itSMF Switzerland - Blog #security information

The internal investigations of organizations according to the ISO 37008 standard

Wed, 03 Sep 2025 07:00:00 +0200

Reading time: ~ 3 min.

The management of internal investigations of organizations according to the ISO/TS 37008 standard

For internal investigation we understand the professional fact-finding process lead by (or for, if this process leading is transfered outside) an organization to establish facts in relation to supposed or suspicious wrongdoing, misconduct or noncompliance.

The internal investigation in indeed an integral part of organizational management and the standard ISO/TS 37008:2023 on «Internal investigations of organizations – Guidance» provides support for its implementation.

The internal investigation of organizations can examine cases such as bribery, fraudulent activities, harassment, violence or discrimination (just to mention some typical situations we can apply the standard to manage the process of fact-finding).

We can have different reasons why we need to lead an internal investigation, such as:

civil actions (liability, responsibility,...);
whistleblowing reports (discern between substantiated or unsubstantiated allegation);
external investigations led by regulators (need for reporting);
decision-making process (requirements set by laws, regulations, codes, policies,...).

We have to keep in mind that internal investigation is part of a compliance management system of an organization.

The ISO/TS 37008 standard structure

The ISO/TS 37008 standard has 11 main chapters and an «ANNEX A». This is an overview on the structure:

Chapter 1: scope
Chapter 2: normative reference
Chapter 3: terms and definitions

Chapter 4: Principles

4.1 Independent
4.2 Confidential
4.3 Competent and professional
4.4 Objective and impartial
4.5 Legal and lawful

Chapter 5: Support of internal investigations

5.1 Resources
5.2 Leadership and commitment

Chapter 6: Establishment of investigation policy or procedure
Chapter 7: Safety and protection measures

7.1 Preserving and securing evidence
7.2 Protection of and support to personnel involved in investigations
7.3 Anti-retaliation
7.4 Safeguarding

Chapter 8: Investigative process

8.1 Investigation team
8.2 Preliminary assessment
8.3 Determining the scope of the investigation
8.4 Investigation planning
8.5 Maintaining confidentiality
8.6 Liability caution to deter disclosure
8.7 No interference
8.8 Evidence
8.9 Interviews
8.10 Finalization process
8.11 Investigation report

Chapter 9: Potential remedial measures or improvements

9.1 Proposal of remedial measures and improvements
9.2 Interim remedial measures
9.3 A final plan for post-investigation remedial measures
9.4 Proportionality of remediation and improvement measures
9.5 Monitoring and enforcement of remedial measures

Chapter 10: Interaction with stakeholders

10.1 General
10.2 Planning
10.3 Measures for the communication process
10.4 Effective communication channels
10.5 Government and regulator communication
10.6 Self-disclosure to the authorities

Chapter 11: Disciplinary actions

Annex A Guidance on the use of this document (10

ISO 37008 standard: correlations between other standards and regulations

The ISO/TS 37008 standard is logically downstream of whistleblowing reports (we can consider for example the Italian Legislative Decree 24/2023 on whistleblowing).

This standard is also useful in correlation with:

ISO 37002:2021«Whistleblowing management systems – Guidelines»;
ISO 37001:2016«Anti-bribery management systems standard».

ISO 37008 provides support also in the implementation of the organization and management models (OMM) set by the Italian Legislative Decree 231/01 (corporate criminal Liability).

Our infographic on ISO/TS 37008 standard

To better figure out the «big picture» about the ISO/TS 37008 standard, take a look at our infographic:

If you want to keep you up-to-date with the most recent news on this topic, don't forget to subscribe to our newsletter: you will get a monthly update with the most relevant and valuable content from our experts!

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

Resilience and crisis management according to the ISO 22361 standard

Wed, 04 Jun 2025 12:13:52 +0200

Reading time: ~ 3 min.

ISO 22361 standard: the resilience and crisis management

The ISO 22361:2022 standard on «Security and resilience – Crisis management – Guidelines» provides an effective guidance for every kind of organizations aside from their type, size or industry to improve their crisis management capability.

This document is useful not only to plan, but also to set, keep up-to-date and enhance the strategic crisis management ability in every organization. It helps also to improve the capability to identify and manage crisis.

The ISO 22361 standard is relevant for the top management (strategic responsabilities) and useful for everyone who operates under the direction of top management. The guidance has several relationships and interdepencies with other topics.

In particular, the application of ISO 22361 can be suggested by ISO 22301:2019 standard on «Security and resilience – Business continuity management systems requirements».

This document defines the requirements for a business continuity management system, remembering that crisis management is very important.

The ISO 22361:2022 standard structure

The ISO 22361:2022 helps to design and develop the crisis management capability in organizations, setting out the principles and practises needed.

Organizations have to provide committed leadership, structures, supportive culture and competent personnel to enhance their crisis management capability. To make effective their approach to crisis management, organizations should apply a set of principles that determine the development of a crisis management framework.

The standard outlines them into the following main clauses:

Chapter 1: scope
Chapter 2: normative reference
Chapter 3: terms and definitions
Chapter 4: crisis management – context, core concepts, principles
Chapter 5: building a crisis management capabilities (with crisis management framework and crisis management process focus)
Chapter 6: crisis leadership
Chapter 7: strategic crisis decision making (challenges and complexities)
Chapter 8: crisis communication (guidelines from strategy, management of relationships and reputation, consistency of message, …)
Chapter 9: training, validation and learning from crises.

Our infographic on ISO 22361:2022 standard

To better figure out the «big picture» on ISO 22361 standard, take a look at our infographic:

ISO 22361 standard and its main references

The ISO 22361 standard not only provides an effective guidance on «Security and resilience – Crisis management»: it can be used to in the context of management systems for information security (ISO 27001 standard) and for IT services (ISO 20000-1 standard).

If we extend our point of view on ISO 22361 to other regulations, we find many references in the following:

📘 European Directive NIS 2 cybersecurity
📘 European DORA regulation (Digital Operational Resilience Act) for the finance sector
📘 Bank of Italy Circular 285 for resilience requirements
📘 Circular 01/2023 from FINMA (Switzerland) for resilience requirements

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

The information security risk management according to the ISO 27005 standard

Tue, 15 Apr 2025 09:43:13 +0200

Reading time: ~ 2 min.

ISO 27005 standard: the risk management of the information security

The ISO/IEC 27005:2022 standard on «Information security, cybersecurity and privacy protection — Guidance on managing information security risks» provides a useful guidance for all kind of organizations (no matter which type, size or industry).

ISO 27005 is useful for all the organizations that have already adopted an Information Security Management System according to the ISO 27001 standard to evaluate (assessment) and treat the information security risks.

If you want to have an overview on ISO/IEC 27001 Information Security Management System, check out our previous post. in the next lines, we're going to have a look at the 27005 standard structure.

The ISO/IEC 27005 standard structure

The ISO/IEC 27005 standard has 10 main chapters and an «ANNEX A». This is an overview on the structure:

Chapter 1: scope
Chapter 2: normative reference
Chapter 3: terms and definitions; with focus on:

3.1 «terms related to information security risk»
3.2 «terms related to information security risk management».

Chapter 4: structure of the document
Chapter 5: information security risk management; with focus on:

5.1 «information security risk management process»
5.2 «information security risk management cycles»

Chapter 6: Context establishment; with focus on:

6.1 Organizational considerations
6.2 Identifying basi requirements of interested parties
6.3 applying risk assessment
6.4 establishing and maintaining information security risk criteria

6.4.1 general
6.4.2 risk acceptance criteria
6.4.3 criteria for performing information security risk assessments

6.5 choosing an appropriate method

Chapter 7 Information security risk assessment process

7.1 general
7.2 identifying information security risks

7.2.1 identifying and describing information security risks
7.2.2 identifying risk owners

7.3 analysing information security risks

7.3.1 general
7.3.2 assessing potential consequences
7.3.3 assessing likelihood
7.3.4 determining the levels of risk

7.4 evaluating the information security risks

7.4.1 Comparing the results of risk analysis with the risk criteria
7.4.2 Prioritizing the analysed risks for risk treatment

Chapter 8 Information security risk treatment process

8.1 general
8.2 selecting appropriate information security risk treatment option
8.3 determining all controls that are necessary to implement the information security
risk treatment options
8.4 comparing the controls determined with those in ISO/IEC 27001:2022, Annex A
8.5 producing a statement of applicability
8.6 information security risk treatment plan

8.6.1 formulation of the risk treatment plan
8.6.2 approval by risk owners
8.6.3 acceptance of the residual information security risks

Chapter 9 Operation

9.1. performing information security risk assessment process
9.2 performing information security risk treatment process

Chapter 10 leveraging related ISMS processes

10.1 context of the organization
10.2 leadership and commitment
10.3 communication and consultation
10.4 documented information

10.4.1 general
10.4.2 documented information about processes
10.4.3 documented inforrmation about results

10.5 monitoring and review

10.5.1 general
10.5.2 monitoring and reviewing factors influencing risks

10.6 management review
10.7 corrective action
10.8 continual improvement

Annex A Examples of techniques in support of the risk assessment process

Our infographic on ISO/IEC 27005:2022 standard

To better figure out the «big picture» about the ISO 27005 standard, take a look at our infographic:

The ISO 27005:2022 is indeed a useful supplementation of the ISO 31000:2018 standard on «risk management – guidelines», as it applies the guidance provided by the second one to the specific topic of the information security risks.

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

FINMA requirements for ICT resources in Swiss finance industry: GRC approach and main related standards

Wed, 20 Sep 2023 07:00:00 +0200

Reading time: ~ 4 min.

The ICT resources requirements for Swiss finance industry set by FINMA

As you probably already know, in Switzerland FINMA – Eidgenössische Finanzmarktaufsicht; autorité fédérale de surveillance des marchés financiers; autorità federale di vigilanza sui mercati finanziari – is the Financial Market Supervisory Authority.

This authority set indeed a lot of mandatory requirements for all the financial industry players and in particular today we're going to take a closer look at the FINMA Circular 2023/1.

The document has been issued in January 2023 by the authority and it is intended to substitute the previous one – the old Circular 08/21.

In the following lines, we're going to better figure out the main ICT resources requirements set by FINMA for the Swiss financial market that, we have to keep in mind that are subjected to supervision.

The Swiss finance industry ICT resources requirements set by FINMA 23/01 Circular

First of all, we would like to focus our examination on the «Chapter IV» of the aforementioned Circular 23/01 issued by FINMA, due to our GRC approach.

This fourth chapter of the document is indeed about the «Management of Operational Risks» and set in particular these six details:

✅ A. Transversal Management of Operational Risks

✅ B. ICT Risk Management

✅ C. Cyber Risk Management

✅ D. Risk management of critical data

✅ E. Business continuity management (BCM)

✅ F. Management of risks relating to the provision of cross-border services

We just did a brief examination of the Chapter 4 of the FINMA Circular 23/01, but we should keep in mind too that there are other regulations that the document set.

If we take the «Chapter V», we noticed that this one relates to the need of «Ensuring operational resilience».

At this point, we can just have a big question for our compliance strategy: how to can we systematically manage the requirements of the Circular 2023/01 applicabile to the ICT resources?

How to manage the ICT requirements for Swiss finance industry set by FINMA according to the more relevant ISO standards

It is probably correct to say that a modern GRC approach – base on the main ISO standards we can put in relation with the matter – can help us on supporting the integrated management of all the requirements applicable to ICT resources, which are:

Information security
Business continuity
IT services.

We should now figure out which ones are the ISO standards we can rely on to manage the requirements; and these are indeed:

ISO 38500, for the Governance;
ISO 31000, for the Risk Management;
ISO 37301, for the Compliance Management.

We should remember also that a modern GRC approach allows indeed the adoption and of course the integration of the several reference standards (E.G. ISO standards and the NIST standards), as follows:

📘 ISO 27001 «information security standard», ISO 27110 «cybersecurity framework standard» and the NIST standard;

📘 ISO 22301 «business continuity standard»;

📘 ISO 20000-1 «IT services standard».

To better figure out the «big picture» about what we just described in these last lines, we can bring as usual our infographic.

We end our brief overview on the FINMA requirements on ICT resources set by the Circular 2023/1 inviting you to stay tuned on our blog, social media channels and newsletter, to be always updated on the next news about this topic.

Don't forget to support our effort to bring you the best content quality and sharing value: follow us on our YouTube channel!

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

ITIL et la protection des données personnelles

Wed, 11 Jan 2023 00:00:00 +0100

Temps de lecture: ~ 3 min.

L'importance de la protection des données personnelles

La protection des données personnelles est une partie de la securité de l'information qui concerne le traitement des données personnelles incluant les aspects de consentement, droits des personnes concernées et autres obligations légales.

Les fournisseurs de services doivent concevoir leurs services en prenant en compte la protection des données personnelles.

Même si le fournisseur opère dans un pays sans législation stricte en la matière, il doit avoir une politique de protection des données personnelles dans le cadre de ses opérations.

Éléments clefs d’une organisation conforme à la législation en matière de protection des données personnelles

Nous verrons dans les paragraphes suivants plus de détails sur les éléments clefs d'une organisation qui agit en conformité avec la législation sur la protection des données personnelles.

Politiques de rétention des données

Toute donnée personnelle traitée par une organisation devrait être traitée dans un but spécifique.

Quand le consommateur fournit ses données personnelles à une organisation il s’agit d’un prêt de données aux fournisseurs de services dans un but particulier.

L’organisation ne doit donc pas conserver ces données personnelles indéfiniment.

Le droit à l'oubli

Les consommateurs ont surtout les droits suivants concernant leurs données personnelles :

Accès aux données
Modification (rectification) des données
Suppression des données (droit à l’oubli)

À tout moment les consommateurs doivent pouvoir contacter le fournisseur de services pour faire valoir un ou plusieurs de ses droits. Des législations comme le RGPD Européen donnent des droits supplémentaires aux personnes concernées. Les organisations doivent donc s’informer sur la législation applicable dans leur(s) pays afin de prendre les mesures nécessaires.

Quand les consommateurs contactent l’organisation pour faire valoir un de ses droits concernant les données personnelles alors l’organisation doit utiliser la gestion des demandes services pour répondre à la demande.

«Privacy by default»

Les données personnelles doivent être traitées de la façon la plus sécurisée possible. C’est un engagement de l’organisation vis-à-vis des consommateurs.

La pratique ITIL4 de gestion de la sécurité de l’information peut être utilisée pour protéger les données personnelles. Cette pratique permet aux organisations de définir des mécanismes pour analyser les domaines ou les données personnelles sont le plus exposées à des risques de sécurité afin de réduire ces risques.

Cette pratique inclut des analyses de vulnérabilités de l’infrastructure utilisée pour traiter les données personnelles. Ces analyses sont utiles aux organisations pour définir précisément leurs engagements vis-à-vis des consommateurs sur la protection des données personnelles.

La pratique de conception des services

Si un des objectifs de l’organisation est garantir un certain niveau de protection des données personnelles – «privacy by default» – alors la pratique de conception des services peut aider à intégrer les activités correspondantes dans les opérations de l’organisation.

De même que le modèle d’amélioration continue la conception de services permet des modifications itératives qui aide l’organisation a augmenter en continu sa création de valeur.

Consentement implicite

Les organisations ont souvent besoin d’un consentement explicite des consommateurs pour stocker leurs données personnelles.

Par exemple un consommateur donne son accord explicite pour recevoir de l’information à propos de produits et services sur une base régulière.

Cependant dans certains cas le consentement pour la collecte et le stockage des données personnelles est implicite.

Se mettre en conformité

Afin de gérer les activités de traitement des données personnelles en conformité avec la législation, il est possible d'adopter une stratégie qui implique un «mapping» et une adaptation continue des solutions pour la protection des données.

Processus de mapping

Les organisations peuvent mapper les instances dans lesquelles les données personnelles sont collectées et traitées par les processus métiers.

Cette activité permet de définir quelles données personnelles sont nécessaires pour des activités métiers et quelles données sont inutiles et ne doivent pas être collectées.

Mapper les données aide les organisations à être conformes avec le principe suivant : toute donnée personnelle traitée par une organisation doit l’être dans un but particulier. La pratique ITIL4 de gestion de l’architecture est utile pour réaliser ce mapping des données.

Améliorations itératives

Les organisations qui souhaitent être (et rester) en conformité avec la législation en matière de protection des données personnelles doivent réaliser des changements réguliers en utilisant le modèle ITIL d‘amélioration continue.

Auteur: David Billouz

Vous voulez vous tenir au courant des news de itSMF Switzerland? Inscrivez-vous à notre newsletter ou connectez-vous à notre page d'entreprise sur LinkedIn.

SUIVEZ-NOUS SUR NOTRE PAGE LINKEDIN

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

SIEM, siete sicuri che sia davvero superfluo?

Wed, 10 Apr 2019 07:58:19 +0200

Reading time: ~ 3 min.

SIEM: un focus sulla sua utilità nel comparto IT

Nella bibliografia digitale SIEM ha un duplice significato: “Security Information and Event Management” se applicato in un ambito legato prettamente alla sicurezza e “Security Incident and Event Management” in ambito più di IT Governance ed IT Service Management ma ad ogni modo i due ambiti sono correlati tra di loro.

Da un punto di vista IT Service Management

Genericamente un “incidente” è un qualunque evento che conduce ad una interruzione non pianificata del servizio: il processo di Incident Management di ITIL p.e. ha come obiettivo primario quello di ristabilire la piena funzionalità del servizio il prima possibile per ridurre al minimo gli impatti sul business.

Un “problema” è la causa che genera l’Incidente: il processo di Problem Management ha come obiettivo, una volta ristabilita la funzionalità del servizio, di indagare per determinare la causa principale che ha causato l’incidente al fine di evitare il riproporsi di incidenti simili.

ITIL suggerisce di trattare gli incidenti di sicurezza con una particolare categorizzazione ed un separato flusso di lavoro con annessi specifici processi e procedure, sebbene come “migliore pratica” di base ogni incidente andrebbe opportunamente:

✔️identificato e registrato

✔️correttamente descritto ed associato ad un preciso cespite

✔️categorizzato (per tipologia di richiesta)

✔️prioritizzato (generalmente in funzione dell’impatto e degli SLA)

✔️preso in carico dall’operatore nella diagnosi ed investigazione della problematica

✔️se il caso scalato agli specialisti tecnici

✔️risolto e documentato

✔️chiuso dal Service Desk o centro operativo

Mentre un Incidente spesso viene gestito in modo reattivo, tanto più un Problema può essere trattato in modo proattivo quanto più dovrebbe essere alimentato da un sistema di Event Management che colleziona ed analizza in tempo reale gli eventi associati ai vari sistemi e dispositivi e propone degli avvisi agli operatori quando i valori di misurazione si avvicinano alle opportune soglie di preallarme.

Sempre maggiori sistemi e dispositivi di sicurezza ed infrastrutturali si standardizzano a dialogare efficacemente con le architetture di gestione degli eventi.

Da un punto di vista di Cyber Security Management

La sicurezza ha assunto un ruolo centrale da diverso tempo. Firewalls, IDS, IPS e affini sono un "must" in ogni rete. Questi dispositivi si dimostrano utili durante un attacco (prevenzione o blocco).Nella maggior parte dei casi però, queste tecnologie non dialogano tra di loro, inoltre non sempre è facile creare regole ad-hoc e adatte ad ogni situazione.

A tutto questo va aggiunto lo sforzo necessario nella gestione degli eventi, spesso manca il tempo, la competenza o entrambe le cose. La correlazione degli eventi permette di anticipare attacchi di diverso genere nel futuro. Questa tecnica risulta molto complessa e dispendiosa se eseguita manualmente o comunque non con sistemi automatici. L'essere "agile" comprende anche la rapidità nel prevenire (e non solo combattere) le minacce.

Un sistema SIEM permette proprio questo: correlare gli eventi tra loro, fornire risultati sul comportamento (behaviour analytic) e dimostrare i progressi ottenuti tramite l'implementazione di nuove regole, sistemi o tecnologie. Il SIEM va visto un po' come il centro dell'ecosistema nell'ambito IT, è infatti l'unico prodotto in grado di leggere le informazioni raccolte dai vari sistemi e di produrre dei risultati tecnici per il reparto IT, ma anche report definiti "C-Level" per il management. La possibilità di creare dei casi su misura, rende infine questo prodotto estremamente versatile.

Do you SIEM or not?

Ignorare l'utilità di un sistema SIEM, equivale a ignorare un livello di sicurezza meno visibile ma estremamente efficace.

Oggigiorno lo scenario di mercato mostra le grandi aziende sempre più attive nel segmento SIEM per la crescente necessità di dotarsi di misure di sicurezza con maggior efficienza ed efficacia possibile, tendono quindi per questo a strutturare dalla base il loro concetto di sicurezza in modo imprescindibile rispetto ai sistemi SIEM, ma le PMI dove si situano rispetto al loro concetto di sicurezza e quale fetta di budget annuale tendono a destinare dunque in questo ambito? Le PMI si sentono ancora sicure di ritenere questo strato di “intelligence” ed “analytics” superfluo rispetto ai sistemi tradizionali attivi e passivi per proteggersi efficacemente contro le minacce di sicurezza?

Abbiamo deciso di lanciare un sondaggio su questo tema importante per preparare al meglio, per tempo, il nostro prossimo evento dopo la pausa estiva e permetterci di raccogliere informazioni importanti per poter dare risposte giuste ed utili agli interessati. Grazie del vostro prezioso contributo.

Autore: Andrea Cherubini, presidente itSMF

>> Compila il questionario <<

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe the itSMF Newsletter

DISCOVER THE EVENT CALENDAR

Enter the itSMF Membership Program