Six frameworks, actively monitored
Overview of all compliance frameworks that Onesurance monitors and adheres to. From GDPR and DORA to ISO 27001 and the EU AI Act: we ensure our services meet the most stringent requirements.
- 6 frameworks, actively monitored and audited.
- GDPR compliant and DORA-aligned: full GDPR compliance; control measures aligned with DORA.
- ISO 27001 in progress: ISMS operational, certification Q1 2027.
Where we stand, per framework
| Framework | Status | Details |
|---|---|---|
| AVG / GDPR | Compliant | Full compliance since inception. All 8 principles upheld. |
| ISO 27001 | In progress | ISMS operational. Certification audit scheduled for Q1 2027. |
| DORA | Aligning | Control measures established that align with the 5 DORA pillars. |
| EU AI Act | In preparation | Limited / Minimal Risk classification. Active monitoring of requirements. |
| NIST CSF | Guideline | Core controls implemented. Continuous improvement. |
| CIS Controls | Guideline | Top 10 critical controls active. Periodic evaluation. |
General Data Protection Regulation: fully compliant since inception
Compliant
Onesurance has been fully GDPR compliant since inception. All 8 data processing principles are upheld, supported by technical and organisational measures.
GDPR principles
- Lawfulness, fairness and transparency: processing based on valid legal grounds with clear communication to data subjects.
- Data subject rights: fully implemented procedures for access, rectification, erasure, restriction, portability and objection.
- Consent management: granular consent with the ability to withdraw. Full audit trail.
- Privacy by Design & Default: data protection embedded in all systems and processes from the design stage.
- Security of processing: appropriate technical and organisational measures to protect personal data.
- Data breach notification: Onesurance notifies the client of any (suspected) data breach without undue delay and in any event within 24 hours, and assists the client with notification to the supervisory authority and data subjects.
- Record of processing activities: fully maintained register in accordance with Article 30 GDPR.
- Data Protection Officer: appointed DPO who oversees compliance and advises on data protection matters.
Evidence and documentation
- Privacy statement
- Data Processing Agreements (DPA)
- Record of processing activities
- Data Protection Impact Assessment (DPIA)
Information Security Management System operational, certification in Q1 2027
In progress
Our ISMS is fully operational and structured in accordance with ISO 27001:2022. The certification audit is scheduled for Q1 2027. All Annex A controls have been implemented and are periodically audited.
Annex A controls
Organisational controls
Information security policy, risk management, compliance management, asset management and supplier relationships.
People controls
Screening, security awareness, training, disciplinary processes and post-employment responsibilities.
Physical controls
Physical security via Azure data centres (ISO 27001 and SOC 2 certified), clean desk policy and device management.
Technological controls
Encryption, network segmentation, access control, vulnerability management, logging and monitoring.
Internal audits
We conduct internal audits annually and upon significant changes across all ISMS processes. The most recent internal audit was completed in September 2026. Findings are tracked to closure and reported to the management team.
Digital Operational Resilience Act: control measures across all five pillars
Aligning
As a service provider for the insurance sector, Onesurance has established control measures that align with the core principles of DORA. All five pillars are continuously developed and monitored.
The 5 pillars of DORA
| Pillar | Measures |
|---|---|
| ICT Risk Management | Systematic identification, assessment and mitigation of ICT risks with a documented risk framework. |
| Incident Management | Standardised process for detection, classification, escalation and reporting of ICT-related incidents. |
| Digital Operational Resilience Testing | Vulnerability assessments and scenario-based tests to validate operational resilience, with an external pentest programme in development. |
| Third-Party Risk Management | Due diligence, contractual safeguards and continuous monitoring of all ICT service providers. |
| Information Sharing | Participation in relevant information-sharing networks for cyber threats and vulnerabilities. |
Our AI applications fall under Limited / Minimal Risk
In preparation
Onesurance classifies its AI applications as Limited / Minimal Risk under the EU AI Act. We actively monitor regulatory developments and have taken proactive measures.
Measures
- Risk assessment: classification of all AI systems by risk level in accordance with the EU AI Act taxonomy.
- Transparency: users are clearly informed when they are interacting with AI systems.
- Human oversight: all AI decisions are subject to human review and override.
- Data governance: quality controls on training data, bias monitoring and data minimisation.
- Technical documentation: comprehensive documentation of AI models, training processes, performance metrics and limitations.
NIST Cybersecurity Framework: five core functions in our operational processes
Guideline
Onesurance uses the NIST Cybersecurity Framework as a guiding principle for our security approach. The five core functions are integrated into our operational processes.
Identify
Asset management, risk assessment, governance and business environment mapped to understand cybersecurity risks.
Protect
Access control, security awareness, data protection and maintenance to safeguard critical services.
Detect
Continuous monitoring, anomaly detection and security events to identify threats in a timely manner.
Respond
Response planning, communication, analysis, mitigation and improvements during security incidents.
Recover
Recovery planning, improvements and communication to restore operations promptly after security incidents.
The top 10 CIS controls are active
Guideline
Onesurance implements the CIS Critical Security Controls as a supplementary framework for practical security measures. The top 10 controls are active.
| Control | Details |
|---|---|
| 1. Inventory of enterprise assets | Active management of all hardware and software assets on the network. |
| 2. Inventory of software assets | Only authorised software runs on enterprise systems. |
| 3. Data protection | Classification, encryption and protection of sensitive data. |
| 4. Secure configuration | Standardised hardening of servers, endpoints and network devices. |
| 5. Account management | Lifecycle management of accounts with least privilege and regular reviews. |
| 6. Access control | Role-based access with MFA and continuous authentication monitoring. |
| 7. Vulnerability management | Continuous vulnerability scanning and timely patching of systems. |
| 8. Audit log management | Central collection, protection and analysis of audit logs. |
| 9. Email and web browser protection | Filtering of malicious content and restriction of unauthorised plugins. |
| 10. Malware defence | Endpoint protection, anti-malware and behavioural analysis on all systems. |
Questions about compliance?
Our Data Protection Officer is happy to assist with questions about compliance, certifications or regulatory matters.