Integrate your own infrastructure: do not let security block the project

A project integrating operational systems into the client's infrastructure often gets stuck at an unexpected point: not technical, not budget-related, but at the security audit gate. The client's information security team asks the partner what certifications they have, what data protection processes are in place, and who is responsible in case of an incident. If not prepared, the project can stand still for weeks even though the technical part is complete.

When security issues become a prerequisite

Not every integration entails heavy auditing requirements. The extent depends on two core questions: what type of data is being affected, and where is that infrastructure located.

• End customer data, personal information, medical records, or financial transactions: the strictest requirements, non-negotiable.
• Internal operational data that does not contain personal information: requirements still exist but are usually more flexible.
• Independent cloud tools, not connected to core systems: the lightest requirements, but still need to check the provider's terms.

The finance, healthcare, and organizations that have implemented information security management systems often have their own security teams with criteria for evaluating external partners. Sinh Vũ recommends you ask that team directly when starting to discuss the project scope, not when you are about to implement.

Four things to prepare before integration

• Data processing agreement: a document specifying what each party can do with the data, where it is stored, when it is deleted, and how incidents are reported. Without this document, processing personal data poses direct legal risks.
• Partner due diligence: your organization needs to assess the security capabilities and compliance status of the integrator before granting access. Typically involves a security questionnaire, certification references like SOC 2 (service security control standard) or ISO 27001 (international information security management standard), or acceptable risk acknowledgment.
• Infrastructure responsibility boundaries: who is responsible for the server, who is responsible for the application, who gets called first when issues arise. If not clearly defined from the start, blame-shifting later wastes time and damages relationships.
• Right to audit and obligation to report incidents: contracts need to specify whether your organization has the right to request regular audits, and the integrator must report incidents within a specified timeframe.

Common mistakes that cause projects to be stuck midway

• To discuss confidentiality requirements in the implementation phase, at which point the client’s security team may block progress entirely.
• Do not sign a data processing agreement thinking it is a minor procedure, leading to legal issues when personal data is involved.
• The infrastructure boundary is not recorded in the contract, only agreed upon verbally, leading to disputes over responsibility when there is a system error.
• Consider security audits as the responsibility of the technical team, not including it in the scope discussion right from the kick-off meeting.

Evaluate partners first, then grant access to the system. It's not about suspicion, but about protecting both parties.

The principle of third-party risk management, Sprinto and Atlas Systems, SOC 2 Vendor Management

The viewpoint of Sinh Vũ

Sinh Vũ is not a technical infrastructure provider and does not take on sensitive infrastructure beyond its capabilities. When a project needs to integrate with your internal system, Sinh Vũ clarifies from the scope stage: which parts Sinh Vũ will build and operate, and which parts your internal technical team will take over and be responsible for.

For clients with an existing information security team, Sinh Vũ prepares compliance documentation early and collaborates directly with that team to shorten the assessment time. Deliverables always come with training for the internal technical team, as the goal is for you to operate independently, without relying on external parties.

In tightly regulated industries like finance or healthcare, if you do not have an internal technical team capable of onboarding, Sinh Vũ will state this clearly before signing the contract, rather than discovering it midway through the project.