Are you ISO 27001 certified?
We run a certifiable ISMS and supply the current certificate plus SoA mapping (Statement of Applicability) on request. We operate in a DACH-specific audit reality — TÜV, DQS and BSI are the typical certifiers our customers recognise.
How do you specifically support our DORA audit?
DORA Art. 28 requires a written contract with documented SLAs, a full sub-outsourcing register, annual resilience tests and an exit strategy. We deliver the DORA-compliant contract template, the quarterly resilience report and run an annual switch-over drill — verifiable to any TLPT auditor.
What do I receive automatically each quarter?
Standard compliance pack: SLA performance report, audit trail of all engineer access, incident logs, sub-outsourcing status. On agreement we extend with spare-parts chain-of-custody, engineer certification register and crisis-test protocol.
Who has access to our hardware data — and how is that audited?
On-site interventions are handled by a defined engineer pool, each with signed NDA. Every access runs through a ticket with audit trail (who, when, which system, which action). Data carriers never leave the site without documented data erase or sealed security container.
What happens during a security incident — e.g. a defective spare part with potential data remnants?
Immediate escalation to our compliance officer (within 4h). Initial notification to you within 24h, deeper report within 72h — exactly per NIS2/DORA deadline. Defective data carriers are destroyed on-site (BSI-compliant wipe or physical destruction) and never returned without a documented erase certificate.
Can we run a background check on TechCare engineers?
Yes. For TISAX level-3 sites or KRITIS security areas, background checks are standard, performed by certified providers (Bundesdruckerei, Schufa-Wirtschaftsdienst). On request we provide the signed confirmation per assigned engineer.
How does your compliance documentation differ from the OEM standard?
Three points: (1) We have a dedicated compliance officer, OEM maintenance typically runs via international service hubs with no EU compliance focus. (2) We deliver reports in German, audit-ready for DACH auditors. (3) Sub-outsourcing transparency: with OEMs the engineer chain is often three tiers deep (OEM → continental partner → local sub) and opaque — with us it's one to two tiers and contractually documented.
Do I need a separate contract for KRITIS or NIS2?
No. The standard maintenance contract already includes NIS2/KRITIS-relevant clauses (incident-response deadlines, sub-outsourcing transparency, engineer certifications). During onboarding we add the KRITIS-specific appendices (e.g. B3S hospital mapping, BSI wipe standard) at no extra cost.
What sub-outsourcing transparency do you offer?
Complete list of all engineer pools (full-time staff and contractors), spare-parts distributors with locations, plus specialised disposal partners (R2v3-certified). Updated annually plus on every change in the standard appendix. No hidden tier-3 — we name names.
Who is my compliance contact at TechCare?
Per contract a dedicated service-delivery manager as operational contact and the compliance officer as escalation instance for audit topics. Direct line, no hotline maze. Both speak German and understand DACH compliance vocabulary (BAIT, MaRisk, BSI, BaFin, NIS2).
