups the standards, articles and clauses so they are neatly organised and therefore easy to find. We also have the ability to add our own internal controls. This makes it easy to manage the risks to our business and the controls we have implemented. If there is content that we need to import into STREAM®, we can create it ourselves or request it from Acuity.
Acuity's ISO 27001 package was a good fit for us. While comparing the various risk methodologies, we wanted something logical to follow. Their resources allowed us to select an efficient way of managing compliance through the use of STREAM®.
There were also other resources (such as manuals and training videos) which allowed us to learn at our own pace and understand what we needed prior to purchase. This was important to us and ultimately sealed the deal.
Implementation Experience
How easy was it for you to learn to use STREAM®?
STREAM® is an organizer for all things related to risk and compliance. It is important to keep in mind that risk management is a very complex topic and therefore should not be undertaken lightly. ISO 27002, NIST and other similar controls contain a lot of detail, so that in itself is a challenge. For us, the topics themselves were more difficult to adopt than the tool. Sure, there is a learning curve with STREAM® initially; as with any new solution, you need to invest time to learn it properly so that you can apply the concepts in a manner that best suits your organisation.
What was important for us was that the tool made dealing with the topics easier, and this is where STREAM® excelled. Once the functions and areas of the application are clear, it becomes second nature and therefore made it easier for us to process the information and carry out the necessary tasks.
Evolution of Use
Has your use of STREAM® changed over time?
Initially, we started using STREAM® for our information security, particularly around ISO 27001 implementation. Through that experience, we added business continuity by bringing in the ISO 22301 standard to manage the continuity component of ISO 27001. As the amount of actions we had to perform in managing the standard grew, we started using the email alerting feature. STREAM® reminds us of upcoming tasks and due dates so we are able to stay organised.
When the GDPR was introduced, we added this to STREAM® in order to manage our compliance. Since the bulk of the work performed for ISO 27001 is applicable to GDPR, we were able to see linkages and consolidate some of the efforts.
We recently added quality management by importing the ISO 9001 content into STREAM®. It was very interesting to use STREAM® to its fullest extent in the context of ISO 9001 because it helped us create a more valuable quality system. Creating our own controls on the quality of our services, and then measuring their effectiveness via our own KCIs, was a real eye-opener. STREAM® has become our centralised repository for risk and compliance.
“We are happy to be associated with the company and the product and look forward to the continued improvements and working with the Acuity team.”
Key Benefits
What are the benefits of STREAM® to you and your organisation?
We enjoy STREAM® because it is a one-stop-shop for all things related to standards and regulatory compliance. We don't have to remember any clauses, articles or control statuses because they are easily accessible and just a few clicks away. We don't have to wonder about our risk and compliance status or what we have to do next. STREAM® tracks this all for us and we are able to view the data through customised dashboards and reports. It serves us more like a guide that we follow instead of something we have to push.
One of the most beneficial things has been the ability to link items to each other. For example, the relationship between a clause, a control, a KCI, an assessment, an action, a non-conformity, an asset and a risk. Having a tool that can present the data is one thing, but to build the mapping and see all the linkages, is where the value is added. This is what really brought the tool to the next level.
Complete transparency in all risk management processes
Increased efficiency in risk assessment and mitigation
Better decision-making through risk-based approach
Improved ability to demonstrate compliance to clients
Enhanced overall security posture
Evolution and Support
How have the developments of STREAM® over the time helped you with your risk/compliance management?
STREAM® has come a long way since we first purchased the tool. The development with the biggest impact to us was the introduction of configurable fields. This feature allows us to capture the information that is important to us, in a form of our choice, e.g. check boxes, selectable drop-down lists and text boxes. This allows us to structure the management of various topics exactly how we wanted, rather than having to adapt to the tool.
The most prominent example is in the management of ISO non-conformities and their corrective actions. With custom fields, we were able to create a system that prompts a series of questions and guides us towards a robust solution. When there is a non-conformity, we can see all the steps needed to resolve it, and by following this sequence, we end up with a dependable corrective action. It means checklists and documents no longer need to be consulted, because everything we need is already in one place.
Comments on the support you have received?
The support from Acuity has been in the top of our customer service experiences to date. The Acuity team has made using and updating the tool enjoyable and has built the reputation of being a reliable partner. We are happy to be associated with the company and the product and look forward to the continued improvements and working with the Acuity team.
Future Plans
What your future plans are for STREAM®?
We already use STREAM® for a range of different applications but are excited to incorporate more. Our next steps are likely to be an integration of ISO 27701, ISO 50001, maybe even ISO 27018. Once the ePrivacy regulation is finalised, we would like to integrate that as well.
Manage multiple standards from one platform
If you're juggling ISO 27001, ISO 22301, ISO 9001, GDPR, or other standards, STREAM® can help you centralise compliance, link controls to requirements, and stay on top of your obligations.
Acuity Risk Management helps businesses worldwide effectively manage, prioritise and report on their risks to inform strategic decision-making and build long-term resilience.
Its powerful STREAM® platform provides rapid time to value to reassure stakeholders that risks are under control and compliance is maintained with increasingly complex standards and regulations. With STREAM®, Acuity eliminates the guesswork around risk to support strategic decision-making, prioritisation of resources and justification of expenditure to maximise ROI. With customers worldwide, Acuity has proven success supporting customers in highly regulated and targeted industries such as finance, IT, telecommunications, healthcare, defence and government.