Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11269 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Legitimate Interest Assessments template
Answer:
There is no such document in the toolkit and this is because entities can use different ways to assess their legitimate interests against the rights and freedoms of the data subjects.
The legitimate interest is provided as a lawful ground for processing by EU GDPR Article 6(1)(f) “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child” https://advisera.com/eugdpracademy/gdpr/lawfulness-of-processing/ and starting form this description an assessment would most likely be divided into three parts:
1. Purpose test: are you pursuing a legitimate interest and what is that legitimate interest?
2. Necessity test: is the processing necessary for that purpose, is legitimate interest the most suitable basis for pro cessing ?
3. Balancing test: do the individual’s interests override the legitimate interest?
To learn more about legitimate interests see this free online training GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course// -
Implementation options
Answer: ISO 27001 requires the establishment of responsibilities relevant to information security, but the organizations are free to divide them, or not, according to their necessities and perceived risks. So, it is possible to implement ISO 27001 without a division of responsibility in the business, provided that identified unacceptable risks related to not dividing responsibilities are properly treated.
These articles will provide you further explanation about responsibilities in ISO 27001:
- How to document roles and responsibilities according to ISO 27001 https: //advisera.com/27001academy/blog/2016/06/20/how-to-document-roles-and-responsibilities-according-to-iso-27001/
- Roles and responsibilities of top management in ISO 27001 and ISO 22301 https://advisera.com/27001academy/blog/2014/06/09/roles-and-responsibilities-of-top-management-in-iso-27001-and-iso-22301/
These materials will also help you regarding responsibilities in ISO 27001:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/
2 - What route to certification do you recommend? How can you help?
Answer: Regarding ISO 27001 implementation, you have three options:
- Implementing with your own employees
- Hiring a consultant
- Implementing by yourself with external support
Each one of them have their advantages and disadvantages, related to time, resources and knowledge. For more information, I suggest you the following materials:
- 3 strategic options to implement any ISO standard https://advisera.com/blog/2016/04/11/3-strategic-options-to-implement-any-iso-standard/
- Implementing ISO 27001 with a consultant vs. DIY approach https://info.advisera.com/27001academy/free-download/implementing-iso-27001-with-a-consultant-vs-diy-approach
Advisera is specialized in the third approach. We offer toolkits with templates and expert support, and also free material in form of articles, papers and webinars, to help you with your implementation project. Please see these materials for more information:
- ISO 27001 Documentation Toolkit https://advisera.com/27001academy/iso-27001-documentation-toolkit/
- How to use a Documentation Toolkit for the implementation of ISO 27001 / ISO 22301 [free webinar on demand] https://advisera.com/27001academy/webinar/how-to-use-a-documentation-toolkit-for-the-implementation-of-iso-27001-free-webinar-on-demand/ -
The Data Processing Agreement
Answer:
Your understanding is correct. The Data Processing Agreement is meant to be send to your processors, meaning your suppliers that process data on your behalf such as payroll providers, external call centers or marketing companies sending SMS or emails on your behalf.
You can find more about controllers and processors by checking out our free EU GDPR Foundations Course https://advisera.com/training/eu-gdpr-foundations-course// -
B2B company
Answer:
Being a B2B company does not automatically mean that EU GDPR does not apply to you. You could be providing services( as a processor) to another company ( as controller) but while doing that you might be processing data of individuals. For example, a marketing company “A” performing an SMS campaign on behalf on company “B”. Company “B” would be processing data of individuals even if the individuals themselves are not customers of company “B”.
So, “directly” processing data as a controller in not the only prerequisite for the EU GDPR to be applicable to you.
Also, if you are established in the EU that would make you a controller in terms of processing data of your employees so the EU GDPR would be again applicable.
To find out more about controllers and processor you can go through our article “EU GDPR controller vs. processor – What are the differences? https://advisera.com/eugdpracademy/knowledgebase/eu-gdpr-controller-vs-processor-what-are-the-differences/ as well as our free EU GDPR Foundations Course https://advisera.com/training/eu-gdpr-foundations-course// -
GDPR data
Answer:
The personal data itself belong to the individuals (data subjects) and this is why the EU GDPR grants individuals extended rights as regard to their personal data.
The controllers only process the personal data for specific purposes using one of the six legal grounds for processing: consent, contract obligation, legal obligation, vital interests, public interest, and legitimate interest.
You can find out more about more about the individuals rights and legal basis for processing from our articles: “8 data subject rights according to GDPR “ https://advisera.com/eugdpracademy/knowledgebase/8-data-subject-rights-according-to-gdpr// and “Is consent needed? Six legal bases to process data according to GDPR” https://advisera.com/eugdpracademy/knowledgebase/is-consent-needed-six-legal-bases-to-process-data-according-to-gdpr/ -
Privacy Shield
Answer:
In addition to the controversial Privacy Shield deal with the US, the EU has adequacy agreements that allow companies to share data with Switzerland, Andorra, the Faroe Islands, Guernsey, Jersey, the Isle of Man, Argentina, Canada, Israel, New Zealand and Uruguay.
All of these agreements will be reevaluated in the near future to ensure that they up to par with the EU GDPR requirements. -
User data from 3rd party integrations
Answer:
If is reasonably possible yes. But I think is quite unlikely considering your business model.
However if the users, decide to send their data to Google Drive, Dropbox etc. then they should have the means to delete their data on their own. You may be able to facilitate that. -
Template content
We received this question:
>I read the answer..
>
>Inshort we need to make sure that all the other development projects that we undertake in the company should have risk assessment done somewhere in the project charter or project plan.
>
>or may be some document that does the project requirement analysis and identify the risks before initiating the design phase
>
>Correct me if I am wrong..
Answer: You must consider risk assessment in all phases of the projects (initiation, planing, execution, control and closing). The better way to ensure that is, as you assumed, by using a document to define how risks must be assessed and treated and when risk assessments must be performed. And the better part is that you can use the same risk assessment and treatment methodology you adopted for your organization (remember, the process is the same, either for the whole organization or for a single project, the difference being only that the project's scope is smaller than of the organization's). -
Security controls review
Answer: ISO 27001 does not prescribe how many times you need to review security controls, so you must define this periodicity based on criticality of processes, the results of risk assessments, recorded incidents and previous audit results (both internal and external).
This article will provide you further explanation about measuring and monitoring:
- How to perform monitoring and measurement in ISO 27001 https://advisera.com/27001academy/blog/2015/06/08/how-to-perform-monitoring-and-measurement-in-iso-27001/
These materials will also help you regarding measuring and monitoring:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Obtaining buy in for ISO 27001
1. You have an Organization where you want to implement ISO 27001 and controls
Example : I have nine information assets with threat, vulnerability and the Risk
Each asset information, there is a RISK. For this risk, you put controls, could be one control or more controls.
The stake holders will oppose for the controls, including staff members. As CISO, I have write an Statement of Applicability to the Management, indicating we have so many threats, staff do not know, how to access the risk, they not know how to interpret the results of a scan report, user awareness.
I need around 15 key points to say to the Management, why we choose ISO 27001 to implement. What are the benefits of this?
How we can convince them, these are the benefits, and if you do not implement, we will have these issues. Key points.
How we put Arguments for the resistance we have. Key points
Please provide the key points for me please.
Answer: In general way, the benefits of ISO 27001 are related to:
- Enhanced competitive edge
- Reduction on losses due to security incidents
- Reduction on fines due to legal or contractual non conformity
- Improvement of internal organization
For a more robust presentation I suggest you to pick some examples from your organization's own context so the top management can clearly understand the benefits (e.g., name competitors that do not have the certification and that you can stand ahead of them, mention incidents that already occurred and how they can be prevented, which specific laws and regulations can be better supported, etc.).
To build your presentation, I suggest you to take a look at our free download Why ISO 27001 – Awareness presentation at this link: https://info.advisera.com/27001academy/free-download/why-iso-27001-awareness-presentation
You can use this template as basis for your presentation, adjusting it accordingly your needs.
These articles will provide you further explanation about ISO 27001 benefits:
- Four key benefits of ISO 27001 implementation https://advisera.com/27001academy/knowledgebase/four-key-benefits-of-iso-27001-implementation/
- How to gain employee buy-in when implementing cybersecurity according to ISO 27001 https://advisera.com/27001academy/blog/2017/07/03/how-to-gain-employee-buy-in-when-implementing-cybersecurity-according-to-iso-27001/
These materials will also help you regarding ISO 27001 benefits:
- ISO 27001 benefits: How to obtain management support [free webinar on demand] https://advisera.com/27001academy/webinar/iso-27001-benefits-how-to-get-management-buy-in-free-webinar-on-demand/
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/