Resource Library

Since 2005 the entire Fabasoft company has been ISO 9001 certified.

Once a year our quality management is audited and certified by a leading certification body. The aims of the audit are to examine the conformity with demand models and the identifying of potential for the further development of the quality management system.

Fabasoft successfully passed the ISO 9001:2015 monitoring audit conducted by TÜV AUSTRIA CERT GmbH in October 2021.

Continuous Improvement

The quality management system at Fabasoft is a living system. This means that work methods, processes and their corresponding documentation are continuously adapted to the new data and constantly undergoing improvements.

All Fabasoft business-relevant processes are depicted in the form of graphic process diagrams in the process landscape in the internal system. The further development, checking and approval of these processes is the responsibility of the process owner and is defined for every process.

Focus on Customer Orientation

A strategic aim of Fabasoft lies in a strong customer orientation of the quality management system. At Fabasoft customer satisfaction is of the highest importance. Fabasoft customers have the opportunity to share their opinions and improvement suggestions with us. In regular meetings (User Group) customers can give their feedback directly to the Fabasoft employee in charge. The results and evaluations of customer surveys are analyzed and integrated into the improvement processes to ensure that the customer demands are met.

Scope

Development and sales of own software produces, cloud services, Software-as-a-Service applications, appliances and provision of related services.

Certified subsidiaries

• Fabasoft International Services GmbH
  AT-4020 Linz, Honauerstrasse 4
  AT-1100 Vienna, Laxenburger Strasse 2
• Fabasoft Austria GmbH
  AT-4020 Linz, Honauerstrasse 4
  AT-1100 Vienna, Laxenburger Strasse 2
• Fabasoft R&D GmbH
  AT-4020 Linz, Honauerstrasse 4
  AT-1100 Vienna, Laxenburger Strasse 2
• Mindbreeze GmbH
  AT-4020 Linz, Honauerstrasse 2
  AT-1100 Vienna, Laxenburger Strasse 2
• Fabasoft Deutschland GmbH
  DE-60549 Frankfurt/Main, THE SQUAIRE 13, Am Flughafen
  DE-10117 Berlin, Leipziger Platz 8
  DE-80539 Munich, Maximilianstrasse 40
  DE-99084 Erfurt, Bahnhofstraße 38
• Xpublisher GmbH
  DE-80333 Munich, Schleißheimer Strasse 6-10
  DE-94469 Deggendorf, Ulrichsberger Straße 17, Haus G1
• Fabasoft Schweiz AG
  CH-3011 Bern, Spitalgasse 36
• Mindbreeze Corporation
  US-Chicago, IL 60606, 311 West Monroe Street, Suite 303
• Xpublisher Inc.
  US-Chicago, IL 60606, 311 W Monroe Street, Convene, 3rd floor

In June 2008 Fabasoft received the ISO 27001 certificate for the first time. The standard is a globally recognized standard for the assessment of the security of IT environments.

In July 2015 Fabasoft was audited successfully and gained also certification under ISO 27018. This international standard was published in 2014 and specifies data protection requirements for cloud service providers. 

Clearly Defined Standards

The certification's range of validity specifies the requirements for fully comprehensive information security management concerning all IT and business processes as well as all confidential company information. For customers, the ISO 27001 certification means compliance with clearly defined technical and security based standards and thereby defined service levels for the data centers.

The international standard ISO 27018 defines data protection requirements for cloud service providers. They have to undertake major obligations regarding notification, information, transparency and burden of proof in order to build trust with clients and public institutions concerning the processing of personal data within the cloud.

Continual Adaptation

Periodical internal controlling of the processes and provisions detailed in the ISO 27001 incl. the ISO 27018 is the basis for the further development of internal IT security standards and the continual adaptation according to changing frameworks and tasks.

Fabasoft successfully passed the ISO 27001:2013 monitoring audit (including ISO 27018:2020) conducted by TÜV AUSTRIA CERT GmbH in October 2021.

Scope

Development and sales of own software produces, cloud services, Software-as-a-Service applications, appliances and provision of related services.

Certified subsidiaries

• Fabasoft International Services GmbH
  AT-4020 Linz, Honauerstrasse 4
  AT-1100 Vienna, Laxenburger Strasse 2
• Fabasoft Austria GmbH
  AT-4020 Linz, Honauerstrasse 4
  AT-1100 Vienna, Laxenburger Strasse 2
• Fabasoft R&D GmbH
  AT-4020 Linz, Honauerstrasse 4
  AT-1100 Vienna, Laxenburger Strasse 2
• Fabasoft Deutschland GmbH
  DE-60549 Frankfurt/Main, THE SQUAIRE 13, Am Flughafen
  DE-10117 Berlin, Leipziger Platz 8
  DE-80539 Munich, Maximilianstrasse 40
  DE-99084 Erfurt, Bahnhofstraße 38
• Fabasoft Schweiz AG
  CH-3011 Bern, Spitalgasse 36
• Mindbreeze GmbH
  AT-4020 Linz, Honauerstrasse 2
  AT-1100 Vienna, Laxenburger Strasse 2
• Mindbreeze Corporation
  311 West Monroe Street, Suite 303 Chicago, Illinois, 60606, US

In May 2011 Fabasoft received the ISO 20000 certificate for the IT services Folio Cloud (today: Fabasoft Cloud) and Folio SaaS for the first time. The scope was subsequently expanded to include Mindbreeze InSpire SaaS. The ISO 20000-1 standard is an internationally recognized standard for IT service management systems which documents the requirements for professional IT service management.

Implementation of International Standards

With this certification, Fabasoft underlines its strategy of implementing international standards.

ISO 20000-1 serves as a measurable quality standard for IT Service Management (ITSM). The aim of ISO 20000 is to deliver a higher quality of IT services to customers. Alignment according to the needs and requirements of customers plays a primary role.

ITIL orientation in IT Service Management

The standard also serves as an instrument to model processes in an optimized management system as they are described in the Office Government Commerce (OGC)’s IT Infrastructure Library (ITIL). This encompasses such core processes as change, release, incident, problem and security management.

The certification brings with it many advantages. Alongside the targeted improvement of processes through regulated structures, service level maintenance, customer satisfaction and availability of services are more easily measurable by means of key performance indicators.

Fabasoft successfully passed the ISO 20000-1:2018 monitoring audit conducted by TÜV AUSTRIA CERT GmbH in October 2021.

Scope

The IT Service Management System of Fabasoft supporting the provision of Fabasoft Cloud, Fabasoft Folio SaaS and Mindbreeze InSpire SaaS to internal and external customers.

Certified subsidiaries

• Fabasoft International Services GmbH
  AT-4020 Linz, Honauerstrasse 4
  AT-1100 Vienna, Laxenburger Strasse 2
• Fabasoft Austria GmbH
  AT-4020 Linz, Honauerstrasse 4
  AT-1100 Vienna, Laxenburger Strasse 2
• Fabasoft R&D GmbH
  AT-4020 Linz, Honauerstrasse 4
  AT-1100 Vienna, Laxenburger Strasse 2
• Fabasoft Deutschland GmbH
  DE-60549 Frankfurt/Main, THE SQUAIRE 13, Am Flughafen
  DE-10117 Berlin, Leipziger Platz 8
  DE-80539 Munich, Maximilianstrasse 40
  DE-99084 Erfurt, Bahnhofstraße 38
• Fabasoft Schweiz AG
  CH-3011 Bern, Spitalgasse 36
• Mindbreeze GmbH
  AT-4020 Linz, Honauerstrasse 2
  AT-1100 Vienna, Laxenburger Strasse 2
• Mindbreeze Corporation
  311 West Monroe Street, Suite 303 Chicago, Illinois, 60606 USA

Fabasoft is the first company in the world to reach the third and highest compliance level (Level 3) of the new EU Cloud Code of Conduct. The EU Cloud Code of Conduct (CoC) is a comprehensive code of conduct for the European cloud industry and gives top priority to consistently uniform enforcement of European data protection standards based on the General Data Protection Regulation (GDPR).

The EU Cloud Code of Conduct – in a nutshell

• Covers the full spectrum of cloud services: software (SaaS) and platform (PaaS) as well as infrastructure (IaaS).
• Has an independent governance structure to deal with compliance as well as an independent monitoring body, SCOPE Europe, which scrutinizes cloud services which sign up to the Code and monitors services that are certified in the Code – a requirement of GDPR.
• Invites Cloud Service Providers of all sizes and from all cloud sectors to join: there are different membership options, depending on CSP’s interests. Once a member, CSP’s can declare Cloud Services adherent to the Code, committing to rigorous data protection safeguards
• Is the only Code drafted together with authorities of the European Union: the Code was developed by the Cloud Select Industry Group (Data Protection Code of Conduct Subgroup) convened by the European Commission under the auspices of DG Connect and with the involvement and advice of DG Justice. Development of the Code was further informed by input from the Article 29 Working Party.

The EU Cloud CoC has emerged over the past eight years as part of a unique collaboration between EU authorities and the European platform industry. From the outset, Fabasoft assumed an active role, contributing significantly to the success of this initiative.

View certificate

View public register of the EU Cloud of Conduct

* EU Cloud CoC Verification-ID: 2021LVL03SCOPE016

Fabasoft was 2017 the first European provider of cloud services to receive the attestation pursuant to the requirements of the catalog of requirements C5 (Cloud Computing Compliance Criteria Catalog, in short: C5), issued by the Federal Office for Information Security (BSI). The C5 attestation pursuant to the requirements of the BSI is a recognized and reliable proof which transparently reveals the high level of information security of the Fabasoft Cloud for all Fabasoft Cloud customers. Until 2020 the KPMG Alpen-Treuhand GmbH Wirtschaftsprüfungs- und Steuerberatungsgesellschaft issued the attestation.

Following the initial audit in accordance with BSI Standard C5:2020 at the beginning of 2021, this audit was carried out again at the beginning of 2022 by PricewaterhouseCoopers GmbH Wirtschaftsprüfungsgesellschaft, Germany, on behalf of Fabasoft.

The catalogue of requirements of the BSI specifies the minimum requirements that cloud service providers must meet. The information on the general conditions of the cloud service serves to provide customers with additional information on the level of information security offered by Fabasoft and ensures transparency with regard to information on jurisdiction and locations, availability and incident handling during regular operation, recovery parameters in emergency operation, availability of the data center, how investigation enquiries from government authorities are handled and certifications or attestations.

The International Standard on Assurance Engagements (ISAE 3402) is the international testing standard that assesses the effectiveness of internal control systems (IKS) of service providing organizations. The standard was created by the International Auditing and Assurance Standards Board (IAASB) as a successor to the SAS 70 Standard. Up until 2011 Fabasoft was tested according to the AICPA´s reporting standard SAS 70 Type 2, afterwards according to ISAE.

ISAE 3402 aims to extensively test an organization's internal control system and to rate its effectiveness in detail. The testing takes place over a twelve month period. The ISAE 3402 test report contains the opinion of an external test company on the control procedure at the service provider, a description of the control points, the test methods and controls, information about the test period and a statement about the effectiveness of the controls.

Fabasoft completed the SOC2  audit for its Fabasoft Cloud, marketed under the name Fabasoft Business Process Cloud since the beginning of 2020. PricewaterhouseCoopers GmbH Wirtschaftsprüfungsgesellschaft, Germany, issued the audit report.

As part of the audit process, PwC checked whether the Trust Services Criteria (TSC) for Security – issued by the American Institute of Certified Public Accountants (AICPA) – are being adhered to. Therefore, the existing internal control mechanisms for the services offered – for example with regard to risk minimization, access controls, monitoring measures or communication – were examined and documented. The audit took the form of an ISAE 3000  audit (checking the control implementation within a defined test period). Fabasoft received the final audit results as an ISAE 3000 SOC2  report.

TÜV Rheinland i-sec GmbH certification body certifies that Fabasoft R&D GmbH has achieved the following objectives for the Fabasoft Cloud, Fabasoft Folio SaaS, HeadsUp! User Engagement, and Mindbreeze InSite services for the cloud infrastructure and cloud application:

• Effectiveness in selecting the data location
• Secure hosting of data
• Secure data transmission
• Secure operation of business-critical applications
• Quality and availability of service provision – high service continuity, high on-demand scalability
• Security and quality of data access and data storage – secure login procedure, and authorization systems to control data access at network level
• State-of-the-art protection against attacks

Proof was provided on site in the form of random external and internal security analyses as well as an audit of the technical, physical as well as organizational security measures, and business processes. The test report 63007063-01 forms part of this certificate.

TÜV Rheinland i-sec GmbH tests the effectiveness of the assessed process through annual monitoring audits.

For more information please click here.

KPMG Advisory GmbH reviewed the Fabasoft Cloud in terms of revision security in accordance with Austrian, German and Swiss commercial and tax law, and issued the certificate according to IDW PS 880. The Fabasoft Cloud therefore meets the required storage requirements in Germany, Austria and Switzerland (GoB compliant archiving) .
 
The safe and proper storage of digital data has not only become a key compliance requirement but also an existential challenge for companies. Stronger interconnectedness and current legislative changes, such as the EU Data Protection Basic Regulation, exacerbate this requirement.
 
In the case of the IDW PS 880 examination, an independent auditor determines whether and to what extent software solutions support the storage regulations in accordance with the applicable trade and tax law (audit-proof or GoB-compliant archiving) of the respective country in order to meet the required compliance.

MoReq stands for Model Requirements for the Management of Electronic Records and is geared towards standardizing the creation and storage of business documents in digital form. The MoReq1 project was therefore started in Europe in 2001 to establish a uniform standard for business records management software. Because of the pace of technical development, MoReq1 soon became outdated and thus it was decided to start MoReq2.

MoReq2 is today the most important specification for electronic document and record management in Europe. The European standard specifies requirements for written material administration, document and records management as well as for electronic archiving. The current version of MoReq2 was published on February 13, 2008, complete with a certification process for software products. In order to be able to call itself "MoReq2 certified", a software product must undergo an extensive testing process.

In December 2008 Imbus AG were assigned as the first official accreditation board for MoReq2 to carry out the tests and examinations as an independent institute.

The standard is the benchmark for all users who systematically manage and store electronic and paper information. Jef Schram from the European Commission in Brussels on the motives behind the standard: "MoReq2 offers an extensive specification of requirements for the management of electronic records and business processes across the whole of Europe." MoReq2 is intended for users from the private and public sectors, for manufacturers and consultants, as well as for associations and eductional organizations.

Equal opportunities for people with disabilities and their integration into society and work require the accessible use of software, which is also defined by law.

The user interface of the Fabasoft Public Cloud is not only easy and intuitive to use but is also  available in 22 different languages. Moreover, it is almost 100% accessible and offers equal opportunities for people with impairments, as the certificate “very accessible” granted by Pfennigparade Center for Accessibility on the Internet in January 2015 attests. 

The Fabasoft eGov-Suite is offering accessibility for almost all kinds of disabilities. In September 2013, Pfennigparade tested the web application Fabasoft eGov-Suite 2013 for accessibility. The practical accessibility of the application corresponds to an overall result of 93.5 points of a BITV test. The Fabasoft eGov-Suite 2013 is therefore “very accessible”.

The Web Accessibility Certificate (WACA) is Austria's first quality seal promoting accessible websites according to the international W3C guidelines (Web Content Accessibility Guidelines). The official certificate issued by TÜV Austria as an independent certification body, is intended to guarantee accessibility for all people on the audited website/application. The certificate awards the efforts made to ensure accessibility on the web and fulfils legal requirements.

The Fabasoft Cloud is the first web application to be WACA-certified and re-certified by TÜV Austria in 2022. The web-based application meets the requirements of WCAG 2.1 – AA to a high degree and was awarded silver. With this application, no users are excluded and everyone can use this web app optimally.

The following criteria must be met for the Web Accessibility Certificate (WACA) in silver:

• Website/application largely complies with WCAG 2.1 – AA success criteria.
• All content is accessible to all users.
• The basic functionality is fully accessible to all users.
• Parts of the extended/optional functionality are cumbersome for some users, yet still accessible.

Ö-Cloud is an initiative of the BMWD (Federal Ministry for Digital and Economic Affairs) that promotes secure cloud-based data management and data use in Austria and Europe. In connection with the quality seal, cloud service providers undertake to adhere to rigorous, transparent European security standards including compliance with the GDPR. These standards and services not only benefit Austrian companies and their data assets, they also serve to bolster Austria’s position as a digital data center in Europe.

The quality seal for the Fabasoft Business Process Cloud provides companies with the assurance that their data will remain in Europe and that deleted data will be irretrievably erased.

The German Association for Supply Chain Management, Procurement and Logistics (BME) has awarded Fabasoft Approve, a cloud-based product for technical data and document management, its “BMEnet Seal of Quality for Supplier Relationship Management.”

BMEnet’s seal of quality is awarded exclusively to software products and electronic platforms that play a role in helping to optimize the areas of procurement and logistics. The audit is based on criteria catalogs that specify BME’s predefined requirements for procurement solutions. Supplier management, sourcing, and desktop purchasing are among the relevant test criteria. The award provides both procurement managers and users the assurance that they are purchasing software with tested and verified quality standards. Fabasoft Approve fulfills every one of the 126 mandatory test criteria together with 31 of the 32 optional test criteria.

The German Association for Supply Chain Management, Procurement, and Logistics (BME) has presented AI-based contract management software Fabasoft Contracts with the “Contract Management” BMEnet seal of quality.

Only software products and electronic platforms that promote optimization in the areas of procurement and logistics can be considered as candidates for the quality seal. The audit is conducted against a set of criteria defined by the BME that are designed to make the market for software solutions more transparent. The requirements range from the ability to populate the digital file using drag-and-drop to contract categorization and clause management, full-text search, and revision-secure storage for different types of documents. This ensures that both decision-makers and users abide by audited quality standards.

Fabasoft was the very first cloud provider to receive the Cyber Trust Austria Gold Label. This Austrian seal of quality for cybersecurity is based on the Cyber Risk Scheme developed by KSÖ (Kompetenzzentrum Sicheres Österreich). As part of an external audit, Fabasoft provided proof that the company fulfills the fourteen basic security criteria as well as the eleven additional criteria that define the stringent level required to demonstrate proof of advanced security.

In cooperation with the Federal Ministry of the Interior, a panel of security experts jointly devised the KSÖ Cyber Risk Rating, which also complies with the provisions of the Law on Network and Information System Security (Netz- und Informationssystemsicherheitsgesetz, “NISG”). The rating evaluates companies with regard to how effectively they implement core requirements in the area of cyber security.