Book a demo
Security, Trust & Compliance

Enterprise GRC. Built with security and trust in mind.

STORM GRC helps organizations manage governance, risk and compliance through a unified platform, connecting regulatory requirements, business processes, assets, risks and supporting evidence.

We believe transparency is essential to enterprise trust. Our security approach distinguishes between the organizational certifications of ICT PROTECT, the independently certified infrastructure of our hosting providers, and the security controls implemented within STORM GRC.

Request security documentation How assurance is structured
  1. 01
    ICT PROTECTOrganizational certifications
  2. 02
    Hosting providerCertified cloud infrastructure
  3. 03
    STORM GRCApplication security controls
  4. Each layer is assured independently, within its own defined scope.
01 · Organizational security

Organizational Certifications & Independent Assurance

ICT PROTECT maintains a comprehensive framework for information security, quality management, business continuity, and independent assurance, encompassing the development, operation, and delivery of STORM GRC. This framework is supported by applicable organizational certifications and independent assessments, reinforcing the security, reliability, and compliance of the STORM GRC platform.

  • CERTIFIED ISO 27001
  • CERTIFIED ISO 22301
  • CERTIFIED ISO 9001
  • CERTIFIED CYBER ESSENTIALS
  • CERTIFIED CYBER ESSENTIALS PLUS
  • ASSURANCE ISAE 3000 TYPE II
ICT PROTECT organizational certifications and independent assurance, by focus area
Standard / AssuranceFocus Area
ISO/IEC 27001Information Security Management
ISO 22301Business Continuity Management
ISO 9001Quality Management
Cyber EssentialsCybersecurity Controls
Cyber Essentials PlusIndependently Verified Cybersecurity Controls
ISAE 3000 Type IISecurity, Availability & Confidentiality Controls

Certifications and assurance reports apply to their respective certified or assessed scopes. Supporting documentation, including issuing bodies, validity and scope, may be provided upon request, subject to applicable confidentiality requirements.

Request Security Documentation
02 · Hosting & infrastructure

Cloud infrastructure assurance

STORM GRC operates on cloud infrastructure selected with security, availability and data protection considerations in mind.

Relevant independent certifications and assurance reports of the hosting provider can be made available or referenced where applicable.

Hosting provider
Independently certified cloud infrastructure provider
Hosting region(s)
European Union (EU)
Infrastructure certifications
The provider maintains internationally recognised certifications and attestations, including:
  • ISO/IEC 27001
  • ISO/IEC 27701
  • SOC 2 Type II

Cloud provider certifications do not automatically constitute certifications of STORM GRC or ICT PROTECT.

03 · Application security

STORM GRC platform security controls

STORM GRC is designed to support enterprise security and compliance requirements through application-level controls and operational safeguards. Depending on the deployed configuration, security capabilities may include:

  • Identity and access management
  • Role-based access control
  • Audit trails and activity monitoring
  • Encryption and secure communications
  • Data access restrictions
  • Backup and recovery procedures
  • Vulnerability and patch management
  • Security monitoring and incident response

Specific capabilities, configurations and assurance evidence are confirmed during the enterprise security review.

04 · Defence in depth

Layered protection for the STORM GRC platform

Independent layers of control protect the platform, from the network edge through detection, endpoint security, backup and continuity to controlled releases.

STORM GRC defence-in-depth controls by security layer
LayerControl
EdgeWeb Application Firewall inspecting HTTP/HTTPS traffic before it reaches application servers: DDoS protection, OWASP Top 10 defence, rate limiting, IP-reputation blocking and custom rule sets.
DetectionCentralized SIEM aggregates security logs from STORM GRC application and infrastructure components, with rule-based threat detection and alerting. A third-party Security Operations Center (SOC), operated by a Managed Security Service Provider (MSSP), provides 24×7 security monitoring, alert triage, and incident escalation.
EndpointEndpoint and cloud workload protection across all infrastructure components: real-time and scheduled scanning, centrally managed threat intelligence, and logs integrated into the SIEM.
BackupDaily database backups with 30-day retention; system-level backups per policy and before critical releases; annual restoration testing.
ContinuityISO 22301-certified BCMS with Business Impact Analysis, a tested Business Continuity Plan and Disaster Recovery Plan defining RTO/RPO, with STORM identified as a top recovery priority.
Release managementControlled release process under the ISMS: regular updates, security patches, performance improvements and feature enhancements.
05 · Security documentation

Transparency for enterprise procurement

Organizations evaluating STORM GRC can request relevant security information, subject to availability and appropriate confidentiality arrangements.

  • Applicable organizational certificates
  • Hosting infrastructure assurance information
  • Security architecture overview
  • Data processing and hosting information
  • Application security questionnaire
  • Relevant technical and operational security documentation
Request security documentation

Talk to us about your security review.

Contact the STORM GRC team to discuss your organization's security and procurement requirements.

Contact the STORM GRC team