
36Penneo Annual Report 2024
Risk management
Penneo regularly assesses which risks the company is
facing as an organization in order to make sure that
appropriate mitigation measures are taken to address
them. The risk management approach is inspired by
the International Organisation for Standardization
(ISO) 31000 (Risk Management Framework) and
covers all areas within Penneo, such as financial,
organizational, legal, market, industry, and cyber risks.
Risk owners evaluate relevant risks and Penneo’s CEO
evaluates the risk assessments. The results of these
assessments are then presented to Penneo’s Audit
Committee and the Board of Directors where final
discussions are held and decisions are made.
Organisational risk
As a SaaS company, Penneo is highly dependent on
its employees. The fight for talent particularly in IT
and compliance, poses a significant risk to Penneo’s
organisation. To remain an attractive employer, we
must ensure that we prevent discrimination, and create
a fulfilling work environment. As such, Penneo focuses
on supporting employees’ rights to privacy, safe and
healthy working conditions, and fair remuneration, as
well as providing career opportunities, growth paths,
and an inspiring work environment.
Cyber risk
As a processor of personal data through the products
Penneo Sign and Penneo KYC, Penneo continues to
have product security as a top priority to mitigate the
risk of cyber threats, as well as other kinds of risks that
could disrupt Penneo’s services or lead to unintended
disclosure of data.
Penneo continues to operate its Information
Security Management System (ISMS), based on the
internationally recognised ISO 27001 standard, to
ensure internal processes and controls to address
risks related to the confidentiality, integrity and
availability of data. Penneo was in 2023 certified in
accordance with the ISO 27001 standard, and passed
the surveillance audit in 2024.
Penneo engages an external audit firm to audit
relevant internal processes and controls for both
Penneo Sign and Penneo KYC, which results in ISAE
3000 audit reports that are shared with customers
and other relevant stakeholders. Both technical and
organisational measures are audited and cover areas
such as governance, access control, encryption,
disaster recovery and software development. Penneo
also engages an external IT security firm to perform
security penetration tests aimed at testing Penneo’s
infrastructure and applications and discover potential
vulnerabilities.
Penneo uses Amazon Web Services (AWS) as its
Infrastructure as a Service (IaaS) provider, which
continues to be a secure and reliable hosting provider.
Both performance and compliance is monitored by
Penneo’s engineers and Legal and Compliance teams.
GDPR risk
Penneo handles a large amount of EU citizens personal
data and is subject to the General Data Protection
Regulation. Penneo is subject to risks as we operate
both as a Data Processor, in relation to our customers
data, and as a Data Controller for our employees’
personal data. Non-compliance with this legislation
can be due to human error, insufficient technical
security measures, misinterpretation of the rules or
case law. The consequences for non-compliance are
either public criticism or a fine. Most severely, Penneo
could face reputational damages.
Implemented measures
Penneo has implemented several initiatives to
mitigate risks. All employees must complete annual
cybersecurity awareness training. Penneo vets all
vendors and suppliers from a GDPR and security
perspective. Penneo tries to update our products in
response to new case law or data privacy specifications.
Penneo was in 2023 certified in accordance with the
ISO 27701 standard, and passed the surveillance audit
in 2024.
Penneo also ensures training of legal staff through
seminars and certifications to stay updated on
relevant changes to the legislation and the practical
implementation of data privacy rules/case law.
Additionally, Penneo has implemented a number
of People initiatives in 2024, to remain an attractive
employer. These include manager training, work on
psychological safety, a clear framework and plans for
career development.
Key risks