Privacy and Security Assessment

Data privacy and security are becoming increasingly important. This is evident, not least, in the rapid rise in cyberattacks driven by political and criminal motives. Around the world, individuals, organizations, and companies such as Deutsche Telekom are targets. For Deutsche Telekom, data privacy and security are particularly important because its services rely on customers' trust in their security.

Deutsche Telekom recognized the resulting challenges early on and responded by developing and introducing a tailored solution: the Privacy and Security Assessment (PSA).

The PSA procedure ensures that all projects for developing and introducing new technologies and products meet the high requirements for technical security and data privacy.

The PSA procedure has the following objectives:

• A consistent and appropriately high level of security and privacy across all products, systems, and platforms.
• An integrated, standardized process for technical security and privacy that is firmly embedded in product and system development processes.
• A level of support tailored to project complexity and criticality through categorization at the start of each development project.

Small steps for a project, one giant leap for data privacy and security

The PSA procedure is simple and easy to navigate. Focusing on the essential steps promotes efficiency and consistent application across all relevant projects within the Deutsche Telekom AG Group.

The first step is to categorize the project. This determines its security relevance. This is necessary to prioritize the large number of IT and NT projects carried out each year within the Deutsche Telekom AG Group.

The subsequent steps in the PSA procedure are directly linked to the individual phases of each project.

An important first step is identifying the relevant privacy and security requirements. The requirements developed by Deutsche Telekom's security and privacy experts based on manufacturer recommendations, industry standards, and applicable laws and regulations are aligned and valid across the Group. In the next step of the PSA procedure, the requirements must be implemented, reviewed, and documented. For requirements that have not been met, a risk assessment based on the protection needs of the individual systems is generated automatically and, if necessary, an action plan is developed together with the project.

The PSA procedure ensures that the Group's security standards are implemented for every relevant product and system and approved by security and privacy experts before the product or system is put into operation.