Munich Re Group Annual Report 2006 (PDF, 1.8

Munich Re Group Annual Report 2006 Management report_Other success factors
physically disabled colleagues – a project supported by the
company’s own foundation, Fundación Integral. Inspired
by this idea, ERGO Hestia in Poland has set up a similar
foundation.
Social responsibility is likewise practised by Hamburg-
Mannheimer with its foundation Jugend & Zukunft, which
awarded prizes in 2006 for the first time. Under the motto
“Fußball bewegt” (”Football moves”) it honoured various
initiatives that bring young people together using sport as
a medium of integration.
IT processes
Information security
Munich Re ensures the security of all its data, computers
and networks worldwide. IT security in primary insurance
and reinsurance is organised in separate, but individually
effective structures.
At the top of our security pyramid in the reinsurance
group is the IS Office, which defines uniform standards
and guidelines applied by all our companies globally. It is
also responsible for information-security crisis management
and for quality assurance in the enforcement of the
relevant directives. In addition, it instructs our Security
Centre of Competence in Toronto, whose functions include
testing the IT infrastructure of the reinsurance group and
central IT applications for weaknesses and possible security
risks. We attach great importance to the security training
of all our staff.
Regular external audits have confirmed that Munich
Re’s information security is at a high level. However, given
that we see security as a process rather than a state, we are
constantly refining our strategies and standards as part of
our information risk management. This process is geared
both to the actual risks and to ways of minimising them in
order to support Munich Re’s business operations. The
recommended measures are carefully weighed up and
taken into account in the security architecture, which not
only describes the technical and organisational aspects
but also includes risks related to the “human factor” in the
broadest sense.
However, the security organisation does not just concern
itself with protective measures. It also acts as a con-
sultant for the divisional units in jointly assessing information
security risks at potential clients. To this end, it has
delegated a permanent representative to the Information
Technology Topic Network and carries out or partners
information risk assessments.
ERGO’s IT security is part of our cross-corporate IT
security management, which embraces four levels: security
policy, guidelines, concepts and technical implementation.
Responsibility for the management of information
security in the ERGO Group lies with the IT Security Officer,
who is supported by the IT Security Management Board – a
strategy and controlling body.
ERGO’s security management is being continually
improved and extended with a view to gearing it to international
standards – we are aiming for certification to
ISO 27001 by 2009. We are also preparing for the developments
of Solvency II and the requirements of ISO 27001,
which go beyond the basic protection demanded by the
German Federal Office for Information Security, by building
up an information security management system in conjunction
with operational risk management in the IT sector.
This involves investigating all the main points of IT security,
analysing the risks identified in their entirety, and
putting in place security measures where there is a need
for protection.
IT Security Management also supports risks analyses
for future strategic and operational projects in order to
safeguard the ERGO Group’s assets long term.
Gloria
With our reinsurance platform Global Reinsurance Application
(Gloria), we are providing the reinsurance group
with a consistent data basis and an integrated system for
all business-relevant core processes. Building on various
SAP modules, we are thereby harmonising the business
processes in our reinsurance, not only enhancing the quality
and efficiency of individual process steps – such as
underwriting, claims and accounting – but also improving
the analysis, management and administration of our reinsurance
business as a whole. The harmonisation of all core
business processes will also serve our global risk management,
which will have extensive data available even more
quickly.
109