Information Security

Where to start: ISMS Overview

Record Type	Document
Policy	Information Security Policy Application Security Policy Physical Security Policy Security Incident Management Policy
Procedure	Information Security & Data Privacy Procedure Security Incident Response Procedure Standards of Acceptable Use Procedure Network Security Procedure Endpoint Management Procedure User Account Management Procedure Office Security Procedure Security Team Procedure
Work Instruction	Index of Current Security Operations Sub‑Processes Security Patching WI Standards of Job Roles and Accounts WI Operations Periodic Maintenance WI Business System Account Management WI VaultQuality Account Management WI CMC Account Management WI Business System Patch Management WI Office Badge Management WI

Veeva is a company devoted to providing software-as-a-service (SaaS) to clients in the life sciences sector who wish to utilize mobile and outsourced cloud-based solutions. Information is a strategic asset of Veeva. Unauthorized or inadvertent alteration, disclosure, or unavailability of information could severely result in damage to Veeva’s business activities and reputation. Moreover, Veeva as a data processor is the custodian of customer information that can be both confidential and sensitive.

Veeva follows a process approach in developing, implementing, and improving upon the effectiveness of its quality system. This approach is based on the “Plan, Do, Check, Act” philosophy. The ISMS program leverages the ISO 9001 framework of the QMS, including risk management, change and configuration management, CAPA, resource management and document management. Veeva’s ISMS program is certified against ISO27001:2013 and Trust Service Principles (SOC2). Veeva’s QMS program is certified against ISO9001:2015.

Penetration Testing

Veeva contracts a third party to perform annual white-box penetration testing.

Summary reports are made available within ComplianceDocs.

Penetration Testing Summaries

Other Useful Documents

Veeva’s Certificates can be found here

Industry Standard Assessments

Knowledge Articles

Choosing the Right SOC