itSMF Switzerland - Blog #ISO27001

The medical devices data protection compliance: EU Regulation 745/2017, GDPR and ISO 27001

Tue, 02 Jul 2024 10:09:53 +0200

Reading time: ~ 2 min.

The data protection compliance on medical devices

In our previous post on «Software as a Medical Device», we took a look in particular at the main related ISO management standards. In this new article, we are going to consider the data protection compliance on medical devices.

The first regulation that grab our attention is the «EU Regulation 2017/745 on Medical Devices» of the European Parliament and of the Council, of 5 April 2017 that came into force on 27 May 2017. It is known also as «MDR».

The Regulation (EU) 2017/745:

amends the Directive 2001/83/ECon the Community code relating to medicinal products for human use;
amends the Regulation (EC) no. 178/2002laying down the general principles and requirements of food law, establishing the European Food Safety Authority and laying down procedures in matters of food safety;
amends the Regulation (EC) no. 1223/2009on cosmetic products;
repeals the Council Directive 90/385/EEC on the approximation of the laws of the Member States relating to active implantable medical devices;
repeals the Council Directive 93/42/EEC concerning medical devices.

In its Article 110, the regulation on medical devices establishes that the medical devices that process personal data must comply with the applicable EU requirements. So we must take into consideration the General Data Protection Regulation (GDPR).

Medical devices and the data protection compliance according to the European GDPR

Medical Devices software that process personal data must therefore comply with European General Data Protection Regulation (GDPR) 2016/679 requirements and in particular with:

🔖 Article 25, on «Data protection by design and by default»;

🔖 Article 32, on «Security of processing».

Swiss companies aiming to launch Software as a Medical Device (SWas a MD) into the EU market must manage the compliance with the aforementioned GDPR articles as well as with the LPD/DSG, in particular with:

📘 Article 7, on «Protection of personal data by design and by default»;

📘 Article 8, on «Security of Data».

These companies can take advantage of an integrated compliance model between the two regulations, adopting the most relevant ISO standard.

The ISO 27001:2022 standard for the medical devices data protection compliance integration between EU and Switzerland

The medical data protection compliance integration can be managed with the help of the ISO/IEC 27001:2022 standard on «information security, cybersecurity and privacy protection – information security management systems – requirements».

To better figure out the «big picture», take a look at our infographic on medical devices data protection compliance integration according to the ISO 27001:2022 standard.

If you want to keep you up-to-date with the most recent news on this topic, don't forget to follow our social media or subscribe on our newsletter.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

The EU Network & Information Security 2 (NIS 2) Directive: a GRC approach with the main related ISO standards

Wed, 22 May 2024 18:08:00 +0200

Reading time: ~ 2 min.

The EU Network & Information Security 2 Directive (NIS 2)

Our today post is focused primarily on the Directive (EU) 2022/2555, the Network and Information Security directive issued by the European Parliament and the European Council, which is knowns also as the «NIS 2».

The NIS 2 Directive is focused on measures for a high common level of cybersecurity across the Union, and especially:

amending the Regulation (EU) No. 910/2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC;
amending the Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (Recast)Text with EEA relevance;
repealing the Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union.

We remember that this NIS 2 Direct (date 14 December 2022) entered into force on 13th January 2023 and its implementation in national regulation must be done on 17th October 2024 at the latest.

As an European Directive, it lays down the results or goals that each Member State must achieve, however it is up to the single country to devise their own laws on how to reach these results or goals.

Where does the EU Network & Information Security 2 Directive (NIS 2) apply?

The NIS2 applies to all the sectores that the law defines «critical», such as:

📘 energy;

📘 public services;

📘 financial services;

📘 health services;

📘 telecommunications;

📘 space;

📘 public administration;

📘 ect.

The EU Network & Information Security 2 Directive (NIS 2) structure

The Directive (EU) 2022/2555 on Network & Information Security (NIS 2) is divided in the following chapters:

🔖Whereas (144)

🔖 Chapter I: general provisions

🔖Chapter II: coordinated cybersecurity frameworks

🔖Chapter III: cooperation at union and international level

🔖Chapter IV: cybersecurity risk-management measures and reporting obligations

🔖Chapter V: jurisdiction and registration

🔖Chapter VI: information sharing

🔖Chapter VII: supervision and enforcement

🔖Chapter VIII: delegated and implementing acts

🔖Annex I: sectors of high criticality
🔖Annex II: other critical sectors

How can we manage the compliance with all the requirements set by NIS 2? Our solution is a GRC Approach: let's take a closer look in the chapter below.

How to apply the NIS 2 EU Directive?

We can choose a GRC approach to apply the Directive (EU) 2022/2555 that can be based on the main ISO standards in relationship with the law.

Lets check them out:

✅ ISO 20000-1 on IT services;

✅ ISO 27001 on Information Security; on Risk Management;

✅ ISO 22301 on Business Continuity;

✅ ISO 31000 on Risk Management;

✅ ISO 27035 on Incident Management.

Our infographic on the NIS2 Directive application with our GRC approach (and the main ISO standards)

To better figure out the «big picture», take a look at our infographic:

If you want to keep you up-to-date with the most recent news on this topic, don't forget to follow our social media or subscribe on our newsletter.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

The EU Regulation on Digital Operational Resilience Act (DORA): GRC approach and main related standards

Wed, 24 Apr 2024 07:00:00 +0200

Reading time: ~ 2 min.

The EU Digital Operational Resilience Act (DORA)

In our post, we're going to take a closer look to the EU Regulation 2022/2554, the Digital Operational Resilience Act for the financial sector issued by the European Parliament and the European Council (known as well as «DORA»).

First of all, we should remember that the EU Regulation (date 14 December 2022) entered into force on 16 January 2023 and it applies to the EU financial service providers.

We have to know that the Digital Operational Resilience Act amended also these regulations:

📘 Regulation (EC) No. 1060/2009;

📘 Regulation (EU) No. 648/2012;

📘 Regulation (EU) No. 600/2014;

📘 Regulation (EU) No. 909/2014;

📘 Regulation (EU) No. 2016/1011.

Let's check out in the next lines which requirements have been set by the lawmakers on the new «DORA».

The Digital Operational Resilience Act: the main requirements

The EU Regulation 2022/2554 defines in particular a set of requirements which are meant to ensure digital resilience and security.

The main parts of the Digital Operational Resilience Act on these matters are in the following chapters:

🔖 1. General Provisions

🔖 2. ICT Risk Management

🔖 3. ICT Related Incident Management Process

🔖 4. Digital Operational Resilience test

🔖 5. Managing of ICT Third Party Risk

🔖 6. Information Sharing Arrangement

How can we manage the compliance with all the requirements set by DORA? Our solution is a GRC Approach: let's take a closer look in the chapter below.

How to manage the compliance with DORA requirements?

We can support the management – in an integrated way – of the requirements set by the Digital Operational Resilience Act with the GRC approach based in particular on these ISO standards:

✅ ISO 38500 on Governance;

✅ ISO 31000 on Risk Management;

✅ ISO 37301 on Compliance Management.

This GRC approach provides a useful basis for addressing and integrating too the main aspects of these reference standards:

📘 Resilience and Business Continuity (ISO 22301);

📘 Information Security (ISO 27001);

📘 ICT Services (ISO 20000-1).

Our infographic on DORA requirements and the related ISO standards

To better figure out the «big picture», take a look at our infographic:

If you want to keep you up-to-date with the most recent news on this topic, don't forget to follow our social media or subscribe on our newsletter.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

The Central Bank of Bahrain requirements for ICT resource in financial sector: GRC approach and main related standards.

Tue, 02 Apr 2024 14:31:39 +0200

Reading time: ~ 2 min.

The Central Bank of Bahrain and the rulebook

The Central Bank of Bahrain (CBB) is the authority in charge of regulation and supervision of the whole financial sector of Bahrain.

Among all the laws and regulations available on the Central Bank of Bahrain documentation, we find its «CBBRulebook», that is made up of these parts:

📘 Common Volume

📘 Volume 1 (Conventional Banks)

📘 Volume 2 (Islamic Banks)

📘 Volume 3 (Insurance)

📘 Volume 4 (Investment Business)

📘 Volume 5 (Specialised Lincensees)

📘 Volume 6 (Capital Markets)

📘 Volume 7 (Collective Investment Undertakings)

In our article, we're going to take a closer look at the «Volume 1» on conventional banks.

The CBB Rulebook Volume 1 and its requirements

In its «Rulebook Volume 1» for conventional banks, the Central Bank of Bahrain set the requirements applicable to the ICT resources management.

In particular, is the Part A about «Business Standards Section» that provides us a focus on the relevant matter of operational risk management.

The CBB rulebook set in this section the following categories of requirements:

🔖 OM-A Introduction (executive summary, legal basis and module history)

🔖 OM-B Scope of application (Bahraini conventional and branches of foreign bank licensees)

🔖OM-1 General Requirements

🔖OM-2 Outsourcing requirements

🔖OM-3 Electronic money and electronic bank activities

🔖OM-4 Business Continuity Management

🔖OM-5 Security measures for banks

🔖 OM-6 Books and records

🔖 Appendix A, B and C (Loss event type classification, Cyber security control guidelines)

How can we manage these Rulebook requirements for ICT resources? Our solution is a GRC Approach: let's take a closer look in the next lines.

The ISO standards applicable to the CBB Rulebook requirements for ICT Resources

We can support the management – in an integrated way – of the requirements for ICT resources set by the Central Bank of Bahrain with the GRC approach based in particular on these ISO standards:

✅ ISO 38500 on Governance

✅ ISO 31000 on Risk Management

✅ ISO 37301 on Compliance Management

We should keep in mind, in this case, that the focus is on the information security, business continuity and IT services.

With the GRC approach on the ICT resources requirements management we can take advantage also of the chance to adopt and integrate the reference standards available, as the ISO standards and NIST standards.

These are the main relevant standards:

📘 Information security standard: ISO 27001;

📘 Cybersecurity framework standard: ISO 27110 and NIST standard;

📘 Business Continuity standard: ISO 22301;

📘 IT services standard: ISO 20000-1.

Our infographic on CBB rulebook ICT resources requirements and related ISO standards

To better figure out the «big picture», take a look at our infographic:

If you want to keep you up-to-date with the most recent news on this topic, don't forget to follow us through our social media accounts. Do you prefer to read our latest content on your e-mail? Subscribe now on our newsletter!

SUBSCRIBE ON OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

FINMA requirements for ICT resources in Swiss finance industry: GRC approach and main related standards

Wed, 20 Sep 2023 07:00:00 +0200

Reading time: ~ 4 min.

The ICT resources requirements for Swiss finance industry set by FINMA

As you probably already know, in Switzerland FINMA – Eidgenössische Finanzmarktaufsicht; autorité fédérale de surveillance des marchés financiers; autorità federale di vigilanza sui mercati finanziari – is the Financial Market Supervisory Authority.

This authority set indeed a lot of mandatory requirements for all the financial industry players and in particular today we're going to take a closer look at the FINMA Circular 2023/1.

The document has been issued in January 2023 by the authority and it is intended to substitute the previous one – the old Circular 08/21.

In the following lines, we're going to better figure out the main ICT resources requirements set by FINMA for the Swiss financial market that, we have to keep in mind that are subjected to supervision.

The Swiss finance industry ICT resources requirements set by FINMA 23/01 Circular

First of all, we would like to focus our examination on the «Chapter IV» of the aforementioned Circular 23/01 issued by FINMA, due to our GRC approach.

This fourth chapter of the document is indeed about the «Management of Operational Risks» and set in particular these six details:

✅ A. Transversal Management of Operational Risks

✅ B. ICT Risk Management

✅ C. Cyber Risk Management

✅ D. Risk management of critical data

✅ E. Business continuity management (BCM)

✅ F. Management of risks relating to the provision of cross-border services

We just did a brief examination of the Chapter 4 of the FINMA Circular 23/01, but we should keep in mind too that there are other regulations that the document set.

If we take the «Chapter V», we noticed that this one relates to the need of «Ensuring operational resilience».

At this point, we can just have a big question for our compliance strategy: how to can we systematically manage the requirements of the Circular 2023/01 applicabile to the ICT resources?

How to manage the ICT requirements for Swiss finance industry set by FINMA according to the more relevant ISO standards

It is probably correct to say that a modern GRC approach – base on the main ISO standards we can put in relation with the matter – can help us on supporting the integrated management of all the requirements applicable to ICT resources, which are:

Information security
Business continuity
IT services.

We should now figure out which ones are the ISO standards we can rely on to manage the requirements; and these are indeed:

ISO 38500, for the Governance;
ISO 31000, for the Risk Management;
ISO 37301, for the Compliance Management.

We should remember also that a modern GRC approach allows indeed the adoption and of course the integration of the several reference standards (E.G. ISO standards and the NIST standards), as follows:

📘 ISO 27001 «information security standard», ISO 27110 «cybersecurity framework standard» and the NIST standard;

📘 ISO 22301 «business continuity standard»;

📘 ISO 20000-1 «IT services standard».

To better figure out the «big picture» about what we just described in these last lines, we can bring as usual our infographic.

We end our brief overview on the FINMA requirements on ICT resources set by the Circular 2023/1 inviting you to stay tuned on our blog, social media channels and newsletter, to be always updated on the next news about this topic.

Don't forget to support our effort to bring you the best content quality and sharing value: follow us on our YouTube channel!

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Information technology and information security integration according to the ISO/IEC 27013:2021 standard

Wed, 22 Feb 2023 09:07:33 +0100

Reading time: ~ 3 min.

ISO/IEC 27013:2021 the link between information technology and information security

The ISO/IEC 27013:2021 standard on «Information security, cybersecurity and privacy protection— Guidance on the integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1» provides a guide for all the organizations that try to:

manage the implementation of ISO/IEC 27001 after the one of the ISO/IEC 20000-1 standard (or vice versa);
lead the implementation of the two standards (27001 and 20000-1) together;
organize the integration of management systems (already implemented according to ISO/IEC 27001 and ISO/IEC 20000-1.

If we take a closer look at the both of the ISO/IEC standards, we can notice that the relationship between information security management (according to ISO/IEC 27001 standard) and the IT service management (accordin to ISO 20000-1 standard) is very close indeed.

As we can easily figure out, many organizations choose to integrate these management systems.

ISO/IEC 27013:2021 the guidance on integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1 for organizations

If we focus on the documentation, we can underline that there are also a lof of correlations with the management of compliance with personal data protection requirements as set by GDPR (General Data Protection Regulation, in the EU context) and the FADP (Federal Act on Data Protection - LPD, «Loi fédérale sur la Protection des données» or «Legge sulla protezione dei dati» | DSG, Bundesgesetz über den Datenschutz, in Switzerland).

We could also identify along the main benefits of an integration implementation of the information security management and service management the following:

more credibility to the internal and external customers, and other stakeholders;
lower cost of implementing, maintaining and auditing an integrated management system;
substantial reduction in implementation time due to the integrated development of processes;
last but not least: an organization certified for ISO/IEC 27001 can more easily fulfil the requirements for information security specified in ISO/IEC 20000-1:2018, 8.7.3, as ISO/IEC 27001 and ISO/IEC 20000-1 are complementary in requirements.

As we use to better focus on things with the help of our infographic, we're going to use one of them also in this case...

At the final stage of our short overview on «Information technology and information security integration according to the ISO/IEC 27013:2021» we take leave and remember you that if you don't want to miss our newest content on GRC, don't forget to follow us on our LinkedIn page or subscribe to our newsletter.

If you are particularly interested in this topic, you should consider to attend our Annual IT Service Management Forum Day 2023, as we're going to share the expertise of: Digital&Privacy lawyer; ISO, SMS & Data Protection auditor and many other professionals.

More info on our hybrid Annual IT Service Management Forum Day 2023

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

The ISO 27002:2022 standard: the new information security controls

Wed, 23 Nov 2022 00:04:32 +0100

Reading time: ~ 4 min.

The Information Security: the controls set by the new ISO 27002:2022 standard

The International Organization for Standardization (ISO) has recently released the updated version of the guideline for the application of the operational controls for the ISO/IEC standard 27002:2022, also known as the «Information security, cybersecurity and privacy protection - Information security controls».

The new edition of ISO 27001:2022 Information Security Management Systems standard that the worldwide known Organization released some weeks ago – we gave you an update on our post here – refers to Annex A controls of ISO 27002 standard.

The ISO 27002 standard recognizes 4 large groups (clauses or themes) of operational controls:

Organization Controls (aspects related to the organization)
People Controls (details on single individual)
Physical Controls (objects and aspects related to physical & environmental matters)
Technological Controls (aspects related to the technology)

For each single control, the ISO 27002:2022 standard recognizes five attributes that constitute different ways you can adopt on considering the control.

In particular, 5 different views are defined which represent different categorizations of the controls seen from different perspectives:

The control type («when and how control changes risk» perspective);
The information security properties (integrity, availability and confidentiality perspectives);
The cybersecurity concepts (application of controls to information security perspective);
The operational capabilities (information security operations perspective);
The security domains (governance, protection, defense and resilience perspectives).

To better understand the way ISO 27002:2022 standard refers to the controls, you can take a look at this infographic:

A closer look at attributes of the controls set by the ISO 27002:2022 standard on Information Security

As we already suggested on the previous paragraph, the new ISO 27002:2022 standard on Information security, cybersecurity and privacy protection - Information Security Controls sets 4 macroscopic groups of operational controls.

Let's take a closer look at each of which, considering the 5 attributes and how they affect the way you can put them in perspective.

1. The Control Type attribute on ISO 27002:2022 standard

The first ISO 27002:2022 standard control attribute we are going to analyse - according to our infographic - is the «Control Type» one.

This one sets the way you can look at the controls from a perspective of «when and how the control modifies the risk» with regard to the occurence of an information security incident.

The «Control Type» attribute values consist of:

Preventive (the control that is intended to prevent the occurrence of an information security incident);
Detective (the control acts when an information security incident occurs);
Corrective (the control acts after an information security incident occurs).

2. The Information Security Properties controls attribute according to ISO 27002:2022 standard

The second of the controls attributes set by the ISO 27002:2022 standard we take into consideration is the «Information Security Properties» one.

In this case, the attribute set a point of view of the controls according to the perspective of

«which characteristic of information the control will contribute to preserving».

The attribute values consist of:

Confidentiality;
Integrity;
Availability.

3. The cybersecurity concepts controls attribute set by ISO 27002:2022 standard

The third of all the controls attributes recognised by the ISO 27002:2022 standard we are considering is the «Cybersecurity concepts» one.

This attribute suggests the way you can view the controls from a perspective of «the association of controls to cybersecurity concepts», as defined in the cybersecurity framework described in the ISO/IEC TS 27110.

In this case, the attribute value consist of:

Identify;
Protect;
Detect;
Respond;
Recover.

4. The ISO 27002:2022 operational capabilites controls attribute

The fourth attribute of the updated version of ISO 27002:2022 standard we are going to consider is the «operational capabilities» one.

This attribute helps us to view the controls from a «practioner's perspective of information security capabilities».

In this case, the attribute values are:

Governance;
Asset Management;
Information Protection;
Human Resource Security;
Physical Security, System and Network Security;
Application Security;
Secure Configuration;
Identity and Access Management;
Threat and Vulnerability Management;
Continuity;
Supplier Relationships Security;
Legal and Compliance;
Information Security Event Management;
Information Security Assurance.

5. The security domains controls attribute according to ISO 27002:2022 standard

The last of all the ISO 27002:2022 standard controls attributes we are going to mention is the one known as «Security domains».

This attribute provides us a controls view according to the «perspective of four information security domains», which are:

«Governance & Ecosystem» that includes the «Information System Security Governance & Risk Management» and the «Ecosystem cybersecurity management» (considering also the internal & external stakeholders);
«Protection» that considers all these topics: «IT Security Architecture», «IT Security Administration», «Identity and access management», «IT Security Maintenance» and «Physical and environmental security»;
«Defence»that contains the «Detection» and «Computer Security Incident Management» matters;
«Resilience» that includes «Continuity of operations» and «Crisis management».

The attribute values consist of:

Governance_and_Ecosystem
Protection;
Defence and Resilience.

Our «breakdown» on ISO 27002:2022 Organizational, People, Physical and Technological Controls

At the ending stage of our overview on the new ISO 27002:2022 standard on «Information security, cybersecurity and privacy protection - Information security controls» we'd like to provide you our breakdown on Organizational, People, Physical and Technological controls.

If you want to download our breakdown document, subscribe to our newsletter. Every month we update you with all the most relevant topics for our ICT Service Management professional community and we give you some preview of «what is happening behind the scenes».

SUBSCRIBE TO OUR NEWSLETTER TO GET THE ISO 27002:2022 DOCUMENT

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

The new Information Security Management System ISO27001 Standard edition 2022

Wed, 02 Nov 2022 07:00:00 +0100

Reading time: ~ 3 min.

The ISMS requirements set by the updated ISO27001 standard

In the last few days, the International Organization for Standardization (ISO) released its last updated 2022 version of the ISO/IEC 27001 standard on the Information Security Management Systems requirements.

Just in case you don't remember it, this update follows the first release (2005) and the revised version (2013) of one of the best known ISMS standard in the industry. What makes this updated ISO 27001:2022 version different from the previous ones?

First of all, the new standard is based on the High Level Structure(HLS) which is common to every System Management Standard set by ISO (as described on ISO Annex SL section). This a new (standardized) way to ensure the development of future MSS that are able to support each other.

The ISO 27001:2022 standard also brings to the table an interesting update on this matter. ISO aligned it with its standard ISO/IEC 27002:2022 (on Information Security, Cybersecurity and Privacy Protection - Information Security Controls).

Let's take a look at the details of this relevant change decided by the standards developer.

The Information Security Management System ISO27001:2022 and the alignment with ISO 27002

In the age of the rising concerns on privacy and data protection related matters, ISO took advantage of its HSL strategy on the update of its Information Security Management System standard (ISO 27001) aligning it to its 27002:2022 standard.

The Information Security, Cybersecurity and Privacy Protection - Information Security Controls standard (ISO 27002) identifies 4 large groups (clauses or themes) of operational controls:

organizational controls (organizational aspects);
people controls (single individual);
physical controls (physical & environmental objects and aspects);
technological controls (technological aspects).

I guess we probably can better figure out this approach with the help of this infographic:

The ISO 27002 2022: focus on the control 5.34

If we take a look in particular to the Technological Controls section, we notice that the «5.34 Privacy and Protection of Personal Identifiable Information (PII)» of the ISO 27002:2022 Standard clearly definies what the approach of the organization on the matter is supposed to be:

«The organization should identify and meet the requirements regarding the preservation of privacy and protection of PII according to applicable laws and regulations and contractual requirements»

Therefore the standard establishes a direct correlation between the management of compliance and the requirements set by the law according to the jurisdiction.

In the Swiss legal system, it is the Federal Act on Data Protection (known as LPD in Italian/French and DSG in German). In the European Union (EU) countries, it is the General Data Protection Regulation (commonly known as GDPR).

The ISO 27002:2022 and the final focus on the controls

At the final stage of our overview on the new Information Security Management System (ISO 27001) update and alignment with ISO 27002, we want to focus on how this last one standard identifies 5 attributes for each single control.

These attributes are different ways of looking at the single control. In particular, the standard defines 5 different views which represent different categorizations of the controls seen from different perspectives:

Control type (perspective of when and how control changes risk);
Information security properties (integrity, availability and confidentiality perspective);
Cybersecurity concepts (perspective of the association of controls to information security);
Operational capabilities (perspective of operations for information security);
Security domains (perspective of governance, protection, defense and resilience).

If you don't want to miss our next updates on Information Security Management System, requirements, ISO standards and compliance related matters, don't forget to follow us on our Linkedin Page or subscribe to our newsletter.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

GRC and Data Protection: the GRC approch in EU and Swiss contexts

Wed, 04 Aug 2021 05:00:41 +0200

Reading time: ~ 2 min.

Data protection between EU and Switzerland: the GRC Data Protection approach on GDPR and LPD-DSG-LPD (FDA)

GRC and Data Protection: what about the approach in Switzerland?

We already told you about the new Federal Data Protection Act (also known as LPD) that was enacted in Switzerland in our previous post. Today we are getting back on this topic considering one big challenge for the Swiss companies: the GRC and data protection between European Union and Switzerland.

Many organizations in Switzerland will face a double challenge. They have to manage compliance with the requirements of the LPD and, at the same time, with GDPR too. This one - as known - applies also to the EU citizens personal data processing carried out outside of the EU.

Many Swiss companies have to find a solution that could be suitable for both the contexts.
How to manage compliance with the requirements of the LPD and the GDPR in an integrated way?

The adoption of a common GRC approach (Governance, Risk Management, Compliance) based on the main ISO standards can be of great help.

This can be the right choice with particular reference to the following standards:

Risk management according to ISO 31000
Privacy Impact Assesment on ISO 29134
Compliance management (ISO 37301)
Information security management system (ISO 27001)
Business continuity management system (ISO 22301)
IT Service Management System (ISO 20000-1).

Due to this high relevance for a lot of companies, we will have a special focus on topic with a dedicated class.

ITSMF and MGS will have a partnership on the next class about GRC and Data protection between EU and Switzerland.

We will held this class on 6th and 7th October: but you will get more info about during the next weeks.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe the itSMF Newsletter

DISCOVER THE EVENT CALENDAR

Enter the itSMF Membership Program

GRC and data protection in Switzerland: structure and main requirements of the LPD

Thu, 22 Jul 2021 05:00:08 +0200

Reading time: ~ 2 min.

Data protection in Switzerland: the Swiss Federal Data Protection Act (DPA)

As is known, on September 25th, 2020, the Federal Data Protection Act (LPD) of Switzerland was enacted.
The LPD - similarly to the GDPR - has a three levels structure: you can find on it chapters, sections and single articles.
There are many clear correlations between the requirements of the Swiss LPD and the requirements of the European GDPR. These are:
The purpose and field of application.
The definition of personal data and processing.
The figures involved (data subject, data controller and data processor).
The applicable principles to the processing.
The rights of the data subject.
The privacy by design and by default.
The obligations of data controllers and processors.
The personal data protection.
The role of the data protection consultant.
The purpose and field of application.
The definition of personal data and processing.
The figures involved (data subject, data controller and data processor).
The applicable principles to the processing.
The rights of the data subject.
The privacy by design and by default.
The obligations of data controllers and processors.
The personal data protection.
The role of the data protection consultant.
How to manage the compliance with the requirements of the Swiss LPD? What is the right answer? Remember, every company has to pay attention to and comply with this act!

The adoption of a GRC (Governance, Risk Management and Compliance) approach based on the main ISO standards can be particularly useful, so we will check it on our next blog posts.

We are going to see how it is possible to execute everything in the right way in the next weeks: so please stay tuned!

Keep in mind also that we are going to take a deeper and closer look at this crucial topic on our next class by itSMF with the partnership of MGS.

This class is going to be scheduled on 6th and 7th October. We will keep you in touch shortly with some details and of course the enrollment.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe the itSMF Newsletter

DISCOVER THE EVENT CALENDAR

Enter the itSMF Membership Program