itSMF Switzerland - Blog #informationsecurity

The Central Bank of Bahrain requirements for ICT resource in financial sector: GRC approach and main related standards.

Tue, 02 Apr 2024 14:31:39 +0200

Reading time: ~ 2 min.

The Central Bank of Bahrain and the rulebook

The Central Bank of Bahrain (CBB) is the authority in charge of regulation and supervision of the whole financial sector of Bahrain.

Among all the laws and regulations available on the Central Bank of Bahrain documentation, we find its «CBBRulebook», that is made up of these parts:

📘 Common Volume

📘 Volume 1 (Conventional Banks)

📘 Volume 2 (Islamic Banks)

📘 Volume 3 (Insurance)

📘 Volume 4 (Investment Business)

📘 Volume 5 (Specialised Lincensees)

📘 Volume 6 (Capital Markets)

📘 Volume 7 (Collective Investment Undertakings)

In our article, we're going to take a closer look at the «Volume 1» on conventional banks.

The CBB Rulebook Volume 1 and its requirements

In its «Rulebook Volume 1» for conventional banks, the Central Bank of Bahrain set the requirements applicable to the ICT resources management.

In particular, is the Part A about «Business Standards Section» that provides us a focus on the relevant matter of operational risk management.

The CBB rulebook set in this section the following categories of requirements:

🔖 OM-A Introduction (executive summary, legal basis and module history)

🔖 OM-B Scope of application (Bahraini conventional and branches of foreign bank licensees)

🔖OM-1 General Requirements

🔖OM-2 Outsourcing requirements

🔖OM-3 Electronic money and electronic bank activities

🔖OM-4 Business Continuity Management

🔖OM-5 Security measures for banks

🔖 OM-6 Books and records

🔖 Appendix A, B and C (Loss event type classification, Cyber security control guidelines)

How can we manage these Rulebook requirements for ICT resources? Our solution is a GRC Approach: let's take a closer look in the next lines.

The ISO standards applicable to the CBB Rulebook requirements for ICT Resources

We can support the management – in an integrated way – of the requirements for ICT resources set by the Central Bank of Bahrain with the GRC approach based in particular on these ISO standards:

✅ ISO 38500 on Governance

✅ ISO 31000 on Risk Management

✅ ISO 37301 on Compliance Management

We should keep in mind, in this case, that the focus is on the information security, business continuity and IT services.

With the GRC approach on the ICT resources requirements management we can take advantage also of the chance to adopt and integrate the reference standards available, as the ISO standards and NIST standards.

These are the main relevant standards:

📘 Information security standard: ISO 27001;

📘 Cybersecurity framework standard: ISO 27110 and NIST standard;

📘 Business Continuity standard: ISO 22301;

📘 IT services standard: ISO 20000-1.

Our infographic on CBB rulebook ICT resources requirements and related ISO standards

To better figure out the «big picture», take a look at our infographic:

If you want to keep you up-to-date with the most recent news on this topic, don't forget to follow us through our social media accounts. Do you prefer to read our latest content on your e-mail? Subscribe now on our newsletter!

SUBSCRIBE ON OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

ICT resources in the Italian finance industry: the requirements set by Bank of Italy circular 285 (GRC approach and main related standards)

Wed, 25 Oct 2023 07:30:00 +0200

Reading time: ~ 5 min.

ICT resources in the Italian finance industry: the requirements set by Bank of Italy circular 285

In its Circular 285, Bank of Italy – the Italian central bank, member of the European System of Central Banks – defined the requirements for ICT resources in the finance industry, in regard to the companies that are subject to supervision.

In this 42th update to the original text of the Circular 285 released by the Italian central bank, we're going to dig deeper on the Title IV «corporate governance, internal controls and risk management» to figure out how to be compliant with a GRC approach (and the related ISO standards).

The circular 285 by Bank of Italy: focus on the 4th title

First of all, let's consider that these are the most relevant requirements which are applicable to ICT resources for all those finance industry companies under supervision according to the Circular 285 (chapter fourth):

Circular 285, Chapter 4: «Information systems»

✅ section I – general provisions

✅ section II – governance, organization and controls of the information system

✅ section III – ICT and security risk management

✅ section IV – the management of information security and ict operations

✅ section IV bis – the management of ict projects and changes

✅ section V – the data management system

✅ section VI – the outsourcing of the information system and the use of third parties for the provision of ICT services

✅ section VII – specific provisions on the «provision of payment services»

✅ annex A – corporate documents for the management and control of the information system.

In addition to all these requirements, according to our GRC approach we can focus on the Chapter V about business continuity too.

Circular 285, Chapter 5: «Business continuity»

In this case, we have to consider these requirements set by Bank of Italy:

✅ Annex A - business continuity requirements.

It is possible to manage the compliance to the Circular 285 requirements applicable to ICT resources with a modern approach?

GRC Approach (and related ISO standards) for the compliance to the Bank of Italy Circular 285 about requirements on ICT resources

Our answer is to manage the compliance according to a GRC approach that put together (combined management) the requirements applicable to ICT resources:

Information security
Business continuity
IT services.

We can match now for all these requirements the related ISO standards:

ISO 38500, for the Governance;
ISO 31000, for the Risk Management;
ISO 37301, for the Compliance Management.

We should remember also that a modern GRC approach allows indeed the adoption and of course the integration of the several reference standards (E.G. ISO standards and the NIST standards), as follows:

📘 ISO 27001 «information security standard», ISO 27110 «cybersecurity framework standard» and the NIST standard;

📘 ISO 22301 «business continuity standard»;

📘 ISO 20000-1 «IT services standard».

To better figure out the «big picture» about what we just described in these last lines, we can bring as usual our infographic.

We end our brief overview about the BANK OF ITALYrequirements on ICT resources set by the Circular 285 inviting you to stay tuned on our blog, social media channels and newsletter, to be always updated on the next news about this topic.

Don't forget to support our effort to bring you the best content quality and sharing value: follow us on our YouTube channel too!

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Information Security Incident Management according to the ISO/IEC 27035-2 standard

Wed, 28 Jun 2023 07:00:00 +0200

Reading time: ~ 3 min.

The information security incident management process according to the ISO/IEC 27035-2

On the previous post about this topic (see the part 1 here) we focused in particular onessential concepts and the stages on handling the information security incident: today we're going to take a closer look the the «Guidelines to plan and prepare for incident response» available on the PART 2 of the ISO/IEC 27035 Standard.

It is important to note that the second part of this standard gives us also a focus on how to learn lessons from the incident response itself, providing us a sort of «best practices» on handling better this matter.

Please be aware that these guidelines are related to on the «plan and prepare» and the «lessons learned» steps of the information security incident management model based on the ISO/IEC 27035-1:2023 standard.

The ISO/IEC 27035-2:2023 main aspects on the «plan & prepare» steps

If we consider the «plan & prepare» steps of the ISO/IEC 27035-2:2023, we can notice that the standard includes in particular these principal aspects:

✅ information security incident management policy and commitment of top management;

✅ information security policies, including those relating to risk management, updated at both organizational level and system, service and network levels;

✅ information security incident management plan;

✅ Incident Management Team (IMT) establishment;

✅ establishing relationships and connections with internal and external organizations;

✅ technical and other support (including organizational and operational support);

✅ information security incident management awareness briefings and training.

The ISO/IEC 27035-2:2023 main aspects on the «lessons learned» phase

If we take a look at the «lessons learned» phase as considered by the ISO/IEC 27035-2:2023, we can notice that the standard includes in particular these main aspects:

✅ identifying areas for improvement;

✅ identifying and making necessary improvements;

✅ incident Response Team (IRT) evaluation.

ISO/IEC 27035-2:2023 Information security incident management and the correlation with others standards

If we reflect on the others ISO standards we can put in relation with this ISO/IEC 27035-2, we can easily find out these ones:

ISO 27001 Information Security Standards (in particular Appendix A);
ISO 20000-1 Services (clause 8.6.1 incident management)
ISO 22301 Business continuity.

The ISO/IEC27035-2:2023 standard on information security incident management

In order to understand better how to manage and adjust this ISO standard let's take a look at this infographic:

We end our brief overview on «Information Security Incident Management according to the ISO/IEC 27035-2 standard»inviting you to stay tuned on our blog, social media channels and newsletter to be always updated on the next news about this topic.

If you want support our effort to bring you the best content quality and sharing value, do not forget to follow us on our LinkedIn page!

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Information Security Incident Management according to the ISO/IEC 27035-1 standard

Wed, 03 May 2023 07:00:00 +0200

Reading time: ~ 3 min.

The information security incident management process according to the ISO/IEC 27035-1

When it comes to thinking about an information incident response plan, a playbook, management framework or handling process it is probably common to take into consideration the ISO/IEC 27035-1:2016 standard on «Information technology — Security techniques — Information security incident management — Part 1: Principles of incident management».

ISO/IEC 27035-1:2016 is indeed the basis of this particular composite International standard on the information security incident management, where you can find essential concepts and the stages on handling this matter.

This ISO/IEC standard combines these concepts with principles giving us a guideline for a clearly defined approch to detecting, reporting, assesing and responding to incident and finally applying the lessons learned.

It is interesting to note that the principles suggested with ISO/IEC 27035-1:2016 can be applied to every organization, regardless its industry, size and nature. The organizations can manage the adjustement of the standard guidance according to their particular context and especially to their information security risk circumstances. This standard can be applied also to the organizations that provide external information security incident management services.

A closer look to the ISO/IEC 27035-1 standard on information security incident management

If you consider the ISO/IEC 27035-1:2016 approach on handling information security incident, you can notice that it includes the following steps:

✅ Plan & Prepare

✅ Detect & report

✅ Evaluate & decide

✅ Respond

✅ Lesson learned

On suggesting the handling management process, this standard recalls moreover these ISO/IEC standards:

✅ ISO 27035-2, standard that provides guidelines for incident response planning and preparedness.

✅ ISO 27035-3, standard that provides guidelines for ICT incident response (detect and report, evaluate and decide, respond).

The incident management and the relation with the management systems standards

The «concept» of incident management it is indeed related to the following management systems:

✅ IT Service Management Systems (ISO 20000-1 standard, Clause 8.6.1)

✅ Information Security Management Systems (standard ISO 27001, Control 5.24, 5.25, 5.26, 5.27, 5.28)

✅ Business Continuity Management Systems (ISO 22301 standard, Clause 8.4)

The incident management and the correlations with data breach requirements

If you think about information security incident management, you can of course immediately put it in direct correlation with the data breaches requirements set by the law on data protection as the European General Data Protection Regulation or the Swiss Federal Act on Data Protection.

The ISO/IEC27035-1:2016 standard on information security incident management

In order to understand better how to manage and adjust this ISO standard let's take a look at this infographic:

We end our brief overview on «Information Security Incident Management according to the ISO/IEC 27035-1 standard»inviting you to stay tuned on our blog, social media channels and newsletter to be always updated on the next news about this topic.

If you want support our effort to bring you the best content quality and sharing value, do not forget to follow us on our LinkedIn page!

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Information technology and information security integration according to the ISO/IEC 27013:2021 standard

Wed, 22 Feb 2023 09:07:33 +0100

Reading time: ~ 3 min.

ISO/IEC 27013:2021 the link between information technology and information security

The ISO/IEC 27013:2021 standard on «Information security, cybersecurity and privacy protection— Guidance on the integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1» provides a guide for all the organizations that try to:

manage the implementation of ISO/IEC 27001 after the one of the ISO/IEC 20000-1 standard (or vice versa);
lead the implementation of the two standards (27001 and 20000-1) together;
organize the integration of management systems (already implemented according to ISO/IEC 27001 and ISO/IEC 20000-1.

If we take a closer look at the both of the ISO/IEC standards, we can notice that the relationship between information security management (according to ISO/IEC 27001 standard) and the IT service management (accordin to ISO 20000-1 standard) is very close indeed.

As we can easily figure out, many organizations choose to integrate these management systems.

ISO/IEC 27013:2021 the guidance on integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1 for organizations

If we focus on the documentation, we can underline that there are also a lof of correlations with the management of compliance with personal data protection requirements as set by GDPR (General Data Protection Regulation, in the EU context) and the FADP (Federal Act on Data Protection - LPD, «Loi fédérale sur la Protection des données» or «Legge sulla protezione dei dati» | DSG, Bundesgesetz über den Datenschutz, in Switzerland).

We could also identify along the main benefits of an integration implementation of the information security management and service management the following:

more credibility to the internal and external customers, and other stakeholders;
lower cost of implementing, maintaining and auditing an integrated management system;
substantial reduction in implementation time due to the integrated development of processes;
last but not least: an organization certified for ISO/IEC 27001 can more easily fulfil the requirements for information security specified in ISO/IEC 20000-1:2018, 8.7.3, as ISO/IEC 27001 and ISO/IEC 20000-1 are complementary in requirements.

As we use to better focus on things with the help of our infographic, we're going to use one of them also in this case...

At the final stage of our short overview on «Information technology and information security integration according to the ISO/IEC 27013:2021» we take leave and remember you that if you don't want to miss our newest content on GRC, don't forget to follow us on our LinkedIn page or subscribe to our newsletter.

If you are particularly interested in this topic, you should consider to attend our Annual IT Service Management Forum Day 2023, as we're going to share the expertise of: Digital&Privacy lawyer; ISO, SMS & Data Protection auditor and many other professionals.

More info on our hybrid Annual IT Service Management Forum Day 2023

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Privacy & Risk Management according to ISO/IEC 27557:2022

Wed, 08 Feb 2023 07:00:00 +0100

Reading time: ~ 3 min.

ISO/IEC 27557:2022 the information security, cybersecurity and privacy protection standard

The ISO/IEC 27557:2022 standard on «information security, cybersecurity and privacy protection– application of ISO 31000:2018 for organizationl privacy risk management» provides a framework for assessing organizational privacy risk.

It is important to note that this framework takes into consideration the privacy impact as a component of the overall organizational risk and particularly in the way that follows:

the organizational consequences of adverse privacy impacts on individuals;
the organizational consequences of privacy events that damage the organization itself (e.g. by harming its reputation) without causing any kind of privacy impacts to individuals.

The relationship between the ISO/IEC 27557:2022 and ISO 31000:2018 standards

It is useful to remember that ISO/IEC 27557:2002 standard is based on the «ISO 31000:2018 – Risk Management – Guidelines».

This standard includes some specific considerations for organizational privacy risk and to support the organizations on the implementation of a Privacy Information Management System (PIMS), according to the «ISO/IEC 27701:2019 Security techniques– Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management – Requirements and guidelines» standard.

The ISO/IEC 27557 standard therefore can be used for integrating risk management and compliance between the privacy requirements set by the EU GPDR and the Swiss FADP (known as LDP and DSG).

It sounds quite interesting but it is a little bit confusing to figure out just considering our brief recap? Let's try to look at things from a different perspective with the help of our steady infographic.

ISO/IEC 27557 standard: the «bridge» to integrate risk management and compliance under EU and Swiss privacy regulations

In order to understand better this kind of scenario where the ISO/IEC 27557 standard can be used for an effective integration of risk management and compliance between the privacy requirements set by the UE GDPR and the Swiss FADP (known as well as LPD and DSG), we can take a look at this infographic:

We end our brief overview on «Privacy & Risk Management according to ISO/IEC 27557:2022 standard» inviting you to stay tuned on our blog, social media channels and newsletter to be always updated on the next news about this topic.

If you want support our effort to bring you the best content quality and sharing value, do not forget to follow us on our LinkedIn page!

If you are interested in this topic, you should consider to attend our Annual IT Service Management Forum Day 2023, as we're going to share the expertise of Digital&Privacy lawyer;ISO, SMS & Data Protection auditor and many other professionals.

More info on our hybrid Annual IT Service Management Forum Day 2023

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

The new Information Security Management System ISO27001 Standard edition 2022

Wed, 02 Nov 2022 07:00:00 +0100

Reading time: ~ 3 min.

The ISMS requirements set by the updated ISO27001 standard

In the last few days, the International Organization for Standardization (ISO) released its last updated 2022 version of the ISO/IEC 27001 standard on the Information Security Management Systems requirements.

Just in case you don't remember it, this update follows the first release (2005) and the revised version (2013) of one of the best known ISMS standard in the industry. What makes this updated ISO 27001:2022 version different from the previous ones?

First of all, the new standard is based on the High Level Structure(HLS) which is common to every System Management Standard set by ISO (as described on ISO Annex SL section). This a new (standardized) way to ensure the development of future MSS that are able to support each other.

The ISO 27001:2022 standard also brings to the table an interesting update on this matter. ISO aligned it with its standard ISO/IEC 27002:2022 (on Information Security, Cybersecurity and Privacy Protection - Information Security Controls).

Let's take a look at the details of this relevant change decided by the standards developer.

The Information Security Management System ISO27001:2022 and the alignment with ISO 27002

In the age of the rising concerns on privacy and data protection related matters, ISO took advantage of its HSL strategy on the update of its Information Security Management System standard (ISO 27001) aligning it to its 27002:2022 standard.

The Information Security, Cybersecurity and Privacy Protection - Information Security Controls standard (ISO 27002) identifies 4 large groups (clauses or themes) of operational controls:

organizational controls (organizational aspects);
people controls (single individual);
physical controls (physical & environmental objects and aspects);
technological controls (technological aspects).

I guess we probably can better figure out this approach with the help of this infographic:

The ISO 27002 2022: focus on the control 5.34

If we take a look in particular to the Technological Controls section, we notice that the «5.34 Privacy and Protection of Personal Identifiable Information (PII)» of the ISO 27002:2022 Standard clearly definies what the approach of the organization on the matter is supposed to be:

«The organization should identify and meet the requirements regarding the preservation of privacy and protection of PII according to applicable laws and regulations and contractual requirements»

Therefore the standard establishes a direct correlation between the management of compliance and the requirements set by the law according to the jurisdiction.

In the Swiss legal system, it is the Federal Act on Data Protection (known as LPD in Italian/French and DSG in German). In the European Union (EU) countries, it is the General Data Protection Regulation (commonly known as GDPR).

The ISO 27002:2022 and the final focus on the controls

At the final stage of our overview on the new Information Security Management System (ISO 27001) update and alignment with ISO 27002, we want to focus on how this last one standard identifies 5 attributes for each single control.

These attributes are different ways of looking at the single control. In particular, the standard defines 5 different views which represent different categorizations of the controls seen from different perspectives:

Control type (perspective of when and how control changes risk);
Information security properties (integrity, availability and confidentiality perspective);
Cybersecurity concepts (perspective of the association of controls to information security);
Operational capabilities (perspective of operations for information security);
Security domains (perspective of governance, protection, defense and resilience).

If you don't want to miss our next updates on Information Security Management System, requirements, ISO standards and compliance related matters, don't forget to follow us on our Linkedin Page or subscribe to our newsletter.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

The integrated ICT GRC in Swiss and Italian financial services industry

Wed, 19 Oct 2022 09:24:34 +0200

Reading time: ~ 3 min.

The ICT GRC requirements in financial services industry in Switzerland and Italy

If we take a closer look to the Italian and Swiss financial services industry, we can easily note that Bank of Italy (with its 285 Circular letter) and FINMA (with its 21/2008 Guidance, at the moment under reform) set the GRC requirements of the ICT systems of the banking and financial services companies.

How can we setup a hassle-free compliance according to the GRC requirements set by the two supervisory authorities? What kind of approach can help us to make sure to be compliant with all the rules?

The answer is an integrated management of Bankitalia and FINMA requirements applicable to ICT services in the financial and banking industries according to the GRC approach and ISO standards. Check it out our advice on the paragraph below.

The integrated management of ICT GRC requirements in Italy and Switzerland

The proposal of adopting a common GRC approach (Governance, Risk Management and Compliance) is the key to support in the best way the integrated management of the (complex) requirements set on the two different countries by their own authorities.

If you take a look at our infographic, you can figure out how the two jurisdictions have a set of rules on ICT systems of the companies on the banking and financial services industry:

corporate governance;
quality requirements;
IT infrastructure;
business continuity;
data protection.

The GRC of ICT requirements on financial services industries according to the relevant ISO guidelines

The common GRC approach for managing the requirements applicable on ICT systems of financial and banking services can usefully refer to the guidelines of the relevant ISO standards for this industry.

We can take advantage in particular of these ISO standards:

ISO 38500 for the ICT Governance;
ISO 31000 for the Risk Management;
ISO 37301 for the Compliance Management.

You can probably be wondering about which are the benefits on adopting this GRC approach strategy for your organization.

You should keep in mind, for example, that the both of the jurisdictions set compliance requirements on information security: you could easily manage them according to the ISO 27001 standard, without the need to set up two different models.

Another interesting solution to to be compliant with the IT services management requirements - another common point between Italy and Switzerland financial industry guidance set by the authorities - is to implement the ISO 20000-1 standard.

The last example that can help us to figure out how to make sure to be compliant with business continuity requirements set by Bank of Italy and FINMA is to adopt the ISO 22301 standard.

The integrated GRC management approach: the benefits for data protection and digital innovation

If you have taken a closer look at our infographic, you should notice that there is a focus on data protection requirements set by the two different jurisdictions.

Please remember that GDPR entered into force in 2016 (application since 2018). In Switzerland, the new FADP - this act has some differences and similarities with the European General Data Protection Regulation - will enter into force in September 2023.

Also in this case, the adoption of a common GRC approach allows us to support an integrated management solution to provide the required data protection standards set by the GDPR (in the EU context Italy belongs to) and the FADP - known also as LPD and DSG - in Switzerland.

Finally our GRC approach strategy can be the best way to support the systematic management of digital innovation implementing the ISO 56002 standard, the best choice to fix a common a relevant issue in the fintech industry.

We will come back for sure to this topic in the next posts. If you don't want to miss our latest updates, subscribe to our newsletter or follow us on our social media channels.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

GRC and Data Protection: the GRC approch in EU and Swiss contexts

Wed, 04 Aug 2021 05:00:41 +0200

Reading time: ~ 2 min.

Data protection between EU and Switzerland: the GRC Data Protection approach on GDPR and LPD-DSG-LPD (FDA)

GRC and Data Protection: what about the approach in Switzerland?

We already told you about the new Federal Data Protection Act (also known as LPD) that was enacted in Switzerland in our previous post. Today we are getting back on this topic considering one big challenge for the Swiss companies: the GRC and data protection between European Union and Switzerland.

Many organizations in Switzerland will face a double challenge. They have to manage compliance with the requirements of the LPD and, at the same time, with GDPR too. This one - as known - applies also to the EU citizens personal data processing carried out outside of the EU.

Many Swiss companies have to find a solution that could be suitable for both the contexts.
How to manage compliance with the requirements of the LPD and the GDPR in an integrated way?

The adoption of a common GRC approach (Governance, Risk Management, Compliance) based on the main ISO standards can be of great help.

This can be the right choice with particular reference to the following standards:

Risk management according to ISO 31000
Privacy Impact Assesment on ISO 29134
Compliance management (ISO 37301)
Information security management system (ISO 27001)
Business continuity management system (ISO 22301)
IT Service Management System (ISO 20000-1).

Due to this high relevance for a lot of companies, we will have a special focus on topic with a dedicated class.

ITSMF and MGS will have a partnership on the next class about GRC and Data protection between EU and Switzerland.

We will held this class on 6th and 7th October: but you will get more info about during the next weeks.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe the itSMF Newsletter

DISCOVER THE EVENT CALENDAR

Enter the itSMF Membership Program

GRC and data protection in Switzerland: structure and main requirements of the LPD

Thu, 22 Jul 2021 05:00:08 +0200

Reading time: ~ 2 min.

Data protection in Switzerland: the Swiss Federal Data Protection Act (DPA)

As is known, on September 25th, 2020, the Federal Data Protection Act (LPD) of Switzerland was enacted.
The LPD - similarly to the GDPR - has a three levels structure: you can find on it chapters, sections and single articles.
There are many clear correlations between the requirements of the Swiss LPD and the requirements of the European GDPR. These are:
The purpose and field of application.
The definition of personal data and processing.
The figures involved (data subject, data controller and data processor).
The applicable principles to the processing.
The rights of the data subject.
The privacy by design and by default.
The obligations of data controllers and processors.
The personal data protection.
The role of the data protection consultant.
The purpose and field of application.
The definition of personal data and processing.
The figures involved (data subject, data controller and data processor).
The applicable principles to the processing.
The rights of the data subject.
The privacy by design and by default.
The obligations of data controllers and processors.
The personal data protection.
The role of the data protection consultant.
How to manage the compliance with the requirements of the Swiss LPD? What is the right answer? Remember, every company has to pay attention to and comply with this act!

The adoption of a GRC (Governance, Risk Management and Compliance) approach based on the main ISO standards can be particularly useful, so we will check it on our next blog posts.

We are going to see how it is possible to execute everything in the right way in the next weeks: so please stay tuned!

Keep in mind also that we are going to take a deeper and closer look at this crucial topic on our next class by itSMF with the partnership of MGS.

This class is going to be scheduled on 6th and 7th October. We will keep you in touch shortly with some details and of course the enrollment.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe the itSMF Newsletter

DISCOVER THE EVENT CALENDAR

Enter the itSMF Membership Program