Search results

Document 14.1

I’m assuming you are referring to Appendix 1 – Specification of Information System Requirements.

Considering that, you should create this record for each software listed in your Risk Treatment Table for which you have identified risks that need to be treated by control A.14.1.1 (Information security requirements analysis and specification). Please note that these records can be created either for each individual software or as a single record for a set of software which share the same security requirements.

Considering the software under development, you need to create a record for each new version (this will help you track the changes and evolution in security requirements)

For further information, see:

• How to integrate ISO 27001 A.14 controls into the system/software development life cycle (SDLC) https://advisera.com/27001academy/how-to-integrate-iso-27001-controls-into-the-system-software-development-life-cycle-sdlc/
• How to set security requirements and test systems according to ISO 27001 https://advisera.com/27001academy/blog/2016/01/11/how-to-set-security-requirements-and-test-systems-according-to-iso-27001/

Security and Privacy

ISO 27001 is a management framework for the protection of information in general, and does not cover specifics related to privacy and medical data, depending upon the defined requirement (e.g., GDPR, HIPAA, etc.).

Considering that ISO 27001 may not be enough to ensure fulfillment of privacy requirements. In this case, you should consider using additional ISO 27001 supporting standards, like ISO 27701 (for privacy protection) and ISO 27799 (for health organizations).

For further information, see:

• Relationship between ISO 27701, ISO 27001, and ISO 27002 https://advisera.com/27001academy/blog/2019/12/10/relationship-between-iso-27701-iso-27001-and-iso-27002/
• How ISO 27001 and ISO 27799 complement each other in health organizations https://advisera.com/27001academy/blog/2016/06/13/how-iso-27001-and-iso-27799-complement-each-other-in-health-organizations/

Risk Assessments for Early Start up

ISO 27001 does not prescribe assets and threats to be used for risk assessment, so you should consider assets and threats regarding your own organizational context (e.g., industry, adopted technologies, etc.). Without this kind of information is not possible to provide a more detailed answer.

What we can say at this moment is that you should avoid using so broad categories, because assets/threats related to them may require different treatment approaches. For example, in software, you can have off-the-shelf software and internally developed software. For the network, you can have firewalls and switches. As for the environment, you may have fire and flood.

Included in your toolkit you have a Risk Assessment Table with lists of assets, threats, and vulnerabilities commonly used in information risk assessment. It is located in folder 05 Risk Assessment and Risk Treatment. Additionally, you have access to a video to a video tutorial that can help you perform risk assessment, using real data as an example.  

These articles will provide you a further explanation about risk assessment:

• ISO 27001/ISO 27005 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/
• ISO 27001 risk assessment: How to match assets, threats and vulnerabilities https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-how-to-match-assets-threats-and-vulnerabilities/

Videos and names

EU GDPR requires the data controller when processing personal data (i.e., the names of participants to a Zoom lesson) to inform the data subjects about the use of personal data. If the data controller aims to modify and add some further use (i.e., publishing the video on Youtube) it shall inform the data subjects and require their consent. Of course, it is needed to have consent from the students mentioned.Another solution can be to anonymize the video by editing the lesson and removing the name of the student. In that case, being only your voice the video may be published.

Here you can find more information about consent:

• Four main questions for obtaining and managing data subjects’ consent under GDPR: https://advisera.com/eugdpracademy/knowledgebase/four-main-questions-for-obtaining-and-managing-data-subjects-consent-under-gdpr/
• Is consent needed? Six legal bases to process data according to GDPR: https://advisera.com/eugdpracademy/knowledgebase/is-consent-needed-six-legal-bases-to-process-data-according-to-gdpr/

If you need to understand how to comply with the EU GDPR and manage consent you can consider enrolling in our EU GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course/

GDPR query

1. We are a processor and have received a data subject access request via the controller for a personal data that is bundled together with personal data from several different persons - how should we respond, because if we provide any information, we would reveal personal data from other data subjects as well?

Article 28 par 1 h) GDPR requires the processor shall immediately inform the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions.This means that you will inform your data controller who is in charge of the relationship with the data subject that the access request should be rejected because it infringes third parties' privacy. The data controller will decide how to behave.

2. For a company based in the UK, should we register the name of our DPO with the ICO?

Yes. Consider that a UK-based company is under UK GDPR since UK has left the EU.

If you need more information about the difference between data controller and processors or data subjects rights, here you can find some resources:

• EU GDPR controller vs. processor – What are the differences? https://advisera.com/eugdpracademy/knowledgebase/eu-gdpr-controller-vs-processor-what-are-the-differences/
• Data subject rights according to GDPR https://advisera.com/eugdpracademy/knowledgebase/8-data-subject-rights-according-to-gdpr/

If you need to understand how to comply with the EU GDPR you may consider enrolling in our EU GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course/ 

Defining scope of application and scope for ISMS

The best ways to define an ISMS scope consider the information, processes, or locations you want to protect. An application cannot be defined as an ISMS scope.

Considering that, for your context, you can define the ISMS scope in terms of:

• the development and maintenance processes that support the web application
• the information processed by the web application

Please note that for companies up to 50 employees, the best alternative is to include all organizations in the ISMS scope, because the effort to keep only the organization in the ISMS scope is not worthy.  

These articles will provide you a further explanation about scope definition:

• How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
• Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/

These materials will also help you regarding scope definition:

• How to set the ISMS scope according to ISO 27001 [free webinar on demand] https://advisera.com/27001academy/webinar/how-to-set-the-isms-scope-according-to-iso-27001-free-webinar-on-demand/
• Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
• ISO 27001 Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/

ISO 14001 and Fire response

A fire is a risk in your environmental management system (EMS). Also, fire is an environmental aspect under abnormal situations.

So, you determine fire as a possible environmental aspect. Is there any mandatory prevention and or response preparation under your organization’s compliance obligations?

Even without any compliance obligations, your EMS should evaluate the significance of that environmental aspect and its impacts. If it is deemed to be significant you should consider ISO 14001:2015 clause 8.2 and prevent and or prepare a response to a possible fire in your facilities.

You can find more information below:

• ISO 14001 emergency preparedness and response - https://advisera.com/14001academy/knowledgebase/iso-14001-emergency-preparedness-and-response/
• 5 steps to set up an emergency plan according to ISO 14001 - https://advisera.com/14001academy/blog/2014/07/23/5-steps-set-emergency-plan-according-iso-14001/
• Enroll for free in this course – ISO 14001:2015 Foundations Course - https://advisera.com/training/iso-14001-foundations-course/
• Book – The ISO 14001:2015 Companion - https://advisera.com/books/the-iso-14001-2015-companion/

BC Strategy

Please note that departments in the scope may use different strategies depending on their needs (e.g., time to recover business operations, amount of acceptable data loss, etc.). For example, depending on the number of required personnel, the transport channel will vary between using own cars to taxis or buses. In case of reimbursement, some may be in cash or by means of wire transfer.

The point is that you may not assume that the strategy will be more or less the same. You need to take into account recovery objectives.

For further information, see:

• Can business continuity strategy save your money? https://advisera.com/27001academy/blog/2010/03/15/can-business-continuity-strategy-save-your-money/
• What is the difference between Recovery Time Objective (RTO) and Recovery Point Objective (RPO)? https://advisera.com/27001academy/knowledgebase/what-is-the-difference-between-recovery-time-objective-rto-and-recovery-point-objective-rpo/
• Developing the business continuity strategy according to ISO 22301 [free webinar on demand] https://advisera.com/27001academy/webinar/developing-the-business-continuity-strategy-according-to-iso-22301-free-webinar-on-demand/

Vendita di un piccolo centro estetico

La cessione dell'intera azienda comporta il subentro del nuovo acquirente in tutti i rapporti giuridici, attivi e passivi, pertanto nella disciplina della vendita sarà possibile cedere l'intero database dei clienti regolamentando nel contratto l'intera cessione. Al momento del subentro, il nuovo proprietario dovrà rilasciare ai clienti ceduti un'informativa ai sensi dell'art. 14 GDPR nella quale li informa del cambio di titolarità.

Qui puoi trovare alcuni articoli sul trattamento dei dati personali:

• È necessario il consenso? Sei basi giuridiche per il trattamento dei dati in conformità con il GDPR https://advisera.com/eugdpracademy/it/knowledgebase/e-necessario-il-consenso-sei-basi-giuridiche-per-il-trattamento-dei-dati-in-conformita-con-il-gdpr/

Se vuoi saperne di più qui trovi il corso gratuito EU GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course/ 

Audit report

The common practice is to gather robust evidence to support the findings (i.e., concrete evidence of the observed facts and that defined requirements and/or plans are not being fulfilled) and keep constant communication with top management during the audit process (e.g., meet with them at the end of each audit day). Keeping information flowing is the best way to prevent top management from being surprised by the results of an audit.

For further information, see:

• 7 ways to improve the internal audits of your ISO 27001 ISMS https://advisera.com/27001academy/blog/2017/08/28/7-ways-to-improve-the-internal-audits-of-your-iso-27001-isms/