Frequently Asked Questions
The Afra Certificate (Information Production and Exchange Space Security) is a national security accreditation granted by the Presidential Center for Afra to software and hardware systems and products. This certificate indicates the system's compliance with the highest cybersecurity standards and its resilience against security threats. Its importance lies in increasing trust in digital systems, protecting sensitive information, and complying with national cybersecurity legal requirements.
Receiving an Afra Certificate for a BPMS system offers numerous benefits, including: increased trust and credibility with customers, significant reduction in security risks and data breaches, assurance of compliance with national legal and regulatory requirements, guaranteed business continuity and organizational operations, and saving time and costs for independent security assessments for customers. This certificate transforms the system into a more secure and reliable process management tool.
The Pooya Business Management system ensures user data security by adhering to a set of advanced security standards. These standards include advanced data encryption at rest and in transit, Role-Based Access Control (RBAC), robust authentication management, thorough security event logging and auditing, resistance to known attacks like OWASP Top 10, and a continuous process of vulnerability management and regular updates. The Afra Certificate validates the strict adherence to these principles.
The main steps include initial application and assessment, comprehensive security documentation, penetration testing and vulnerability assessment, detailed source code review, compliance checks against mandated security standards, remediation of all identified issues and vulnerabilities, and finally, upon final approval from the Afra Center, the issuance of the certificate. This process involves a thorough and meticulous review of all security aspects of the system.
Yes, the Afra Certificate is typically issued for a specific period, after which it requires re-inspection and renewal to ensure that security standards are maintained against new threats and system updates. This periodic process ensures that the system consistently remains at the highest security level and keeps pace with the latest developments in cybersecurity. The commitment to security is an ongoing process, not a one-time event.
