Reading time: ~ 3 min.

The ISO/IEC 27013:2021 standard on «Information security, cybersecurity and privacy protection— Guidance on the integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1» provides a guide for all the organizations that try to:

• manage the implementation of ISO/IEC 27001 after the one of the ISO/IEC 20000-1 standard (or vice versa);
• lead the implementation of the two standards (27001 and 20000-1) together;
• organize the integration of management systems (already implemented according to ISO/IEC 27001 and ISO/IEC 20000-1.
  

If we take a closer look at the both of the ISO/IEC standards, we can notice that the relationship between information security management (according to ISO/IEC 27001 standard) and the IT service management (accordin to ISO 20000-1 standard) is very close indeed.

As we can easily figure out, many organizations choose to integrate these management systems.

If we focus on the documentation, we can underline that there are also a lof of correlations with the management of compliance with personal data protection requirements as set by GDPR (General Data Protection Regulation, in the EU context) and the FADP (Federal Act on Data Protection - LPD, «Loi fédérale sur la Protection des données» or «Legge sulla protezione dei dati» | DSG, Bundesgesetz über den Datenschutz, in Switzerland).

We could also identify along the main benefits of an integration implementation of the information security management and service management the following:

• more credibility to the internal and external customers, and other stakeholders;
• lower cost of implementing, maintaining and auditing an integrated management system;
• substantial reduction in implementation time due to the integrated development of processes;
• last but not least: an organization certified for ISO/IEC 27001 can more easily fulfil the requirements for information security specified in ISO/IEC 20000-1:2018, 8.7.3, as ISO/IEC 27001 and ISO/IEC 20000-1 are complementary in requirements.

As we use to better focus on things with the help of our infographic, we're going to use one of them also in this case...

Reading time: ~ 3 min.

The ISO/IEC 27557:2022 standard on «information security, cybersecurity and privacy protection– application of ISO 31000:2018 for organizationl privacy risk management» provides a framework for assessing organizational privacy risk.

It is important to note that this framework takes into consideration the privacy impact as a component of the overall organizational risk and particularly in the way that follows:

• the organizational consequences of adverse privacy impacts on individuals;
• the organizational consequences of privacy events that damage the organization itself (e.g. by harming its reputation) without causing any kind of privacy impacts to individuals.

It is useful to remember that ISO/IEC 27557:2002 standard is based on the «ISO 31000:2018 – Risk Management – Guidelines».

This standard includes some specific considerations for organizational privacy risk and to support the organizations on the implementation of a Privacy Information Management System (PIMS), according to the «ISO/IEC 27701:2019 Security  techniques– Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management – Requirements and guidelines» standard.

The ISO/IEC 27557 standard therefore can be used for integrating risk management and compliance between the privacy requirements set by the EU GPDR and the Swiss FADP (known as LDP and DSG).

It sounds quite interesting but it is a little bit confusing to figure out just considering our brief recap? Let's try to look at things from a different perspective with the help of our steady infographic.

Reading time: ~ 3 min.

• Data protection and privacy related matters (EU GDPR or the Swiss FADP - known also as LPD and DSG);
• Organization and Management Models Legislative Decree 231/01;
• CE marking of medical devices pursuant to MDR 745/2017;
• and many others mandatory requirements we should comply with.
  

Artificial Intelligence can help the compliance also with all the regulatory requirements we should consider for our business model. We can take here as example the ISO standards of the main management systems.

As we can see, Artificial Intelligence is the «core» of our smart model of governance, risk management and compliance scenario.

• monitoring the reference context;
• monitoring threats and vulnerabilities in risk management;
• managing due diligence.
  

• managing the feedback we get from users or customers (written content);
• managing the archiving activities of pics (visual content);
• improving security solutions based on facial recognition;

Reading time: ~ 2 min.

The Federal Act on Data Protection (as well as the OLPD) is expected to come into effect in the second half of 2022.

For Swiss organizations there will be a lot of challenges to face on privacy protection.This is the reason why we will focus together on this topic. 

On 6th and 7th October we will held an itSMF class on GRC and Data protection with the partnership of MGS. 

In conclusion, to know more details on this class as well as relevant news, you can just read our blog as well as follow us on our social channels.