DMS security: protect, trace and securely manage documents with enaio
DMS security means that a document management system safeguards the confidentiality, integrity, availability and traceability of all documents: with a permission concept, encryption, complete logging, audit-proof storage and verified backup.
AWP Consult has implemented these building blocks as a certified enaio partner since 2006: in your own data centre or in the enaio Cloud from Germany, complemented by its own encryption solution CipherMate for highly confidential documents.
Protection layers of a documentSample view
Operation and backup
Roles and permissions
Log of every action
Encrypted with AES-256
Confidential documentstored audit-proof, versioned
Security objectives met
confidential
intact
available
traceable
250+
completed projects since 2006
150+
reference customers in the DACH region
12 to 18
months average payback
Key facts at a glance
- DMS security is the sum of technical and organisational measures through which a document management system achieves the security objectives of confidentiality, integrity, availability and traceability for every stored document.
- Art. 32(1) of the General Data Protection Regulation (GDPR) explicitly names encryption, ensuring the ongoing confidentiality, integrity, availability and resilience, rapid restoration after an incident and the regular review of the measures.
- Under the German GoBD (principles for proper electronic bookkeeping; BMF letter of 28 November 2019, para. 103 and 104), the IT system must be protected against loss and, through access and authorisation controls, against unauthorised changes. If records cannot be produced as a result, the bookkeeping is no longer formally compliant.
- The German NIS2 Implementation Act has applied since 6 December 2025. Under Section 30 of the German BSI Act (BSIG), affected entities must implement and document measures including backup management, cryptography concepts, access control and multi-factor authentication.
- CipherMate from AWP Consult encrypts files with AES-256 and the group and user keys with RSA-4096. Only authorised users can decrypt, and administration is secured by the four-eyes principle.
- In the enaio Cloud, AWP Consult runs enaio exclusively in German, ISO 27001 certified data centres, with backups several times a day at geographically separate locations and a data processing agreement under Art. 28 GDPR.
Sounds right for your company? Let's talk.
What does DMS security mean?
DMS security means that a document management system permanently meets four security objectives: only authorised people see a document, nobody changes it unnoticed, it is available when needed and every action on it is traceable. This is achieved through the interplay of permissions, encryption, logging, unalterable storage, backup and well-maintained operations. A single feature such as encryption does not make a system secure.
Information security asks whether data is protected against loss, manipulation and unauthorised access. Data protection and tax law also ask whether personal data is processed only for its intended purpose and whether tax-relevant records remain unchanged for the entire retention period. Secure document management answers both with the same mechanisms.
Confidentiality
Documents can only be read by people who need them for their work. This is governed by roles, permissions and, where required, document-level encryption.
Integrity
Content and metadata are not changed unnoticed. Versioning and audit-proof storage preserve the original state.
Availability
Documents can be found and read, even after a technical incident. Backup, recovery and stable operations make sure of this.
Traceability
Who opened, changed, exported or deleted what, and when? The log answers this question completely and reliably.
Where does your DMS stand on the four security objectives?
In the security check, we review with you how your enaio environment currently safeguards confidentiality, integrity, availability and traceability.
What are the building blocks of data security in a DMS?
Data security in a DMS consists of six building blocks that build on each other: permissions, encryption, logging, audit-proof storage, backup, and hosting and operations. If one of them is missing, it leaves a gap that the others cannot close. An encrypted archive without a tested backup is just as lost after an outage as an unencrypted one.
Permissions
Finely graded permissions define who may view, edit, export or delete documents, for example by role, department or project.
Typical mistakes in permission conceptsEncryption
Encryption covers the transport route, storage and, where protection needs are high, the individual document, so that even administrators cannot read the content.
CipherMateLogging
Every action, every document version and every processing step is recorded with user and timestamp and can be audited later.
What an auditor looks for in the logAudit-proof storage
Archived documents remain unchanged, every change creates a new version, and retention periods are monitored.
Audit-proof, properly understoodBackup
Regular backups at separate locations and practised recovery keep documents available even after an incident.
Hosting and operations
Operation in your own data centre or in the enaio Cloud from Germany, with updates, monitoring and dedicated support contacts.
enaio Cloud HostingWhich threats does secure document management protect against?
Secure document management mainly protects against six threats: unauthorised viewing, gradual permission creep, manipulation of documents, data loss through hardware failure or malware, misuse of privileged accounts and uncontrolled leakage of documents. The overview assigns a measure, security objective and basis to each threat.
| Threat | Measure in the DMS | Security objective | Basis |
|---|---|---|---|
| Unauthorised viewing | Role and document type based permissions, encryption of confidential documents | Confidentiality | Art. 32 GDPR, ORP.4 |
| Permissions grow with every role change | Recertification at fixed intervals, revocation on exit via the leading system | Confidentiality | ORP.4 |
| Manipulation of documents | Versioning, unalterable storage, log of every change | Integrity | GoBD para. 58 to 60 and 110 |
| Data loss and malware | Separate, protected backups and tested recovery | Availability | Art. 32(1)(c) GDPR, CON.3 |
| Misuse of admin rights | Separation of system and content rights, four-eyes principle, document-level encryption | Confidentiality, integrity | CON.1, OPS.1.1.2 |
| Uncontrolled leakage | Export as a separate right, defined interfaces, log of every export | Traceability | GoBD para. 103, OPS.1.1.5 |
Codes such as ORP.4 or CON.3 refer to modules of the BSI IT-Grundschutz Compendium (German baseline IT protection), 2023 edition.
How does DMS security work in day-to-day operations?
In day-to-day operations, DMS security works through six mechanisms that interact with every access: a permission concept based on the need-to-know principle, encryption on three levels, protected logging, unalterable storage, verified backup and well-maintained operations with updates.
01
Permission concept in the DMS
A permission concept in a DMS describes which role may use which document types and in what way. It follows two principles: need-to-know, meaning access only to what a task requires, and least privilege, meaning as few rights as possible. In enaio, permissions can be finely graded by role, department or project, separately for viewing, editing, exporting and deleting.
The IT-Grundschutz Compendium of the German Federal Office for Information Security (BSI) covers this topic in module ORP.4 Identity and Access Management. GDPR-compliant access control does not come from the software alone, but from a documented concept supported by data protection, the business departments and, for personnel data, the works council (Betriebsrat).
- Roles, not peoplePermissions are tied to roles such as purchasing or HR. People are assigned roles, never individual rights on request.
- Permission classes per document typeConfidential document types such as personnel, contract or health records get their own, narrow permission class.
- Segregation of dutiesWhoever maintains master data does not also approve payments. Whoever administers the system does not need read access to content.
- RecertificationManagers confirm at fixed intervals that their team's permissions are still correct. Unconfirmed permissions are revoked.
Practical tip
Start with a one-page permissions matrix of roles and document types. Anything that cannot be entered clearly there will not be properly governed in the system later either.
02
Encryption on three levels
Document encryption works on three levels, each defending against different attacks. Transport encryption protects data on its way between client, browser and server. Storage encryption protects storage media and backups if they fall into the wrong hands. Document-level encryption protects the content even when someone with administrative rights accesses the server or database.
Key management is decisive: who generates keys, where are they stored, how are they replaced and who restores them in an emergency? These questions belong in a cryptography concept, as described in IT-Grundschutz module CON.1. General recommendations on methods and key lengths can be found in BSI TR-02102-1.
- Transport encrypted connections for clients, enaio webclient and interfaces. Recommendations on using TLS are given in the technical guideline BSI TR-02102-2.
- Storage encrypted storage of documents, database and backups. In the enaio Cloud, data is encrypted in transit and at rest.
- Document level hybrid encryption of each file with a symmetric file key, which is encrypted asymmetrically for each authorised user. This is how CipherMate works.
Practical tip
Use document-level encryption selectively for document types with high protection needs. Full-text search and automated processing need readable content, so the selection is a deliberate trade-off.
03
Audit-proof logging
Audit-proof logging means that every relevant action is recorded with user, timestamp, object and type of action, and that the log itself cannot be changed. In para. 59, the German GoBD (principles for proper electronic bookkeeping) require changes and deletions of electronic records to be logged and apply this accordingly to documents subject to retention. enaio logs all actions, including every document version, every change and every processing step.
Logs of employee access are also personal data. Where there is a works council (Betriebsrat), a works agreement governs when and by whom they may be evaluated. IT-Grundschutz dedicates module OPS.1.1.5 to logging.
- What is recordedCreating, opening, changing, exporting, deleting, permission changes and logins, each with user ID and timestamp.
- Reliable timeAll servers take their time from a common source, otherwise processes cannot be reconstructed.
- Protected logsLogs cannot be changed by administrators and are retained for as long as audit and retention obligations require.
Practical tip
Define in advance who evaluates logs and on what occasion. A log that nobody may read helps as little in an audit as one that everybody can read.
04
Immutability and audit-proof storage
In para. 103, the German GoBD (principles for proper electronic bookkeeping) require the IT system to be protected against loss, such as records becoming untraceable, destroyed, lost or stolen, and against unauthorised entries and changes through access and authorisation controls. Para. 110 names three ways to achieve immutability: in hardware, for example with unalterable storage media, in software through historisation and logging, or organisationally through access concepts. Simply storing files in a file system is generally not sufficient.
The requirements this creates for an archive used for tax purposes are described in detail under GoBD-compliant DMS and on the page on archiving software.
- VersioningEvery change creates a new version, and the original content remains identifiable.
- WORM storageIn the enaio Cloud, archived documents are backed up on WORM storage, which never overwrites data once written.
- Retention periodsDeletion is only possible after the retention period has expired and is itself logged.
05
Backup and recovery
Art. 32(1)(c) GDPR requires the ability to restore the availability of and access to personal data in a timely manner after a physical or technical incident. Under para. 106 of the German GoBD (principles for proper electronic bookkeeping), the description of the backup is part of the procedural documentation. A backup is therefore only complete once its recovery has been tested and documented.
In the enaio Cloud, AWP Consult backs up several times a day at geographically separate locations. For operation in your own data centre, IT-Grundschutz module CON.3 Data Backup Concept describes the requirements.
- Recovery pointHow many hours of work may be lost at most? This determines how often you back up.
- Recovery timeHow long may the DMS be down? This determines procedures, storage location and staff planning.
- Separate copyAt least one backup is kept at another location and protected against changes, so that malware cannot encrypt production data and backups at the same time.
- ConsistencyDocument storage and database are backed up so that they match. Otherwise recovery shows documents without an index or an index without documents.
Practical tip
Restore a complete archive in a test environment at least once a year and check samples from different years. Only then do you know that the backup holds up.
06
Updates, support and secure interfaces
A DMS is only as secure as its maintenance status. Security updates for the operating system, database and enaio belong in a fixed schedule, version upgrades in a planned project. AWP Consult carries out enaio version upgrades with a test system, verified interfaces and a fallback plan, and support offers dedicated contacts and preventive system maintenance.
How this works in detail is shown on the pages on enaio version upgrades and support and maintenance. How data flows securely between enaio and ERP is described under enaio interfaces.
- Patch managementUpdates are first installed in the test system and then put into production. The IT-Grundschutz basis is OPS.1.1.3 Patch and Change Management.
- Remote maintenanceAccess by service providers runs over encrypted, approved and logged connections.
- InterfacesDocuments flow into the archive via defined routes, for example with the AWP DocumentHandler from a file system, network share, FTP, REST API or email inbox, rather than via manually maintained export folders.
We will show you what this looks like with enaio at your company.
How does CipherMate protect highly confidential documents?
CipherMate protects highly confidential documents by encrypting each file symmetrically with AES-256 and additionally securing the group and user keys asymmetrically with RSA-4096, so that only authorised users can decrypt the content. CipherMate is a client-server solution from AWP Consult for encrypting documents in conjunction with document management systems.
The principle is called hybrid encryption: AES encrypts large files quickly, and RSA solves key distribution by encrypting the file key for each authorised user with their public key. Even someone with administrative access to the server or database sees only encrypted data without authorisation.
AES-256 for files
Each document is encrypted symmetrically before it is stored.
RSA-4096 for keys
Group and user keys are encrypted asymmetrically. This lets you control permissions via groups.
Four-eyes principle
Administration is secured so that no single person can manage keys alone.
Proven technology
Encryption uses the interfaces provided by the operating system and established algorithms.
Future-ready
The architecture is designed to adopt new technologies and algorithms when recommendations change.
Made for your DMS
CipherMate is designed for integration into existing DMS environments and configurations.
Where is your data stored: DMS hosting in Germany or your own data centre?
Your data is stored either in your own data centre, in the enaio Cloud, which AWP Consult operates exclusively in German data centres, or in a hybrid combination of both. What matters for security is less the location than a clear allocation of responsibility: who patches, who backs up, who monitors and who is liable? With DMS hosting in Germany, a data processing agreement under Art. 28 GDPR settles these questions bindingly.
Your own data centre
You keep servers, network and backup in your own hands. AWP Consult supports installation, hardening, updates and the backup concept. Your IT handles operations.
Cloud or on-premises?enaio Cloud from Germany
Operated in German, ISO 27001 certified data centres, encryption in transit and at rest, 24/7 monitoring, regular security updates and no transfers to third countries.
enaio Cloud HostingHybrid and managed service
Some parts run locally, others in the cloud, or AWP Consult takes over operating your environment. Responsibilities and service levels are set out in writing.
Hybrid DMS strategyReview permissions, encryption and backup together
We look at the permission concept, cryptography concept and backup of your enaio environment with you and show where action is needed.
- Permissions matrix by role
- Encryption down to document level
- Tested recovery
What are the most common security mistakes in DMS projects?
The most common security mistakes in DMS projects are gradually growing permissions, administrators with read access to all content, backups without recovery tests, backups on the same network as the production system, logs without evaluation rules and postponed updates. All of them can be avoided at the concept stage.
01
Permissions grow with every department change
- Consequence
- Long-serving employees end up seeing more than their manager.
- Better
- Tie permissions to roles, reassign them on every change and recertify them regularly.
02
Administrators read everything
- Consequence
- Whoever looks after the server has access to personnel and contract files.
- Better
- Separate system and content rights, encrypt confidential document types at document level.
03
Backup without recovery test
- Consequence
- In an emergency, the index, keys or entire years are missing.
- Better
- Test a full recovery every year and document the result.
04
Backup on the same network
- Consequence
- Malware encrypts production data and backups at the same time.
- Better
- At least one separate copy at another location, protected against changes.
05
Logs without rules
- Consequence
- Nobody may evaluate them, or anyone can read them.
- Better
- Define evaluation for specific occasions, in a works agreement for employee data.
06
Updates postponed
- Consequence
- Known vulnerabilities stay open, and the next version jump becomes large and risky.
- Better
- A fixed update schedule with test system and fallback plan.
What role do ISO 27001 and BSI IT-Grundschutz play in DMS security?
ISO/IEC 27001 and BSI IT-Grundschutz (the German baseline IT protection methodology) provide the organisational framework for DMS security: ISO/IEC 27001 sets requirements for an information security management system (ISMS), while IT-Grundschutz provides specific modules from which measures for archive, permissions, cryptography, logging and backup can be derived. Certification always applies to an organisation's management system, not to an individual piece of software.
The current version is ISO/IEC 27001:2022, supplemented by Amendment 1:2024. The BSI offers ISO 27001 certification based on IT-Grundschutz and is developing IT-Grundschutz into a digital set of rules, while the previous Compendium remains applicable during a transition period. If your company operates an ISMS, the DMS is managed in it as a separate target object with protection needs, risks and measures.
ORP.4
Identity and access management: roles, granting, revoking and reviewing permissions.
CON.1
Cryptography concept: methods, key lengths, key management and emergency access.
CON.3
Data backup concept: frequency, retention, storage locations and recovery tests.
OPS.1.1.5
Logging: what is recorded, how it is protected and how it is evaluated.
OPS.1.2.2
Archiving: long-term readability, integrity and suitable storage media.
OPS.2.2
Cloud usage: requirements when the DMS is operated by a service provider.
Sounds right for your company? Let's talk.
What does NIS2 mean for your document management?
For your document management, NIS2 means that, as part of your IT systems, it falls under risk management in accordance with Section 30 of the German BSI Act (BSIG) if your company is an important or particularly important entity: backup management, cryptography concepts, access control, multi-factor authentication and supply chain security must then also be implemented and documented for the DMS. Under Section 28 BSIG, this generally applies to companies in the sectors listed in Annexes 1 and 2 with 50 or more employees or with more than EUR 10 million in annual turnover and annual balance sheet total.
16.01.2023
The NIS2 Directive (EU) 2022/2555 enters into force and requires member states to transpose it into national law.
06.12.2025
The German NIS2 Implementation Act applies. The revised BSI Act regulates classification, risk management and reporting obligations.
06.01.2026
Registration in the BSI portal is possible. Affected entities have three months to register.
Significant security incidents must be reported in stages under Section 32 of the German BSI Act (BSIG): an early initial report within 24 hours at the latest, a notification within 72 hours at the latest and a final report no later than one month after that. If an incident involves personal data, Art. 33 GDPR applies in parallel, with notification to the supervisory authority within 72 hours where feasible. In both cases, a complete DMS log is the basis for reliably describing the scope and sequence of events.
Companies outside NIS2 also feel the rules when customers ask for evidence along the supply chain. Whether you are affected can be clarified with the BSI's NIS2 applicability check and your legal advisers. AWP Consult supports the technical implementation in the DMS.
Checklist: how secure is your DMS today?
These questions let you check in one hour where your document management stands. Every missing yes is a starting point.
Access and identities
- Is there a documented matrix of roles and document types?
- Are permissions adjusted automatically when people leave or change roles?
- Do managers regularly confirm their team's permissions?
- Are system and content rights separated for administrators?
Data and encryption
- Are connections to clients, browsers and interfaces encrypted?
- Are storage and backups encrypted?
- Is it defined which document types are encrypted at document level?
- Is there a cryptography concept with key management and emergency access?
Operations, backup and evidence
- Is one backup kept separately and protected against changes?
- Was a full recovery tested in the last year?
- Are logs protected and is their evaluation regulated?
- Is there a fixed schedule for security updates?
- Does the procedural documentation describe permissions, backup and logging?
- If operations are external, is an agreement under Art. 28 GDPR in place?
How does AWP Consult bring your DMS to a verified security level?
AWP Consult brings your DMS to a verified security level in five steps: inventory with protection needs, permission and cryptography concept, implementation in enaio, testing of permissions and recovery, and ongoing maintenance with updates and recertification. This also applies to enaio environments that have grown over time.
01
Inventory
Document types, roles, interfaces, operating model and backup are recorded, and the protection needs of each document type are assessed.
02
Concept
Permissions matrix, cryptography concept, logging and backup concept are agreed with IT, data protection and business departments.
03
Implementation
Permissions, encryption, logging and interfaces are configured in enaio, with CipherMate if required.
04
Testing
Permissions are spot-checked, recovery is tested, and the results feed into the procedural documentation.
05
Operations
Updates, support, recertification of permissions and regular review under Art. 32(1)(d) GDPR.
More on this: enaio implementation and training for users and administrators and enterprise content management consulting
Frequently asked questions about DMS security
Your question about the security of your document management is not listed? Call us or write to us, and we will answer personally.
Security check for your enaio environment
We go through permissions, encryption, logging and backup together with your IT and your data protection team.
Book a security check +49 6104 94738-13What does DMS security include?
DMS security includes a permission concept, encryption in transit, at rest and, where required, at document level, protected logging, audit-proof storage with versioning, verified backup and well-maintained operations with updates. These building blocks safeguard confidentiality, integrity, availability and traceability. Only their interplay makes a system secure. A single feature is not enough.
Which document management system supports GDPR-compliant permission management?
A suitable system assigns permissions finely by role, department, project and document type, controls viewing, editing, exporting and deleting separately and logs every access. enaio meets these requirements. Whether permission management is GDPR-compliant, however, depends on the configuration: need-to-know, separate areas for special categories of data under Art. 9 GDPR and regular recertification. We define these points with your data protection team.
How do I check a provider's DMS security?
Ask about the permission model down to document types, about encryption in transit, at rest and at document level, about unalterable logs and about the recovery concept. For hosting, ask to see the location, certificates with their scope and the agreement under Art. 28 GDPR. Clarify who installs updates and how version upgrades are tested.
Are documents encrypted in enaio?
In the enaio Cloud from AWP Consult, data is encrypted in transit and at rest. In your own data centre, you define transport and storage encryption in the operating concept, and AWP Consult supports the implementation. For documents with high protection needs, CipherMate additionally encrypts each file with AES-256 and the keys with RSA-4096. Then only authorised users can read the content, not even administrators.
Is there document management with GDPR-certified servers in Germany?
There is no general GDPR certificate for servers. The GDPR provides for certification procedures in Art. 42, but what matters in practice is the location of the data centres, a certificate for information security management such as ISO 27001 and an agreement under Art. 28 GDPR. AWP Consult operates the enaio Cloud exclusively in German, ISO 27001 certified data centres, with no transfers to third countries.
What is audit-proof logging?
Audit-proof logging records every relevant action with user, timestamp, object and type of action, and the log itself cannot be changed. In para. 59, the German GoBD (principles for proper electronic bookkeeping) require changes and deletions to be logged. enaio logs all actions, including every document version and every processing step. In addition, a rule on who may evaluate the log and when is important.
How do I prove to the works council (Betriebsrat) and IT that every approval step is fully documented?
With the workflow audit trail: for every case, it shows who reviewed, approved, rejected or forwarded it, and when. For IT, you prove this with a test run and an extract from the log. For the works council (Betriebsrat), a works agreement governs which data is logged and when it is evaluated. How approvals are set up in the workflow is described under Workflow Management.
Does a DMS need ISO 27001 certification?
No. ISO/IEC 27001 certifies an organisation's information security management system, not a piece of software. If your company operates an ISMS, the DMS is managed in it as a target object with protection needs, risks and measures. For hosting, what matters is whether the data centre is certified and what scope the certificate covers. BSI IT-Grundschutz (the German baseline IT protection methodology) offers suitable modules for permissions, cryptography concept, logging and backup.
Does NIS2 also affect document management?
Yes, if your company is an important or particularly important entity under Section 28 of the German BSI Act (BSIG). Risk management under Section 30 BSIG then applies to all IT systems of your services, including the DMS, covering backup management, cryptography concept, access control and multi-factor authentication. Implementation must be documented.
Is secure, audit-proof remote access to the DMS possible?
Yes, if access runs over encrypted connections and the same permissions and logs apply as in the office. With the enaio webclient, employees work in the browser. For remote access, a second factor at login is recommended. For NIS2 entities, Section 30 of the German BSI Act (BSIG) explicitly names multi-factor authentication.
What is the difference between data protection and data security in a DMS?
Data protection asks whether personal data is processed lawfully, for a specific purpose and for no longer than necessary. Data security asks whether all data is technically protected against loss, manipulation and unauthorised access. Art. 32 GDPR connects the two, because data protection requires appropriate security measures. We describe the data protection side under GDPR-compliant document management.
Which information security terms should you know?
The key terms that come up in discussions between IT, data protection, internal audit and business departments about DMS security.
- Security objectives
- Confidentiality, integrity and availability, supplemented by traceability in document management. Every measure can be assigned to at least one objective.
- Need-to-know principle
- Access only to the information required for a specific task.
- Segregation of duties
- Incompatible activities are assigned to different people, such as master data maintenance and payment approval.
- Recertification
- Regular confirmation by those responsible that granted permissions are still needed.
- Hybrid encryption
- Combination of fast symmetric encryption of the file and asymmetric encryption of the file key for each authorised user.
- Audit trail
- Complete, unalterable log of who performed which action on which document and when.
- WORM
- Write Once Read Many: storage that never overwrites data once written.
- Recovery point and recovery time
- Maximum tolerable data loss and maximum tolerable downtime. Both determine the backup concept.
- ISMS
- Information security management system under ISO/IEC 27001: rules, responsibilities and processes an organisation uses to manage information security.
- Processing on behalf
- Processing of personal data by a service provider on instructions, governed by an agreement under Art. 28 GDPR.
We will show you what this looks like with enaio at your company.
Define the security level of your DMS together
We support permissions, encryption, logging and backup of your enaio environment from the inventory to ongoing operations, in your own data centre or in the enaio Cloud.
Related topics
Sources and legal basis
The legal and technical statements on this page are based on the following official and established sources. Last reviewed: October 2026.
- Art. 32 GDPR: Security of processing Encryption, recovery and regular review
- Art. 33 GDPR: Notification of personal data breaches Notification within 72 hours where feasible
- GoBD (German bookkeeping principles), BMF letter of 28 November 2019 Data security in para. 103 to 106, immutability in para. 58 ff. and 108 ff.
- Section 30 BSIG: Risk management measures Measures for important and particularly important entities
- Section 32 BSIG: Reporting obligations Initial report after 24 hours, notification after 72 hours, final report
- BSI IT-Grundschutz modules 2023 edition, including ORP.4, CON.1, CON.3 and OPS.1.1.5
- BSI TR-02102: Cryptographic mechanisms Recommendations on methods, key lengths and TLS
- ISO/IEC 27001:2022 at ISO Requirements for information security management systems
How secure is your DMS really?
In the security check, we go through the permissions, encryption, logging, backup and operating model of your enaio environment with your IT and data protection team. You receive a prioritised list of specific measures.
- In person in Dietzenbach or online
- With IT, data protection and business departments
- Result: prioritised list of measures
Your certified partner for audit-proof document management, ECM and DMS in the DACH region since 2006.
150+ REFERENCE CUSTOMERS IN THE DACH REGION SINCE 2006
250+ COMPLETED PROJECTS SINCE 2006
Average payback of 12 to 18 months at 40+ companies
Certified partner
enaio® Partner DACH
Investment security with a certified enaio implementation partner and 19 years of project experience.
Contact
COMPANY
SERVICES
PRODUCTS
SOLUTIONS
© AWP Consult GmbH. All rights reserved 2026 | Powered by AWP Consult GmbH
