Clear responsibilities for the technology entrusted to us.

Define who can access what—and why.

Access arrangements should reflect the responsibilities of the people using and managing a system.

Depending on the environment and commissioned services, the scope may include:

• Named accounts and role-based permissions.
• Restricted administrative access.
• Multi-factor authentication where supported.
• Separate access arrangements for development and production.
• Approval processes for granting or changing access.
• Periodic access reviews and removal of obsolete permissions.

The agreement identifies who authorises access and who implements the approved changes. Credentials and other sensitive access information are handled through agreed channels.

Make changes through a controlled process.

Development and maintenance work can introduce risk when changes are poorly reviewed or released without preparation.

Our delivery approach provides for version control, appropriate review, testing and documented release decisions. The specific checks reflect the technology and the importance of the change.

Where applicable, the project scope addresses:

• Review of code and configuration changes.
• Software dependencies and licensing.
• Separation of test and production environments.
• Functional and permission testing.
• Security checks and specialist assessments.
• Release approval and rollback arrangements.

Independent penetration testing or other specialist assurance is commissioned explicitly where required.

Understand where information goes and who is responsible.

Information-handling requirements are established around the services being delivered.

Relevant arrangements may cover the categories of information involved, permitted access, hosting and backup locations, retention settings and approved suppliers.

Hosting location and remote support access are considered separately. Irish incorporation alone does not determine where a system’s data is stored or processed.

Your organisation determines its business requirements and applicable legal obligations. Greenovus implements the technical measures assigned to us within the engagement and identifies dependencies requiring further decisions.

Define recovery expectations before an interruption.

Where backup and recovery services are commissioned, the scope identifies the protected systems, backup frequency, retention period and responsibility for restoration.

Recovery planning considers:

• How much recent information the organisation could tolerate losing.
• How quickly the affected service needs to be restored.
• The infrastructure and suppliers required for recovery.
• The people authorised to make recovery decisions.
• The testing needed to assess the arrangements.

Recovery objectives, testing frequency and any contractual commitments are agreed for the supported environment. Test results and unresolved issues are recorded where testing forms part of the service.

Establish a clear route from detection to action.

Support arrangements identify how incidents are reported, assessed, escalated and communicated.

Prioritisation considers the affected service, business impact and available workarounds. Response responsibilities depend on the agreed coverage and the roles of any external providers.

For significant incidents, the scope may include coordinated updates, preservation of relevant records and a review of corrective actions.

Any personal-data incident procedures and notification responsibilities are defined in the applicable agreements. Your organisation retains the decisions assigned to it under those arrangements.

Make external responsibilities visible.

Digital services may depend on hosting providers, software vendors, payment services and other specialist platforms.

We identify material dependencies within the engagement and clarify the responsibilities assigned to each party. Supplier selection and review consider the information, access and service commitments relevant to the proposed use.

Where Greenovus appoints a delivery supplier, the applicable approval, confidentiality and information-handling requirements are addressed within the engagement arrangements.

Changes to important dependencies are assessed for their effect on cost, continuity and client obligations.

Maintain a clear record of your digital assets.

The engagement defines the treatment of domains, cloud accounts, repositories, designs, data, software licences and supporting documentation.

Where practical, client-owned accounts are used with delegated Greenovus access. Where another arrangement is necessary, access, export and transfer provisions are documented.

Ownership of bespoke deliverables, rights to reusable components and third-party licensing are stated in the contract.

These arrangements give your organisation a clearer basis for overseeing its systems and planning future changes.