More Security for Cloud and Data: Projektron Meets ISO/IEC 27001:2022 with Additional Controls Based on ISO 27017 and ISO 27018

With the current certification by TÜV Rheinland, we are continuing our long-standing commitment to systematic and independently audited information security management. The key development is the broader focus on two areas that are particularly important for modern software solutions: the secure provision and use of cloud services and the controlled handling of personal data in the cloud.

What does ISO/IEC 27001:2022 mean?

The international standard ISO/IEC 27001:2022 defines the requirements for establishing, implementing, maintaining and continually improving an information security management system, or ISMS. It provides organizations with a systematic framework for identifying and assessing information security risks and defining appropriate technical and organizational measures.

The standard focuses on three fundamental information security objectives:

Confidentiality: Information is accessible only to authorized individuals and systems.

Integrity: Information is protected against unauthorized or unintended modification.

Availability: Information and systems are reliably available when needed.

Information security is therefore not treated simply as a collection of individual technical safeguards. Instead, it is systematically embedded in processes, responsibilities, risk assessments, controls, training and continuous improvement.

What is new in 2026?

Our information security management system was already certified to ISO/IEC 27001:2022 in 2025. The current certificate reconfirms compliance with these requirements while also documenting an important further development.

The certificate refers to the Statement of Applicability (SoA), Version 1.8 dated June 2, 2026, as the basis for the audited controls. It also explicitly includes additional controls based on:

ISO/IEC 27017:2015

ISO/IEC 27018:2019

This gives greater emphasis to two areas that are particularly relevant to modern software and cloud services: cloud security and the protection of personal data in cloud environments.

The certification standard itself remains ISO/IEC 27001:2022. ISO/IEC 27017 and ISO/IEC 27018 are incorporated as additional controls within the certified information security management system.

While ISO/IEC 27001 provides the overarching framework for the ISMS, ISO/IEC 27017 focuses specifically on information security for cloud services. ISO/IEC 27018, in turn, focuses on the protection of personally identifiable information in public cloud environments.

Our certificate can be viewed online in the TÜV Rheinland Certipedia certificate database.

ISO/IEC 27017: Cloud security requires clearly defined responsibilities

With cloud services, tasks and responsibilities are shared between cloud service providers and cloud customers. This creates specific information security requirements. For example, it must be clearly defined who is responsible for particular security controls, how administrative access is managed and how cloud environments are operated securely.

This is where ISO/IEC 27017:2015 comes in. It supplements general information security controls with additional guidance and controls specifically relevant to the provision and use of cloud services. It applies to both cloud service providers and cloud service customers.

Key areas include:

clearly defined security responsibilities between cloud service providers and cloud customers

controlled administrative access to cloud systems

secure configuration and administration of cloud environments

appropriate segregation of customer environments and information

monitoring of security-relevant activities

defined procedures for handling cloud-specific risks and security incidents

Information security is therefore not considered solely within an individual system. The interfaces and division of responsibilities between the provider, the technical infrastructure and the customer are also taken into account.

This focus is particularly relevant to Projektron because BCS can be operated both in customer-managed environments and as a SaaS solution.

ISO/IEC 27018: Protecting personal data in the cloud in a transparent and controlled manner

While ISO/IEC 27017 addresses the overall security of cloud services, ISO/IEC 27018:2019 focuses specifically on personally identifiable information.

It provides control objectives, controls and guidelines for protecting personally identifiable information in public cloud environments. It is particularly relevant to cloud services in which the provider processes personal data on behalf of its customers.

This is not only about protecting data technically against unauthorized access. Transparent and traceable processes and clearly defined responsibilities for handling personal data are equally important.

Relevant requirements include:

controlled processing of personally identifiable information

transparent and traceable processes

clearly defined responsibilities

protection of personal data during storage and processing

controlled access to this data

traceable and auditable protection measures

This is particularly relevant to BCS customers because, depending on how the software is used, BCS may process contact, time-tracking, HR, project or support data, for example.

The two additional standards therefore complement each other: ISO/IEC 27017 addresses the secure provision and use of cloud services, while ISO/IEC 27018 provides more specific guidance on protecting personal data within such cloud environments.

Why we are certified – and how our customers benefit

Our customers work with sensitive and business-critical data – including project plans, budgets, time entries, quotations, invoices, contracts, tickets, contacts and strategic information.

For us, information security therefore needs to be more than a promise: it must be systematically managed and independently audited.

Our ISO/IEC 27001:2022 certification and the additional controls included in the certificate demonstrate:

A comprehensive security approach: Information security is addressed across software development, operations and hosting, as well as support and IT services.

Systematically defined processes: Security controls are based on established procedures, clearly assigned responsibilities and continuous risk assessments.

Technical and organizational measures: Information and systems are protected by security measures tailored to the respective risks.

Regular audits and continuous improvement: Our information security management system is reviewed internally and regularly audited by independent auditors.

Clearly defined responsibilities for cloud operations: Cloud-specific risks and the allocation of security responsibilities between provider and customer are systematically addressed.

Transparent protection of personal data: Special requirements for secure, controlled and transparent processes are taken into account when personal data is handled within cloud services.

For our customers, this provides transparency and confidence: our security measures are not limited to individual technical features but form part of a documented and independently audited management system.

Information security and quality management have been firmly embedded in Projektron’s business processes for many years.

Since 2008, we have maintained a comprehensive quality management system based on ISO 9001. It covers the entire value chain – from the initial product idea through development, testing and documentation to implementation at the customer’s site and ongoing support.

In October 2016, we decided to additionally establish an information security management system covering development, support, IT services and internal IT administration.

The implementation of the ISMS was itself planned and managed as a project using BCS. We were supported in this process by secuvera GmbH and r-tec Security GmbH, among others.

In February 2018, we successfully achieved our first ISO 27001 certification, issued by TÜV SÜD AG.

Our first recertification followed in November 2021.

In 2024, our information security management system was recertified by TÜV Rheinland in accordance with ISO/IEC 27001:2013.

In the first quarter of 2025, this was followed by certification to the revised ISO/IEC 27001:2022 standard.

The latest audit in 2026 continues this development. For the first time, the certificate also includes additional controls based on ISO/IEC 27017:2015 and ISO/IEC 27018:2019.

Over the years, our information security management system has therefore evolved continuously: from the initial establishment of an ISMS and regular recertifications to a stronger focus on cloud security and the protection of personal data.

A key component of our information security management system is risk management. Potential risks are identified, assessed in terms of their likelihood and potential impact, and then addressed through appropriate measures.

The environment in which we operate is constantly changing. New technologies, cloud services, organizational changes and new attack methods can introduce new risks. Our ISMS is therefore reviewed regularly and adapted to changing requirements.

Training and Security Awareness

Technical security measures alone are not enough. Employees also play a crucial role in information security. Regular training and security awareness measures are therefore an integral part of our information security management.

New employees are introduced to relevant security requirements as part of their onboarding. Existing employees receive regular training and information on current topics and risks. This helps ensure that information security is not only documented in policies but also practiced in everyday work.

Audits and Continuous Improvement

A certified information security management system is not a static achievement. Continuous improvement is an explicit part of the ISO/IEC 27001 approach. Internal reviews and external audits help us assess existing measures, identify potential weaknesses and determine opportunities for improvement.

The current certificate continues a development that began at Projektron many years ago. Since the introduction of our information security management system and our first ISO 27001 certification in 2018, the ISMS has been regularly reviewed, recertified and continuously improved.

The renewed confirmation of compliance with ISO/IEC 27001:2022, together with the additional controls based on ISO/IEC 27017:2015 for cloud security and ISO/IEC 27018:2019 for the protection of personally identifiable information in cloud environments, marks the next step in this development.

For our customers, this means that information security at Projektron is neither a one-time project nor an individual product feature. It is part of a long-established management system covering development, support, IT services and internal IT administration, with risks continuously assessed and the system regularly reviewed by independent auditors.