Compliance & FINMA
FINMA compliance is not a project. It is a permanent condition.
Least privilege is not a recommendation. It is a requirement for FINMA-regulated institutions.
The principle of minimum authorization means that each user receives exactly the rights they need for their task, and no more. Privileged access such as admin rights are not assigned permanently, but are only activated via Privileged Identity Management (PIM) on request, for a limited time and with a complete audit trail.
The same applies to external service providers, including us at Dinotronic: access to your environment is exclusively via GDAP (Granular Delegated Admin Privileges), role-based, time-limited and logged. You can see who has accessed what and when at any time.
This structure is not an additional measure for the audit, but the normal mode of operation. What is operated in this way on a daily basis can also be verified on a daily basis.
A security incident is not the problem. Not dealing with it in a documented way is.
FINMA expects security incidents to be recognized, reported and processed. This requires three things: complete logging of all security-relevant events, a defined incident response procedure and the ability to reconstruct exactly what happened afterwards.
Microsoft Sentinel takes over the central logging and correlation of events from all connected systems: Identities, end devices, cloud services, network. Anomalies are automatically detected and prioritized. Our security team evaluates these signals 24/7 and initiates the incident response process if necessary.
Every incident is documented in writing: Time, affected systems, impact, measures, conclusion. This documentation is stored in an audit-proof manner and is available for audits on request. Not compiled when the audit comes, but kept on an ongoing basis.
Who opened, changed or passed on which file and when?
Supervised institutions are responsible for the security of their data, even if it is held by an external provider. FINMA Circular 2023/1 is explicit: outsourcing does not release institutions from their responsibility. The service provider must meet the requirements and the institution must be able to prove this.
As an ISO 27001-certified Microsoft Solutions Partner, we structurally fulfill these requirements. Our certification is not a one-off, but is confirmed annually by an independent audit. Microsoft Azure and Microsoft 365 operate under a joint responsibility model that clearly defines which security responsibilities lie with Microsoft and which with us.
On request, we can provide you with the necessary evidence for your own supplier management: ISO certificate, processing directory, subcontractor overview and other documents to complete your compliance documentation.
Think of everything right from the start with the Managed Workplace
Our expertise
30 years of experience
IT is changing rapidly. We have kept up with all the developments to date and have important certifications. We are constantly educating ourselves so that our customers don't have to.
High performance standards
Good is not good enough for us, safe is not safe enough for us. We go the extra mile for our customers so that they can work in an environment that suits them.
We are nocturnal
Cyberattacks know no working hours. That's why we work in two time zones and are also active at night for our customers.
From SMEs for SMEs
As a Swiss SME, we know the challenges, but also the importance of SMEs for the Swiss economy.
We want to inspire customers
We support customer projects and future visions with state-of-the-art technologies.
High recommendation rate
90% of our customers recommend us (without being asked).
90% of our customers recommend us to others. Will you be one of them?
“The cooperation with Dinotronic was excellent from the first contact to the end of the project and I can wholeheartedly recommend the product to any company of any size.”
.jpg?width=300&name=2019_EULAR_JULIA%20RAUTENSTRAUCH_29i%20(1).jpg)
90% of our customers recommend us to others. Will you be one of them?
“The cooperation with Dinotronic was excellent from the first contact to the end of the project and I can wholeheartedly recommend the product to any company of any size.”
