DEA Audits – a world of pain

---

In spring 2020 EPCC became one of the very few organisations in the UK to become accredited data processors under the Digital Economy Act (DEA),

one of exactly 8 accredited data processors in the UK! This was for the hosting and technical management of the National Safe Haven. EPCC is used to the stresses and work involved in its annual ISO 9001 and 27001 external audits. Despite all the activity that goes on throughout the year to apply the policies and processes involved and to make and measure improvements, the actual audit always involves a week’s worth of nerves, meetings, inspections, producing evidence, dubious food consumption and post-match celebration. We thought we knew what being audited is like. Oh no, the DEA audit was a whole new level of pain.

It is based on the ISO 27001 information security standard, and required two assessments, one on capability and one on security. The capability one was fairly painless, lulling us into a false sense of security. The security audit however was something special. 4 auditors from the Office for National Statistics(ONS) from Wales grilled us for 9 hours in person (those were the days). We had a cunning plan to give them a physical tour of the datacentre, thus giving us a break, but no, 2 went on the tour so the other 2 could carry on. Something much stronger than cake would have been nice long before the end of the day! The end result was success but the thought of a yearly audit to review progress on any improvements was not something we were looking forward to.

In May 2021 we survived the return match, the annual external audit.

Two very nice auditors from ONS audited us virtually, even alluding to the rather brutal audit the previous time. It would have been rude to agree but … This time they examined progress on a few of the controls where improvements were identified and seemed impressed with what had been done. It was all over in 2 hours and we were told informally had passed. Recently we had the formal confirmation that we passed and improved on our previous results. It is now the autumn, and we are counting down to our next visitation, whilst running, improving, processing and keeping the show on the road.