Identity & access
Structuring access rights and securing accounts.
AWSMTECH
nFADP, GDPR, DORA compliance & IT governance
From regulatory requirements to concrete IT and cybersecurity measures.
- nFADP
- GDPR
- DORA
- IT governance
- Data protection
- Digital resilience
AWSMTECH
Turning regulatory requirements into concrete measures.
Digital compliance should not stop at policies, procedures and documents. It also has to be reflected in your IT environment.
- Who can access the data?
- Where is it stored?
- How is it protected?
- Are your backups under control?
- Are your systems up to date?
- Can you detect and handle an incident?
AWSMTECH supports you in implementing the IT, organisational and cybersecurity measures needed to bring your environment closer to the requirements that apply to your business.
Schedule a callApproach
Compliance does not start with a document
It starts with control over your digital environment. It is possible to have an excellent security policy on paper while still keeping unused accounts, excessive access rights, unmanaged devices or insufficiently protected data. Our approach aims to close the gap between what is planned and what is actually implemented. We work in particular on the technology aspects of compliance:
- Identity and access management
- Workstation and device protection
- Microsoft 365 environment
- Backup and restore
- Data security
- Vulnerability management
- Monitoring
- IT environment documentation
- Continuity and resilience
- Technology supplier governance
nFADP
nFADP: protecting data in your IT environment
The revised Federal Act on Data Protection came into force on 1 September 2023. The FDPIC notes in particular that the revision strengthened the rights of data subjects and the obligations of data controllers.
The Act also incorporates the principles of Privacy by Design and Privacy by Default, which notably involve implementing appropriate technical and organisational measures from the design stage. AWSMTECH helps you translate these principles into your digital environment.
In practice, we can support you in analysing and improving areas such as:
Microsoft 365
Configuring and securing your collaboration environment.
Endpoints
Managing and protecting the devices that access your organisation's data.
Data
Better understanding where it is located and how it can be accessed.
Backup & continuity
Protecting important information and preparing for its restoration.
Operational security
Reducing vulnerabilities and improving the ability to detect incidents.
GDPR
GDPR: controlling data beyond borders
The GDPR is the European framework for the protection of natural persons with regard to the processing of personal data and the free movement of such data.
For the organisations concerned, compliance requires coordination across several dimensions:
- 01Legal
- 02Organisation
- 03Processes
- 04Technology
- 05Cybersecurity
AWSMTECH works mainly on the technology and operational dimensions.
Our goal: to enable your IT environment to support the decisions and policies defined by your organisation and, where necessary, by your legal advisers or data protection specialists.
DORA
DORA: from cybersecurity to operational resilience
In the financial sector, protection is no longer enough. You must be able to withstand and recover.
The European DORA regulation, Regulation (EU) 2022/2554, lays down rules on digital operational resilience for the financial sector. It covers various categories of financial institutions and sets out requirements for ICT risk management.
Topics identified under DORA include ICT risk governance, the use of up-to-date and resilient systems, system monitoring, business continuity, and backup, restoration and recovery policies.
This is precisely where combining managed IT, cybersecurity and governance makes full sense.
DORA
This is precisely where combining managed IT, cybersecurity and governance makes full sense.
IT governance
Understanding your environment, identifying important systems and structuring responsibilities.
Technology risk management
Identifying vulnerabilities and gradually improving the level of control over the environment.
Detection
Putting in place the technology capabilities needed to identify behaviours and events that require attention.
Continuity
Preparing your organisation to maintain or restore its digital capabilities when an incident occurs.
Suppliers
Improving visibility of technology services and external dependencies in your environment.
From framework to practice
From compliance on paper to compliance in practice
Requirement
A policy may state that access rights must be reviewed regularly.
Our role
Helping you build an environment in which identities and access can actually be controlled.
Requirement
A procedure may specify that data must be protected.
Our role
Contributing to implementing the corresponding technical measures.
Requirement
A continuity plan may provide for data restoration.
Our role
Working on the technology capabilities needed for that restoration.
It is this alignment of governance, technology and cybersecurity that turns a regulatory requirement into operational reality.
Microsoft 365
Microsoft 365 & compliance
Microsoft 365 often holds a significant share of a company's information. Configuring identities, access and Microsoft services therefore becomes an important part of controlling the environment.
AWSMTECH helps organisations administer and secure this ecosystem so that it is consistent with their internal information protection requirements.
- Outlook
- Teams
- SharePoint
- OneDrive
- Entra ID
AI & data
AI & data protection
New technologies. New risks to govern.
The rapid adoption of artificial intelligence tools also raises new questions:
- What data can employees share with an AI?
- Which tools are authorised?
- What information can Microsoft Copilot access?
- How can Shadow AI be limited?
- How can employees be made aware?
Rather than blocking innovation, AWSMTECH helps you put in place a framework for using AI in a more controlled way.
Method
A structured approach to IT compliance
- 01
Assess
Understand your technology environment, data, usage and risks.
- 02
Identify gaps
Compare the current situation with the requirements and objectives that apply to your organisation.
- 03
Prioritise
Identify the gaps that carry the greatest risks.
- 04
Remediate
Implement the selected technical and organisational measures.
- 05
Maintain
Adapt the measures to technological, organisational and regulatory changes.
Compliance & cybersecurity
Compliance and cybersecurity: two complementary approaches
Compliance defines a framework. Cybersecurity helps make it operational.
Being compliant does not automatically mean being protected against every cyber threat. Conversely, excellent cybersecurity tools alone cannot meet all regulatory obligations.
AWSMTECH therefore brings these two dimensions together.
- Governance
- Compliance
- Protection
- Detection
- Resilience
Collaboration
We work alongside your specialists
Compliance does not rely on a single profession. Legal, organisational and technology challenges often require several areas of expertise. AWSMTECH can work alongside your:
- Management
- IT manager
- Security officer
- Legal adviser
- DPO / data protection adviser
- Compliance officer
- External auditor
A private company may appoint a data protection adviser, responsible in particular for monitoring compliance with the rules and advising the company. Responsibility for processing data in accordance with the law nevertheless remains with the company.
AWSMTECH supports your compliance efforts without replacing your own responsibility or your legal counsel.
Why AWSMTECH
Why AWSMTECH?
A 360° view of your environment
IT, Microsoft 365, cybersecurity and governance are addressed consistently.
A pragmatic approach
We turn recommendations into concrete technical measures.
Expertise suited to demanding environments
We support organisations for which confidentiality, availability and risk control are essential.
A risk-based approach
Not everything can be addressed at once. We help identify and prioritise the relevant measures.
A local partner
AWSMTECH supports organisations in Geneva and French-speaking Switzerland with an understanding of the Swiss technology context.
Frequently asked questions
Frequently asked questions
The FADP is the Swiss federal data protection framework, while the GDPR is the European regulation on the protection of natural persons with regard to the processing of their personal data. Whether each framework applies depends on the organisation's situation and must be determined case by case.
No. Our role is to support you on the IT, cybersecurity and organisational aspects of your compliance efforts. Where necessary, the legal assessment of your obligations should be carried out by a qualified specialist.
DORA is European Regulation 2022/2554 on digital operational resilience for the financial sector. It sets out governance and risk management requirements for information and communication technologies for the entities within its scope.
For private companies, the FDPIC states that appointing a data protection adviser is optional under the FADP, unlike the GDPR regime in situations where the GDPR requires this role.
No. Data and resilience regulations include aspects that go beyond cybersecurity tools alone. Technology is one part of the framework, alongside legal, organisational and governance aspects.
nFADP, GDPR & DORA compliance
Make compliance a tool for managing risk.
Compliance should not feel like an accumulation of documents. Done well, it helps you know your environment better, protect your data more effectively, clarify responsibilities and strengthen your organisation's resilience. AWSMTECH helps you turn the requirements that concern you into concrete technology measures suited to your reality.
Schedule a callA question about your compliance efforts? Write to us