Eurofiber | ISAE 3402 (SOC 1)

‘We are very pleased with the partnership with Conclude and TÜV Netherlands As we manage vital infrastructure, we are fully committed to ensure our services meet the highest standards regarding reliability, and we work together with the best partners available to realize this. Together with Conclude and TÜV Nederland we accomplished an unique integrated audit approach, in which the ultimate risk management standard ISAE 3402 and multiple ISO standards are combined. Unique in this approach is sampling on ISO requirements, which brings additional value to ISO for our stakeholders than ever before’. 
- Eurofiber, Corporate Compliance

'As TÜV Nord we see the collaboration with Eurofiber and partner Conclude Accountants as a best practise on ‘Building trust together.’ 
– Alex van der Wal, TÜV Nord

‘Eurofiber is a progressive organisation that is focused on achieving an efficient way of working. Regarding the partnership with TÜV, we reached the next step in auditing. This new approach creates additional time for quality improvements within the organisation which affected the audit positively for Eurofiber.'
– Wendy Lammers, Conclude Accountants

Summary

Eurofiber has been operating high-quality digital open infrastructure since 2000. With its fiber-optic network and datacentres, it offer companies, governments, and non-profit organizations future-proof, smart and open cloud infrastructure and connectivity solutions. Eurofiber has its own fiber-optic network of 38,000 kilometres in the Netherlands, Belgium, and France, with a branch in Germany. Eurofiber companies Dataplace, FullSave, and Eura DC operate ten datacentres in the Netherlands and France. In addition to this vital infrastructure, it also offers solutions for interconnectivity between almost all high-quality carrier-neutral datacentres in the Netherlands and Belgium through the DCspine platform. Eurofiber is thus laying the foundation for the digital society. The Dutch government has therefore awarded Eurofiber the status of "vital infrastructure".

The partnership between Conclude Accountants and TÜV Nederland allows customers to integrate certification services such as ISO 27001, ISO 9001 with assurance standards ISAE 3402 / SOC 1 and ISAE 3000 / SOC 2. TÜV Nederland is part of TÜV NORD GROUP and one of the forerunners with regard to certification in the field of information security, privacy, and cybersecurity (ISO 27001, ISO 27701, IEC 62443). Conclude Accountants is a leading provider of assurance services in the field of governance, risk, and compliance and is constantly looking for innovative developments in the market. Together they work on international ISAE 3402 (SOC 1) and ISAE 3000 (SOC 2) assignments, in which audit activities are combined as much as possible with ISO assignments to realize an integrated audit as effectively as possible.

Challenge

Eurofiber Group holds various business units, certified for a broad variety of international ISO standards, verified by multiple independent bodies. There was a stringent need for a generic approach, to be more efficient. And, most importantly, Eurofiber wishes to positively distinguish itself regarding reliability, as Eurofiber is awarded Vital Infrastructure. This requires an integrated audit approach with absolute focus on proven in control.

Working with multiple organizations and performing an integrated audit asks for experience, commitment and focus. The focus was on an integrated audit solution, where the common factor is ISAE 3402 Type II. One framework based on the existing Eurofiber ISAE 3402 Framework supplemented with the ISO standards, known as the layered approach.

The layered approach is designed in order to successfully design and perform the integrated audit process. Regarding the ISO audit, TÜV was able to rely on the outcomes of the ISAE audits that Conclude Accountants performed. Because of the fact that these standards have some overlap regarding a selection of controls, both standards could be combined in a framework in order to increase efficiency for Eurofiber.

By adding controls (e.g. management controls), the Eurofiber framework complies with all requirements from ISAE 3402 and various ISO standards. The tests during the audit must be as efficient as possible to prevent double testing. To accomplish such a complex assignment, the experts from TÜV, Conclude and Eurofiber had to collaborate to achieved this ambition.

Solution&Results

In the end, Eurofiber has one framework where all ISO standards meet and secure risk on all fronts. Unique in this approach is sampling on ISO requirements, which brings more value to ISO for the stakeholders than ever before.