Security, audit, and standards: How to protect your data while keeping the benefits of AI

The NIS2 Directive imposes strict security standards starting in 2025 (vulnerability management, asset management, incident management, data protection) for essential companies in supply and distribution chains.

The ISO 27001 standard for information security also requires full control over the trail of all the company’s IT assets.

GDPR requires strict control of personal data storage and imposes rules on its transfer outside the European Union.

Common requirements from the guides for implementing NIS2, ISO 27001 and GDPR: 2FA (two-factor authentication), encrypted IT connections, data segregation, audit and logging, strong access protection (passwords, authentication system).

Google Cloud–based architecture can be configured from the start with these requirements.

Does your data meet these standards? Here’s a frequent 2025 scenario:

In the cloud, security must be protected through keys, access policies, and data segregation. On-premise servers must be protected from ransomware and unauthorized physical access (who has the admin password?).

Join the priority list

The solution: “Fortress-style” architecture

Concentric layers of protection, with your data and secrets in the center:

1. Data isolation: Data lives in a private project (VPC). It is protected with encryption keys with automatic rotation.
2. IAM & SSO: Integration with Active Directory. Revoking an email account also revokes access to quoting.
3. Row-Level Security: The quoting software assigns each salesperson only their own clients and orders.
4. Monitoring, audit, backup: All access and changes are fully auditable to detect unauthorized activity.
5. Ephemeral data: Sales and quoting data is automatically deleted after an interval that allows behavior aggregation but minimizes exposure (for example 6 months).
6. Using an enterprise LLM: Internal use of an enterprise LLM is recommended instead of public free versions, for data residency and no training data use.