Skip to content
English
File Service Request Customer portal
Go to Riege Status page
  • There are no suggestions because the search field is empty.

Cybersecurity and Business Continuity Statement

Riege Software is committed to maintaining robust cybersecurity measures to safeguard critical data, operational continuity. Below is an overview of our cybersecurity strategy, which includes adherence to international standards, proactive risk management, and specific actions related to the civil aviation sector.

Security Standards & Certifications

  • An Information Security Management System is applied which is certified under ISO/IEC 27001.

  • Regular audits and assessments to maintain cybersecurity posture.

  • Compliance with EU Implementing Regulation (EU) 2015/1998 for civil aviation security.

Cybersecurity Measures for Critical Systems

  • Patch Management: Regular patch cycles and security patch strategy for systems, especially using central tools to monitor status and actions.

  • Central tools for continuous system and application risk analysis.

  • Firmware and platform patches using a managed service.

  • Next-Generation Firewalls in data centers with threat protection

  • Least-privilege access policies

  • Additionally, local system firewalls and further security measures.

  • Two-Factor Authentication (2FA) for access to critical systems (e.g., Scope application).

  • Secure reverse proxy with transport encryption in front of critical systems.

Backup and Recovery Strategies

  • Backup Strategy:

    • Incremental backups daily, differential backups weekly, and full backups monthly.

    • Backup data is stored both on-site and off-site (LTO tapes stored securely for 10 years).

    • Database backups (Percona XtraBackup for MySQL) with 3 replication copies for additional security.

  • Restore Tests: Annual restore tests (often more frequent) to validate backup integrity and recovery capabilities.

  • Backup Monitoring: Real-time Grafana Dashboard for monitoring backup status, with alerts triggered for failed backups.

Incident Management & Business Continuity

  • Incident Response & Business Continuity Plans:

    • Emergency handbook and documented incident response procedures.

    • Disaster Recovery Plan in place.

    • Redundant data centers in three different zones and failover mechanisms ensure availability during incidents.

    • Incident Response Plan (IRP) to ensure quick and effective response to incidents.

Access Control & Cybersecurity Enforcement

  • Access Control:

    • Scope system access restricted by username/password and 2FA as an additional security measure.

    • Role-based permissions tailored to user needs (e.g. for airfreight information)

    • Permissions management is controlled by customer administrators or authorized company personnel.

  • Administrator Access: Administrators must work within a defined framework and are only granted permissions upon explicit instructions from authorized parties.

Cybersecurity Measures Against Cyberattacks

  • Cyberattack Detection:

    • Use of central tools for proactive monitoring of vulnerabilities and risks.

    • Next-Generation Firewalls combined with continuous system monitoring.

    • Central logging and alerting.

  • Cyberattack Response & Recovery:

    • Use of automated recovery tools to recreate systems.

    • Incremental and full back up strategies ensure rapid recovery from incidents.

    • Incident response procedures are well-documented, ensuring quick action during security incidents.

Secure development and deployment

  • 4-eyes-principle during software development.

  • Dependency and patch management defined central tools.

  • Secure CI / CD pipeline within a defined product lifecycle.

  • Regular updates of Scope systems.

  • Secure development guideline.

Supplier & Third-Party Management

  • We conduct through supplier assessments to ensure that external partners meet our requirements.

  • Supplier contracts may include specific cybersecurity requirements to ensure third-party compliance, in particular with data protection policies.

Cybersecurity Training & Awareness

  • Ongoing ISMS and data protection awareness trainings for all employees to raise awareness about cyber risks and regular security to ensure our staff is well-prepared for emerging threats, as phishing and social engineering.

Incident Reporting & Transparency

  • We use a Status Page for real-time updates and communication with stakeholders regarding incidents.

  • Clear reporting procedures ensure that incidents are promptly identified, investigated, and addressed.

Ongoing Improvements & Cybersecurity Initiatives

  • New data center in May 2025, with enhanced availability and improved defenses against DDoS attacks.

  • Continuous cybersecurity improvements and technology updates to stay ahead of evolving threats.

  • Ongoing improvements within the Information System Management System (ISMS)