ISO 27001 AT PYRAMID A Systematic Approach to Information Security

With our ISO/IEC 27001-certified information security management system, we systematically protect sensitive customer, project, and company data. Clear responsibilities, defined processes, and technical and organizational measures ensure the confidentiality, integrity, and availability of information.

General Information What Information Security Means at Pyramid

The protection of information and data is a top priority for Pyramid . Our information security management system has been certified to DIN EN ISO/IEC 27001 since 2026. It ensures that sensitive customer, company, and project data is handled in accordance with carefully defined standards.

Many measures—ranging from regulated access rights to comprehensive backup strategies—were already in place. ISO/IEC 27001 brings them together into a structured, auditable management system and supports their continuous improvement.

This is how we create a reliable foundation for a trusting and responsible partnership: Our customers' data is in safe hands with us.

OUR INFORMATION SECURITY GUIDELINES Basic Principles for Data Protection

This guideline applies to all employees at the Freiburg and Amt Wachsenburg locations. It establishes binding standards for the secure handling of information. Our customers can rest assured that their data is protected in accordance with consistent and verifiable rules. The guideline is based on the following core principles:

Need-to-Know Principle

Access to information only to the extent necessary for the task at hand.

Backups & Recovery

Regular data backups in accordance with a defined recovery plan.

Password & Access Policies

Mandatory guidelines for secure passwords and controlled access rights.

Mobile and Stationary Work Equipment

Clear rules for the use of Computer and company cell phones while working from home, at the office, and on business trips.

GDPR Compliance

Processing of personal data is carried out exclusively in accordance with the GDPR.

Security Objectives Confidentiality, Integrity, Availability

Confidentiality

Information is accessible only to authorized individuals—protected by the need-to-know principle and clear access rights.

Integrity

Data remains complete and unchanged unless it is edited by an authorized user—protected by technical and organizational measures.

Availability

Systems and information are reliably available to authorized users—backed up by backups and a defined recovery plan.

Risk Management Systematically Assessing Criticality

Business Impact Analysis

Assessment of assets based on their criticality to business operations.

Email, Teams, and SharePoint

Clear rules for using email, MS Teams, SharePoint, and OneDrive.

Technical Measures

Continuous IT monitoring for the early detection of anomalies.

Annual Training

Raising awareness among all employees about current risks.

Emergency Management Ready to Act in an Emergency

We have effective procedures and assigned responsibilities in place for security incidents. This enables us to prevent damage or limit its impact, maintain critical business processes, and restore normal operations as quickly as possible. Keyword: Business Continuity.

 

Prevention

Backup & Recovery Plan

Regular, tested data backups with a defined recovery time.

Escalation

Clear Chain of Command

IT Administration → Information Security Officer (ISO) → Executive Management.

Test

Regular exercises

Emergency procedures are tested regularly to ensure their effectiveness in the event of an emergency.

Inquire Now Do you have questions about our information security?

The Information Security Officer (ISO) and the Quality Management Team are happy to provide advice.