Technical and organizational measures in plain English
The abbreviation TOMs stands for “technical and organizational measures” (in German: technische und organisatorische Maßnahmen, or TOM). The term covers everything a company does to ensure that personal data – information about customers, employees, or patients, for example – doesn’t fall into the wrong hands, get altered, or get lost.
An analogy: a jeweler protects their merchandise with a safe, bulletproof glass, and an alarm system. Those are technical measures. On top of that come rules about who may open the safe, who locks up in the evening, and what to do in the event of a robbery. Those are organizational measures. Only the combination of both provides real protection.
In IT, technical measures include firewalls, encryption, backups, and multi-factor authentication. Typical organizational measures are an access rights policy that defines who may access what, training, rules for covering absences, and an emergency plan.
What the GDPR requires
The legal basis is Art. 32 of the General Data Protection Regulation (GDPR). It requires controllers and processors to implement appropriate TOMs to ensure a level of security appropriate to the risk. Among other things, they must take into account the state of the art – meaning proven protective measures available on the market – as well as the costs of implementation and the nature, scope, and purposes of the processing. The regulation gives the following examples:
- the pseudonymization and encryption of personal data – pseudonymization means, for example, replacing names with ID numbers,
- the ability to ensure the ongoing confidentiality, integrity (protection against unauthorized changes), availability, and resilience (ability to withstand disruptions) of systems,
- the ability to restore data quickly after a physical or technical incident,
- a process for regularly testing, assessing, and evaluating the effectiveness of the measures.
The fourth point is often underestimated: it’s not enough to write measures down – you also need to be able to show that they work in practice. Many companies in Germany still structure their TOM documentation according to the control objectives of the previous version of the German Federal Data Protection Act (BDSG), such as physical access control, system access control, and data access control. Further guidance comes from the Standard Data Protection Model (SDM) of the German data protection supervisory authorities and from IT-Grundschutz, the baseline protection methodology of the BSI (Germany’s Federal Office for Information Security).
A practical example
A tax advisory firm has carefully documented its TOMs: access to client data only with multi-factor authentication, daily backups, regular updates. On paper, everything is in order.
A penetration test paints a different picture. An older webmail login requires only a password – MFA doesn’t apply there. The backups are stored on a network drive that every user account can write to. A ransomware attack would therefore have encrypted the backups as well.
The firm shuts down the old login and separates the backups from the rest of the network. A retest confirms that the gaps have been closed. The test report goes into the firm’s data protection documentation – as evidence that the effectiveness of its TOMs has actually been tested.
Why does this matter for businesses?
TOMs are not a formality. The GDPR requires controllers to be able to demonstrate that they comply with its requirements (accountability). If appropriate measures are missing, companies face fines and claims for damages – and after a data breach, often a noticeable loss of trust among customers and partners.
TOMs also play a role in day-to-day business. If you have a service provider process personal data on your behalf, you may only engage providers that can give sufficient assurance that appropriate TOMs are in place. In the data processing agreement (DPA) – known in Germany as an AVV – the service provider commits to the measures required under Art. 32; the TOMs are usually attached as an annex. In addition, the record of processing activities – the overview of which personal data a company processes and for what purposes – should, where possible, include a general description of the TOMs.
What businesses should do now
- Identify which personal data you process and where, and assess the risk to the people concerned.
- Describe your TOMs in concrete, up-to-date terms – instead of using empty phrases such as “data is protected.”
- Define who maintains the TOMs, and update them whenever your IT changes significantly.
- Test their effectiveness regularly – for example, with penetration tests, vulnerability assessments, and restore tests of your backups.
- Document results and remediated deficiencies – this is your evidence for supervisory authorities, customers, and auditors.
- Compare your service providers’ TOMs with your requirements before you sign a DPA.
How Rootsektor can help
As a Germany-based security company, Rootsektor tests whether your technical measures deliver in practice what your documentation promises. As part of our Penetration Testing services, we examine systems, applications, and access points using the methods of real attackers. You receive a report with an executive summary (a concise overview for management), clearly documented findings, and remediation recommendations, plus a free retest after remediation and a test certificate – a solid basis for your evidence under Art. 32 GDPR. You can get a fixed-price quote after scoping via our Pentest Quote page.