Search results

Risk assessment internal and external criteria and factors

What are the internal and external criteria and factors that apply in the risk assessment?

Considering ISO 27005, the ISO standard for information security risk management, you have some of the following:

• Internal factors: business objectives, business processes, organizational structure, information assets
• External factors: geography, marketing trends, political and economical issues
• Risk evaluation criteria: strategic value of processes which handle business information, legal, regulatory and contractual requirements, business value of confidentiality, integrity, and availability
• Impact evaluation criteria: classification level of impacted information, affected operations (internal or of third-parties), breach of legal, regulatory or contractual requirements
• Risk acceptance criteria: business-related, legal and regulatory related, operational related, technological related, and financial related

This material will also help you regarding ISO 27001 risk management:
- Book ISO 27001 Risk Management in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/

EU GDPR and Personal Data Processing

1.Who is responsible for the personal data which is processed with a third company (like a booking or a paying system)?

Booking companies and payment facilitators are acting as independent data controllers so they are responsible for all data they collect and process when providing the service to the data subjects.

2. If the Company can access the data (by e-mail, online account, etc,...) but doesn't hold those data?

If the data can be accessed it means the processing of personal data according to art 4 of the GDPR: Storing the data, is not a condition for processing.

If you want to find out more about the EU GDPR check out this free EU GDPR Foundations Course https://advisera.com/training/eu-gdpr-foundations-course/

Difference between Outsourcing and Contracting

While there are some variances, it is easiest to think of these two terms like this; outsourcing is when you get a supplier to perform one of your processes for you, such as heat treating, and this is generally done at the supplier’s site. On the other hand contractors generally work on your site and often do not affect the production processes, such as an electrician upgrading your building.

You can find out more about the ISO 45001 requirements in this helpful whitepaper: Clause-by-clause explanation of ISO 45001:2018, https://info.advisera.com/45001academy/free-download/clause-by-clause-explanation-of-iso-45001

Control implementation

Please note that control A.14.2.5 "Secure system engineering principles" is covered in the Secure Development Policy template, located on folder 08 Annex A Security Controls >> A.14 System Acquisition Development and Maintenance

These articles will provide you further explanation about secure engineering principles and software development life cycle:
- What are secure engineering principles in ISO 27001:2013 control A.14.2.5? https://advisera.com/27001academy/blog/2015/08/31/what-are-secure-engineering-principles-in-iso-270012013-control-a-14-2-5/
- How to integrate ISO 27001 A.14 controls into the system/software development life cycle (SDLC) https://advisera.com/27001academy/how-to-integrate-iso-27001-controls-into-the-system-software-development-life-cycle-sdlc/

These sites can also provide further information: 

- https://www.nist.gov/news-events/news/2018/01/update-nist-special-publication-800-160-systems-security-engineering

- https://www.owasp.org/index.php/Security_by_Design_Principles

Communication plan

First is important to note that ISO 22301 nor ISO 27001 do not prescribe how a communication plan must be documented, so it is up to the organization to decide if it will be a separated document or not. 

For small and medium size organizations we understand that a separated document would increased administrative effort unnecessarily, so information related to communication plan is available in the several templates, for example:
- Disaster recovery plan, located on folder 08 Annex A >> A.17 Business Continuity >> 04 Business Continuity Plan
- Activity recovery plan, located on folder 08 Annex A >> A.17 Business Continuity >> 04 Business Continuity Plan

- Information Security Policy, located on folder 04 Information Security Policy
-  Incident management, located on folder 08 Annex A >> A.16 Incident Management 

In each document information related to communication is defined according the document purpose.

Template content - information classification policy

Please note that in section 2 of the Information Classification Policy there is reference to a Inventory of Assets, so there is no need to included reference to control a.8.1.1 (this inventory of assets is the Implementation of this control).

Awareness and training for secure software development

Hi, Christin. Please note that considering your scenario, an example of filling out the risk treatment plan columns you mentioned would be:

• Description of activities: Development of specification of safety requirements
• Training and awareness programs: Course about risk assessment, system Functional Specification, controls for Software security (these are the competencies required to fill in the specification of safety requirements)
• Method for evaluation of results: number of changes on specification of safety requirements considering failures on validation and acceptance testing (i.e., the less security failures in validation testes, and the less refusal of customers on delivered systems, the better are the specifications).

Identifying the risks and opportunities related to the environmental aspects

What a great question! When I first started to work with ISO 14001:2015 I had the same question and expected a unique answer, but after some investigation and reflection, I concluded that there is more than one way to handle the challenge. Each organization should pick the option that best suits its particular situation.

1. There are organizations that determine their environmental aspects and use a risk and opportunities assessment to determine their significant environmental aspects. (Please see the end of the second paragraph of Annex A.6.1.1 of ISO 14001:2015)

2. There are organizations that determine their environmental aspects evaluate them and determine the significant ones and use a risk and opportunities assessment to determine which ones need an action plan, and which ones need only to be monitored.

3. There are organizations that only apply the risk-based approach to the context part. In a certain way, they are following the same approach as 1 without explicitly mentioning it.

Currently I’m having two ISO 14001 implementation projects in an industrial context and I use approach number 2. My second rating system is very simple and based on:

• Do we not comply with legislation?
• Improving will be aligned with our strategy?
• Improving will have a good return?

A Yes to any of the questions determines that an action plan is needed.

The following material will provide you with more information about aspects and impacts:

• Article - 4 steps in identification and evaluation of environmental aspects https://advisera.com/14001academy/knowledgebase/4-steps-in-identification-and-evaluation-of-environmental-aspects/
• Environmental aspect identification and classification https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/nowledgebase/environmental-aspect-identification-and-classification/
• Free webinar - Free webinar - ISO 14001: Identification and evaluation of environmental aspects https://advisera.com/14001academy/webinar/iso-14001-identification-and-evaluation-of-environmental-aspects-free-webinar-on-demand/
• Book – The ISO 14001:2015 Companion - https://advisera.com/books/the-iso-14001-2015-companion/

• Personal data processing and Privacy statement

  1. I have a question about the example they have describe as ABC company and XYZ company- When the XYZ company is going to process my personal data for billing purpose- what rights i have against XYZ company and how can i prevent from using personal data. I feel if it is part of contract then my consent is not required. If they have not mentioned about XYZ company then how can i limit the ABC from Processing my personal data?

  If a company issues an invoice to you of course they need to mention some information on the invoice such as your name. Usually is the tax code of each country that provides you with the minimum information that needs to be included in the invoice. The processing  of personal data for invoicing purposes is based on legal obligation.

  2. Does privacy statement on the website can carry sufficient and common information to all of its customers?

  The Privacy Statement/ Notice on the website should clearly mention the purposes and lawful basis for which each set of personal data is being processed.

  If you want to find out more about Privacy Notices check out this free webinar “Privacy Notices under the EU GDPR” (https://advisera.com/eugdpracademy/webinar/privacy-notices-under-the-eu-gdpr-free-webinar/).

• GDPR topics

  1. Is the GDPR applicable for individuals as well as companies?

  The GDPR applies primarily to businesses established in the EU or inextricably linked
  to such a business. However, it also applies to businesses outside the EU that: offer goods or services; or monitor the behavior of individuals in the EU.

  It also applies to individuals if the activities exceed normal household activities.

  2. If I am an individual booking safari trips for European customers is the GDPR applicable?

  It would be applicable if you are intentionally targeting individuals in the EU. However, if you are collecting the personal data while the individuals are not in the EU then the GDPR would not be applicable.

  3. Is social security number or similar considered personal data?

  Yes it is. Moreover, there are some EU jurisdiction where the social security number or similar identification number are considered sensitive personal data.

  If you want to find out more about what constitutes personal data under he EU GDPR check out this free EU GDPR Foundations Course ( https://advisera.com/training/eu-gdpr-foundations-course//)

  4. Is it legal to require copies of passports to the tourists?

  Keeping such copies is legal only if you have a specific legal requirement that allows to do so. Unless this is applicable keeping copies of ID documents is contrary to the principle of data minimization.