{"id":25,"date":"2022-11-25T14:26:00","date_gmt":"2022-11-25T13:26:00","guid":{"rendered":"https:\/\/buchholz-software.de\/?page_id=25"},"modified":"2025-12-09T08:03:19","modified_gmt":"2025-12-09T07:03:19","slug":"anyva-grc","status":"publish","type":"page","link":"https:\/\/buchholz-software.de\/en\/anyva-grc\/","title":{"rendered":"Anyva GRC"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"Anyva\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Data protection, information security & risk management<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Fully process-based management\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

ANYVA revolutionises the way data protection management systems (DSMS) are structured. While traditional DSMSs are form-based and maintain isolated processing records (VVT), ANYVA maps data protection completely process-based. This means that processing activities are not recorded manually, but are systematically derived from the actual business processes.<\/p>

This architecture enables consistent and redundancy-free data management. Technical and organisational measures (TOMs), data categories, legal bases, earmarking and recipients automatically follow the process logic. This eliminates duplicate entries and contradictions in the VVT. More importantly, data protection impact assessments (DPIAs) are based directly on the recorded processes, the associated risks and the current TOM situation - not on subsequently created documents.<\/p>

This structural innovation ensures that data protection is not perceived as an administrative overhead, but as an integral part of corporate management. Every change in the process is automatically reflected in all relevant data protection documents.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
\n\t\t\t<\/i>\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Processes as a basis<\/strong><\/h4>

Real business processes are the basis for VVT and ISMS. Data only needs to be recorded once<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
\n\t\t\t<\/i>\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Automatic linking<\/strong><\/h4>

TOMs, data, legal bases follow the process logic<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
\n\t\t\t<\/i>\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

No redundancies<\/strong><\/h4>

Unique assignment without duplicate entries, TOMs only exist once, common for all modules<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Dynamic TOM effectiveness instead of static lists\n\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In conventional data protection management systems, technical and organisational measures (TOMs) are kept as static, text-heavy lists. Each processing activity, each document and each DPIA contains a separate TOM list - often inconsistent and outdated. ANYVA breaks with this outdated approach.<\/p>

In ANYVA, every TOM once in the system<\/b> as a centrally managed element. These TOMs are assigned to different contexts via assignment: Processes, data types, systems, DSFAs. Every change to a TOM - be it an update of the effectiveness, a new version or an addition - automatically affects all associated elements: all processes, all data types, all DSFAs, all risk assessments.<\/p>

\u00a0<\/p>

This means that if an encryption method is strengthened, the protective effect is updated immediately in all affected processes. If a new access concept is introduced, it takes effect immediately in all relevant DSFAs. The AI-supported plausibility check continuously monitors whether the TOMs are complete, whether they are appropriate to the risks and whether there are any gaps.<\/p>

This means that if an encryption method is strengthened, the protective effect is updated immediately in all affected processes. If a new access concept is introduced, it takes effect immediately in all relevant DSFAs. The AI-supported plausibility check continuously monitors whether the TOMs are complete, whether they are appropriate to the risks and whether there are any gaps.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Integrated DSFA logic with scenarios and risks\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Linking ISMS and DSMS\n\n\n\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

This bridge between information security and data protection is a unique selling point. Conventional DSMSs manage DSFA, TOMs and risks as separate silos. ANYVA merges them into a consistent risk model. This means<\/p>

  • IT security risks automatically affect data protection risks<\/li>
  • TOM changes update both worlds simultaneously<\/li>
  • Attack scenarios and vulnerabilities are taken into account in the DPIA<\/li>
  • Risk management is holistic, not fragmented<\/li><\/ul>
    \u00a0<\/div>

    The result: more precise risk assessments, shorter response times, fewer blind spots. ANYVA turns data protection and information security into an integrated governance approach.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    Automatic risk assessment\n\n\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    In many systems, data protection impact assessments (DPIAs) are isolated documents that have to be created and maintained manually. ANYVA fully integrates the DPIA logic into the process and risk model. DSFA risks arise from automatically<\/b> from the concatenation: process \u2192 data \u2192 categories \u2192 requirements \u2192 TOMs.<\/p>

    Changes in the process, in the processed data or in the TOMs automatically affect the DPIA assessment. If a TOM is removed or a new data category is added, the risk is adjusted in real time. Even more unique: Attack scenarios from the integrated ISMS can influence data protection risks. If a technical risk is identified in the ISMS - such as a vulnerability in authentication - this flows directly into the DPIA assessment.<\/p>

    \u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    Integrated DSFA logic with scenarios and risks\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    TOMs in both worlds\n\n\n\n\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Technical and organisational measures work simultaneously in data protection (DSMS) and information security (ISMS). An encryption measure protects both personal data and sensitive business information. This dual effect is mapped natively in ANYVA - without duplication or manual synchronisation.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    Associated risks\n\n\n\n\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Data protection risks are automatically linked to technical risks. If an IT risk escalates - due to a new vulnerability, for example - this has an immediate impact on the data protection risk assessment. Conversely, data protection requirements flow into the IT risk analysis. The result: a single, consistent risk model instead of three different ones.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    Asset transparency\n\n\n\n\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Assets (systems, applications, infrastructure) are linked to processes, data, TOMs and risks. Changes to an asset - such as a system update or a shutdown - automatically affect all dependent data protection and security elements. There is no such transparency in an isolated DSMS.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    The standardised data model makes ANYVA the central governance platform for data protection and<\/b> Information security. Instead of maintaining parallel systems, data protection officers, IT security managers and risk managers work in the same data model - with consistent information, automatic dependencies and a holistic view.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    Tamper-proof audit trail and AI support\n\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    Complete audit trail\n\n\n\n\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Data protection is accountability. ANYVA documents every decision<\/b> with complete origin and justification: every legal basis, every purpose, every deletion deadline, every TOM update, every risk change. Changes have a system-wide effect and the history is retained without gaps.<\/p>

    Auditors and supervisory authorities have access to the entire chain of reasoning: Why was this legal basis chosen? Who authorised the DPIA? What TOM changes were made? Many DSMSs only save the current version - ANYVA preserves the complete, tamper-proof version history.<\/p>

    This audit trail is crucial for the obligation to provide evidence in accordance with Art. 5 para. 2 GDPR (accountability). It not only documents what<\/i> was decided, but also Why<\/i>, when<\/i> and by whom<\/i>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    AI support for data protection\n\n\n\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    ANYVA does not use AI for superficial text modules, but for logical data protection models<\/b>. The AI provides support with:<\/p>

    • TOM proposals:<\/b> The AI suggests suitable technical and organisational measures based on the data risk and protection requirements.<\/li>
    • DSFA quality assessment:<\/b> The AI assesses the completeness and plausibility of DSFAs and suggests improvements.<\/li>
    • Rights of data subjects:<\/b> The AI recognises when data subject rights are incompletely recorded or not taken into account.<\/li><\/ul>
      \u00a0<\/div>

      These AI functions go far beyond simple text generation. They analyse the structure, logic and consistency of the data protection model - and turn ANYVA into a intelligent data protection system<\/b>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

      \n\t\t\t\t\t\t
      \n\t\t\t\t\t
      \n\t\t\t
      \n\t\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      Conclusion:<\/b> ANYVA offers functions that no classic DSMS on the market provides in this combination. Process-based architecture, dynamic TOM management, automatic plausibility checks, integrated DPIA logic, standardised data model, automatic processor checks, real-time data flows, tamper-proof audit trail, AI support and a fully integrated governance ecosystem - this is the new generation of data protection governance.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"

      Datenschutz, Informationssicherheit & Risikomanagement Vollst\u00e4ndig prozessbasiertes Management ANYVA revolutioniert die Art und Weise, wie Datenschutz-Management-Systeme (DSMS) aufgebaut sind. W\u00e4hrend klassische DSMS formularbasiert arbeiten und isolierte Verarbeitungsverzeichnisse (VVT) f\u00fchren, bildet ANYVA den Datenschutz vollst\u00e4ndig prozessbasiert ab. Das bedeutet: Verarbeitungst\u00e4tigkeiten werden nicht manuell erfasst, sondern systematisch aus den tats\u00e4chlichen Gesch\u00e4ftsprozessen abgeleitet. Diese Architektur erm\u00f6glicht eine konsistente und […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-25","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/buchholz-software.de\/en\/wp-json\/wp\/v2\/pages\/25","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buchholz-software.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/buchholz-software.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/buchholz-software.de\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buchholz-software.de\/en\/wp-json\/wp\/v2\/comments?post=25"}],"version-history":[{"count":79,"href":"https:\/\/buchholz-software.de\/en\/wp-json\/wp\/v2\/pages\/25\/revisions"}],"predecessor-version":[{"id":1735,"href":"https:\/\/buchholz-software.de\/en\/wp-json\/wp\/v2\/pages\/25\/revisions\/1735"}],"wp:attachment":[{"href":"https:\/\/buchholz-software.de\/en\/wp-json\/wp\/v2\/media?parent=25"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}