Information Security

Where to start: ISMS Overview

Record Type	Document
Policy	Application Security Policy Information Security Policy Physical Security Policy Security Incident Management Policy
Procedure	Endpoint Management Procedure Information Security & Data Privacy Procedure Network Security Procedure Office Security Procedure Security Incident Response Procedure Security Management Procedure Standards of Acceptable Use Procedure User Account Management Procedure
Work Instruction	Business System Account Management WI Business System Patch Management WI CMC Account Management WI Index of Current Security Operations Sub‑Processes Office Badge Management WI Operations Periodic Maintenance WI Privacy by Design WI Security Patching WI Standards of Job Roles and Accounts WI VaultQuality Account Management WI

Veeva is a company devoted to providing software-as-a-service (SaaS) to clients in the life sciences sector who wish to utilize mobile and outsourced cloud-based solutions. Information is a strategic asset of Veeva. Unauthorized or inadvertent alteration, disclosure, or unavailability of information could severely result in damage to Veeva’s business activities and reputation. Moreover, Veeva as a data processor is the custodian of customer information that can be both confidential and sensitive.

Veeva follows a process approach in developing, implementing, and improving upon the effectiveness of its quality system. This approach is based on the “Plan, Do, Check, Act” philosophy. The ISMS program leverages the ISO 9001 framework of the QMS, including risk management, change and configuration management, CAPA, resource management and document management. Veeva’s ISMS program is certified against ISO27001:2013 and Trust Service Principles (SOC2). Veeva’s QMS program is certified against ISO9001:2015.

Penetration Testing

Veeva contracts a third party to perform annual white-box penetration testing.

Summary reports are made available within ComplianceDocs.

Penetration Testing Summaries

Other Useful Documents

Veeva’s Certificates can be found here

Industry Standard Assessments

Knowledge Articles

Choosing the Right SOC

Incident Management Process

Taking GCP Breach Notification Seriously