Hansen provides software to energy, utility, and communications providers who are accountable to strict regulators for the data our systems hold. Our security programme is built with that accountability in mind.
Security is risk-based and delivered through a documented Information Security Management System aligned to ISO/IEC 27001:2022 and the NIST Cybersecurity Framework.
Hansen Trust Centres
Governance
Security is owned within a defined governance structure, not left to individual teams.
- Board-level oversight, supported by risk and security committees with defined remits.
- A policy and standards framework approved by senior management, issued to all personnel, and reviewed annually.
- Accountability assigned to managers for their teams and to every individual for reporting incidents.
- Security training for all personnel; additional privacy training where customer or personal data is handled.
Access control
Access is granted narrowly, attributed to a named individual, and reviewed continuously.
- Need-to-know and need-to-use provisioning: the access a role requires, and no more.
- Unique user IDs, so authentication and audit activity is attributable rather than shared.
- Privileged access restricted by job function, controlled, and reviewed on a regular cycle.
- Multi-factor authentication on all remote access.
- Access to customer data limited to the explicit performance of duties, and logged and monitored.
Data protection
Information is protected in proportion to its sensitivity, from transmission through to disposal.
- Data classified and handled according to sensitivity and business context.
- Strong encryption for sensitive information in transit over public networks.
- Hardware-level encryption on end-user laptops and customer hosting infrastructure.
- Cryptographic controls implemented under formal approval and in line with industry good practice.
- Facilities, server rooms, and network infrastructure access-controlled, with environmental and perimeter protection for critical equipment.
- Controlled disposal of equipment and media to prevent recovery of sensitive data.
Secure development
Hansen builds the software it operates, so product and operational security are managed together.
- Source code protected against unauthorised functionality, unintended change, and disclosure.
- Development to Hansen Delivery Standards and Secure Coding Guidelines.
- Formal change control: risk assessment, testing, approval, controlled implementation, and retained audit trails.
Operational resilience
We assume disruption will occur and build to detect, contain, and recover.
- Malware prevention, detection, and recovery controls.
- Business continuity and disaster recovery plans tested in line with your business appetite.
- Backups held in separate availability zones or data centres.
- Capacity monitored across production, supporting infrastructure, and cloud workloads.
- A maintained Security Incident Response Plan defining responsibilities, communication protocols, and escalation.
- Actual, suspected, or potential breaches reported as soon as practicable under that plan.
Assurance
Controls are verified rather than assumed, and the same expectation extends to our suppliers.
- Annual internal audit against a risk-based audit plan.
- Independent audits and certification assessments.
- Technical compliance reviews and penetration testing of Hansen networks and products.
- Suppliers managed under a Third Party Security Standard and assessed before engagement.
- Security requirements written into supplier agreements and monitored on an ongoing basis.