"...How secure is your 360-degree software?..." The issue of 360 degree software security is becoming more and more important. The responsiblity to manage individual data appropriately is an ever increasing problem. In broad terms any individual has the right to view any personal data stored about them, and people are using this right more frequently. Even if you decide you maintain the 360 data yourself, the following may be informative. If you are using a 3rd party it is critical that you take the time to consider the technological and philosophical integrity of the supplier you might be considering. In order to compare 360-degree software suppliers, it would be very unwise not to consider the level of protection and security that your 360 degree software supplier has invested in. The following provides some pointers for your to consider; 1) Personal Data Protection Is the supplier registered with their national Data Protection Agency? Is the suppliers philosophy and commitment document readily available? Are users informed as to how their data will be saved and used BEFORE they complete a questionnaire? Do users have the option to decline on privacy grounds? Is the supplier accredited by any independent bodies (BS7799, ISO 27000), or can they provide evidence of data risk assessment and management? Is data encrypted? If so what data is encrypted, and what levels of encryption are used? 2) Access management (online systems only) What happens if there is an access failure? Even more importantly while questionnaires are being completed? Where are the possible points of failure in the system, how many are there and what is the recovery process for each possible failure? What is the worst possible failure mode? How many servers does the supplier use? Where are they? How do they communicate with each other 3) Data security How does the supplier prove to you that they have built their 360-degree software as securely as possible? How is data backed up on the system? Are the application databases synchronised in real time? What type of hardware does the supplier use? Does the hardward use any type of automatic back up (eg RAID) technology? Are servers dedicated/virtual/shared?