An interview with Frank Wassong, Managing Director at CertMobile

CertMobile supports its customers as a consultant and integration partner for the software-based introduction of IT emergency planning, information security and data protection. The company's Managing Director and Founder, Frank Wassong, is an information security auditor and data protection officer with many years of experience from projects in IT emergency planning, risk management and information security. The company assists customers in planning, coordinating and controlling all related measures. In an interview with Frank Wassong, we talk today about IT emergency planning, information security and the current state of data protection in German SMEs.

DIGITAL FUTUREmag: In the entire field of information security, IT emergency planning plays a major role. Nevertheless, many SMEs neglect this important element for protecting the company. Please name the three most important reasons why every managing director should tackle professional IT emergency planning?

Frank Wassong: In my opinion, the main reason, from which all other reasons automatically follow, is the protection of the company. This includes safeguarding employees and workplaces, obligations to customers, compliance with laws and, last but not least, capital protection. IT emergency planning is tasked with preparing a company for foreseeable and unforeseeable events so that damage is kept to a minimum and does not endanger operations. But that's not all: IT emergency planning enables a company to identify weaknesses in staff, simulate the impact of planned changes or respond to grievances before any damage even occurs.

DIGITAL FUTUREmag: Could you perhaps give us a current example from recent past and briefly report on the consequences?

Frank Wassong: One of our customers has had a well-maintained and up-to-date IT emergency plan for some time. About six months ago, an incident occurred – similar to those in other IT departments – in which large parts of the data centre were affected. Thanks to the IT emergency plan, the company was able to quickly assess the extent, impact and damage consequences. With the help of the alerting plans, all those involved were informed immediately, and the structures and recovery plans developed in advance helped to reduce downtime to a minimum. In this way, financial damage and legal violations can be significantly reduced, if not avoided altogether.

DIGITAL FUTUREmag: Is there standard software for IT emergency planning that you could recommend here?

Frank Wassong: As a gold distribution partner of CONTECHNET GmbH, we have achieved very good results with their software solutions for our customers over the past few years. Of course, there are many other products on the market, but the company's exclusive focus and its products on the topics of information security, IT emergency planning and data protection have thrilled me from the very first moment. Some competing companies simply research in too many different directions. The software solutions of the CONTECHNET Suite all convince with their structured approach and enable customers to create and maintain their management systems with minimal consulting effort. In addition, the synergies that exist between the three topics can be optimally utilised, reducing maintenance efforts. For example, information maintained in INDART Professional® (BCM) can also be used in the INDITOR® BSI/ISO (ISMS) and INPRIVE® (DS) modules. This significantly reduces the effort required and forms the basis for an up-to-date and functional management system.

DIGITAL FUTUREmag: For many companies, 25.05.18 has already faded into oblivion, along with the General Data Protection Regulation that came into force on that date. What has the new regulation brought us, apart from a lot of work and the associated costs?

Frank Wassong: First and foremost, the GDPR has shown us that the importance of data protection was previously far too low – and still is in some cases. To be honest, its introduction has only caused a mountain of work for companies that had never dealt with data protection before. Of course, well-established companies also had to complete some tasks, but by no means as many. The GDPR has impressively demonstrated how many companies only take the issue seriously when the fines and the associated financial risk are correspondingly high. This is very sad, because the rights of those affected should be the focus much earlier. In summary, the GDPR has above all created a new awareness among the population, which has greatly increased the pressure on companies. Suddenly, it is not only the supervisory authorities that monitor compliance with the GDPR, but also the data subjects themselves. This in turn encourages companies to think more carefully about the conscious handling of sensitive personal data and to develop processes that implement the GDPR in a legally compliant manner. However, there is still a hard piece of work ahead of us on this path.

DIGITAL FUTUREmag: Can medium-sized companies also gain something positive from the General Data Protection Regulation and perhaps even gain competitive advantages?

Developing processes and workflows that make the handling of personal data traceable and controllable brings significantly more structure to companies overall. While this does restrict the individuality of individual employees in certain areas, it also reduces the hands-on mentality that poses a risk in data protection—i.e., the careless and unconscious handling of data. Typically, a structured company is better able to respond to changes and assess in advance what such a change means for the business.
Not least, this is one of the reasons behind the standards for IT emergency planning and information security. In principle, companies with proper structures have more control options and are better able to respond efficiently to influences. This is becoming increasingly important for companies and represents a clear competitive advantage.

DIGITAL FUTUREmag: The German government has once again adjusted the rules within the framework of the General Data Protection Regulation. Does this have any significance for us within the scope of this European regulation?

Frank Wassong: Only to a limited extent or not at all. The increase in the employee threshold from which a data protection officer must be appointed has nothing to do with the GDPR itself. The original threshold of ten employees was required by the German government as part of the old Federal Data Protection Act (BDSG-alt) within the opening clause. The GDPR itself provides for a much more generous threshold of 250 employees. Ultimately, however, this is not an easing for companies. While they no longer have to appoint a data protection officer, they remain fully obligated to comply with data protection. Companies that process special categories of data are anyway exempt from this rule and are always subject to the obligation to appoint an officer.

DIGITAL FUTUREmag: When would you recommend appointing a data protection officer in any case, and what advantages do you see in an external data protection officer?

Frank Wassong: I always recommend seeking advice from an experienced data protection officer (DPO). Data protection requirements are diverse and are not based exclusively on the GDPR but are also contained in other regulations and laws that companies must comply with. Without support, it is difficult for a company to determine which regulation or law takes precedence in which situation.
The disadvantages of an internal DPO compared to an external one include training costs/time, provision and duplication of the position (vacation, illness), as well as maintaining the level of knowledge. For small and medium-sized enterprises, an internal DPO is therefore hardly feasible in terms of personnel. An external DPO typically focuses solely on this task. They have a full overview of the topic and thus serve as a competent partner to management, providing objective advice without internal influences.

DIGITAL FUTUREmag: At the upcoming DIGITAL FUTUREcongress, you will be taking part. What will you be presenting to visitors during your appearance?

Frank Wassong: As we did last year, our team, together with Janis Zettel from CONTECHNET, will present our services and the products of the CON-TECHNET Suite along with their latest updates. We look forward to interesting discussions on topics such as the BSI 200 standard, the ISO 27701 extension catalog for data protection, and other subjects like the implementation of the B3S catalog for hospitals. Over the past few months, we have further refined our approach to implementation and can now present concepts that require just three (DS), five (BCM), and 15 (ISMS) consulting days.

DIGITAL FUTUREmag: Then we look forward to a fantastic event with you.