Compliance
How regulations touch field work.
When engineers visit your sites, rules about data, security and third parties still apply. These guides explain how, and what to agree in writing before anyone goes on site.
Please read: these pages are general information, not legal advice. Deploris does not claim any certification or compliance status on these pages. Check your obligations with your own counsel or compliance team, and see our Trust Center for what we can and cannot provide.
ALL TOPICS
Pick a topic.
GDPR
What the EU data protection law means when engineers work next to your screens, drives and tickets, and what to agree in writing.
Organizations established in the EU, and organizations outside the EU that offer goods or services to people in the EU or monitor their behavior. The UK and Switzerland have their own related laws.
Learn more02NIS2
How the EU cybersecurity directive reaches suppliers who work on site, and which access and reporting rules a customer can write into the scope.
Medium and large entities in 18 critical sectors across the EU, such as energy, transport, health, finance, digital infrastructure and public administration, as set out in each member state's national law. Member states may also cover some smaller entities.
Learn more03DORA
How the EU financial sector resilience rules reach IT suppliers who work on site, and which contract terms a financial customer may ask for.
Financial entities in the EU, which DORA lists in more than 20 types, such as banks, insurers, investment firms and payment institutions. Their ICT third-party service providers are affected through contracts, and providers designated as critical are overseen directly by the European Supervisory Authorities.
Learn more04SOC 2
What a SOC 2 report is and is not, and how to ask a field services provider for the same assurance in a written scope.
Service organizations of any size. SOC 2 is voluntary and driven by customer demand: customers and business partners often ask service organizations for a SOC 2 report.
Learn more05ISO 27001
What an ISO 27001 certificate does and does not tell you about the engineers who visit your site, and what to write into the scope.
Organizations of any size and sector worldwide. It is voluntary, although customers and tenders often ask for it.
Learn more06HIPAA
When on-site IT work in a health care setting may involve protected health information, and which controls and agreements to put in writing.
US covered entities (health plans, health care clearinghouses and health care providers that conduct certain electronic transactions) and their business associates and subcontractors that handle protected health information.
Learn more07PCI DSS
What the card payment security standard means when engineers service POS terminals and network gear, and what to write into the scope.
Merchants, processors, acquirers, issuers and service providers involved in payment card processing, and entities that could affect the security of the cardholder data environment. Payment brands and acquirers run the compliance programs.
Learn more08CCPA and CPRA
How California's privacy law shapes the contract with a field services provider, and which handling rules to put in the written scope.
For-profit businesses doing business in California that meet a threshold: annual gross revenue above a dollar threshold that is adjusted for inflation every two years (check the California Privacy Protection Agency for the current figure), buying, selling or sharing the personal information of 100,000 or more California residents or households, or earning 50 percent or more of annual revenue from selling it. Service providers are affected through contracts.
Learn moreGet started
Need engineers on site? Tell us where.
Tell us the sites, the scope and the timeline. We reply with a written plan.