Trusted security for digital healthcare
Roche safeguards data and healthcare infrastructure with a combination of administrative, technical and physical organizational measures. The company actively monitors threats, responding timely to vulnerabilities. Its ISO/IEC 27001-certified information security management system supports compliance with laws and industry standards.
Our people, processes and technology work together to uphold the confidentiality, integrity, availability (CIA) of data and compliance with relevant laws and standards.
Roche believes in building trust through transparency. The product security page is your central hub for important cybersecurity and data privacy information about our solutions.
As part of Roche's defense in depth strategy, product teams classify data, analyze risk and conduct threat modeling during development and commercialization. This effort helps identify technical control requirements to support compliance with laws and regulations, standards and Roche policies.
navify-hosted solutions are protected by a cloud firewall on the Roche-maintained navify Platform. If a navify solution is deployed on-premises, the customer is responsible for security controls.
Effective May 1, 2019, Roche mandates a dedicated, Roche-managed hardware firewall for certain laboratory-based instruments. This establishes a micro-segmented Roche Laboratory Network (RLN) essential for regulatory compliance and patient safety, offering the following value:
Provides primary defense and enables Roche to monitor cyber threats
Establishes a secure, isolated zone for operations enhancing system resilience
Allows for remote system access, software updates and responding to potential cybersecurity incidents
Data protection standards
Security features may vary depending on the solution. Please consult your Roche representative for product-specific details.
navify products employ various security measures and policies that are designed to minimize vulnerabilities and attack threats.
Roche secures data at rest/in transit with industry-standard encryption. When used, it reduces data compromise risk.
Roche uses a defense-in-depth strategy to secure access. This includes password protocols, multi-factor authentication and role-based access controls (RBAC).
Roche partners with companies like AWS to host and secure digital solutions. We require all service partners to use anonymization, pseudonymization or equivalent privacy measures.
Roche provides flexible hosting options (on-premises or cloud) for navify solutions to meet diverse regional needs, prioritizing patient safety and local compliance.
For cloud hosting, Roche partners with leading cloud hosting providers, ensuring data is securely managed across its lifecycle, adhering to global protection laws and giving customers control.
As a trusted partner, Roche
Uses contracts to outline data handling
Transparently discloses data flows and access purposes
Gains customer consent for Roche employee access
Follows applicable laws and regulations
For Roche solutions that are required to be hosted at a customers location, there are a few key points to be aware of:
It is mandatory to use the Roche validated firewall to protect Roche instrumentation*
For all hosting environments that may need to remain outside of the Roche firewall, the customer is responsible for all security measures for all hardware and software that Roche does not provide
Roche contracts will clearly outline mutual obligations to maintain compliance for both Roche and customers
*Roche point of care and navify cloud software solutions are exempt from this physical firewall mandate.
Many Roche customers are taking advantage of the benefits that cloud technologies offer and elect to host navify solutions on the navify Platform. Roche cloud solutions:
Provide industry standard security measures in efforts to protect the confidentiality, integrity and availability of data
Are configured and maintained using tools and services in accordance with laws, regulations and industry standards
Are continuously monitored with technical and automated solutions with the aim of detecting and preventing cybersecurity incidents
The security and compliance of navify solutions throughout their full lifecycle are managed through a quality management system, which is significantly informed by the Roche ISO/IEC 27001-certified information security management system (ISMS). This ISMS establishes the mandatory minimum security baseline, ensuring compliance with relevant laws, regulations and industry standards.