ISO Certification & Compliance

Highly qualified and motivated data protection professionals

Data security breaches, data theft, hacking and phishing are now everyday occurrences. Such breaches destroy reputations in an instant. As a result, increasing numbers of businesses now demand ISO certification as a matter of course before appointing any new data supplier.

To chat about your needs, email dc@datacompliant.co.uk or call 01787 277742

Compliance

Using ISO frameworks helps organisations support compliance with data protection regulations. DC helps you navigate the recent updates to the ISO standards.

Security: ISO 27001 is the information security standard which provides and Information Security Management System (ISMS) and risk management processes.
Management: BS 10012 sets out a personal information management system, to provide controls to prevent risks to personal information
Personal Data in the Cloud: ISO/IEC 27018, combined with a robust ISMS, ensures you address security issues related to personal data stored in the cloud

Data Compliant takes the pain out of the process

Using consultants and certified data auditors to provide organisational, technical, cyber and procedural measures for compliance and security throughout the stages to ISO certification:

Establish clear timeline detailing stages and personnel required
Gap analysis / risk identification
Production of policies and procedures manual
Implementation of manual throughout the business
Ongoing DPO (Data Protection Officer) support

BS 10012

BS 10012 is a British standard that provides a framework for a Personal Information Management System (PIMS). It is designed to help organizations comply with data protection laws such as the EU’s General Data Protection Regulation (GDPR). Key components include:

Data Protection Principles: Ensuring compliance with principles such as lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.
Risk Management: Identifying and managing risks related to personal data.
Roles and Responsibilities: Defining roles and responsibilities for data protection within the organization.
Data Subject Rights: Ensuring that individuals can exercise their rights regarding their personal data.
Consent Management: Managing consent from data subjects in a compliant manner.
Data Breach Management: Establishing processes for responding to data breaches.
Privacy by Design and Default: Incorporating privacy considerations into the design and operation of systems and processes.
Training and Awareness: Ensuring that staff are aware of data protection requirements and best practices.
Continuous Improvement: Regularly reviewing and improving the PIMS to ensure ongoing compliance and effectiveness.

BS 10012 helps organisations demonstrate their commitment to protecting personal data and complying with data protection regulations, thereby building trust with customers and stakeholders

ISO 9001

ISO 9001 is a standard that sets out the criteria for a Quality Management System (QMS). It is based on several quality management principles, including a strong customer focus, the motivation and implication of top management, the process approach, and continual improvement. The goal is to ensure that organizations consistently provide products and services that meet customer and regulatory requirements. Key components include:

Customer Focus: Understanding and meeting customer needs.
Leadership: Establishing unity of purpose and direction.
Engagement of People: Ensuring competent, empowered, and engaged people at all levels.
Process Approach: Managing activities as processes.
Improvement: Continual improvement of overall performance.
Evidence-based Decision Making: Basing decisions on the analysis and evaluation of data.
Relationship Management: Managing relationships with interested parties to optimize performance.

ISO 27001

ISO/IEC 27001 is the leading international standard for Information Security Management Systems (ISMS). It provides a framework for managing and protecting sensitive company information so that it remains secure. This standard helps organisations manage the security of assets such as financial information, intellectual property, employee details, or information entrusted by third parties. Key components include:

Risk Management: Identifying, assessing, and treating information security risks.
Security Controls: Implementing a set of controls to manage or reduce information security risks.
Continuous Improvement: Regularly reviewing and improving the ISMS to ensure it remains effective.
Leadership and Commitment: Ensuring top management is involved and committed to the ISMS.
Context of the Organisation: Understanding the internal and external issues that can affect the ISMS.
Support and Operation: Providing the necessary resources, awareness, and operational controls to support the ISMS.
Performance Evaluation: Monitoring, measuring, analysing, and evaluating the ISMS performance.
Compliance: Ensuring adherence to legal, regulatory and contractual requirements.

ISO 27001 promotes a holistic approach to information security, ensuring that all aspects of an organisation’s operations are considered and protected. This standard is crucial for organisations looking to enhance their information security posture and demonstrate their commitment to protecting sensitive information.

ISO 27002

ISO/IEC 27002 is an international standard that provides guidelines for selecting, implementing, and managing information security controls. It is designed to support the requirements of an Information Security Management System (ISMS) as specified in ISO/IEC 27001. Key components include:

Control Objectives and Controls: Provides a comprehensive set of security controls and control objectives to manage information security risks.
Access Control: Guidelines for managing access to information and information systems.
Cryptography: Recommendations for using cryptographic controls to protect information.
Physical and Environmental Security: Measures to protect physical assets and environments.
Operations Security: Procedures to ensure the secure operation of information processing facilities.
Communications Security: Controls to protect information in networks and its transfer.
System Acquisition, Development, and Maintenance: Security requirements for information systems throughout their lifecycle.
Supplier Relationships: Ensuring that suppliers and third parties comply with security requirements.
Incident Management: Processes for managing and responding to information security incidents.
Business Continuity Management: Ensuring the availability of information and information systems.
Compliance: Ensuring adherence to legal, regulatory and contractual requirements.

ISO 27002 serves as a practical guide for organisations to enhance their information security posture by implementing best practices and controls tailored to their specific needs.

ISO 27018

ISO/IEC 27018 is an international standard that focuses on the protection of Personally Identifiable Information (PII) in public cloud computing environments. It provides guidelines for implementing measures to protect PII in line with the privacy principles in ISO/IEC 29100. This standard is particularly relevant for cloud service providers acting as PII processors. Key components include:

PII Protection: Establishing controls to protect PII in public clouds.
Consent and Choice: Ensuring that PII is processed based on the consent of the data subject.
Purpose Limitation: Processing PII only for the purposes specified.
Data Minimisation: Collecting only the PII that is necessary for the specified purposes.
Use, Retention, and Disclosure Limitation: Ensuring that PII is used, retained, and disclosed only as necessary.
Accuracy and Quality: Maintaining the accuracy and quality of PII.
Openness, Transparency, and Notice: Providing clear information about PII processing practices.
Individual Participation and Access: Allowing data subjects to access and correct their PII.
Accountability: Ensuring accountability for PII protection.

ISO 27018 helps cloud service providers demonstrate their commitment to privacy and build trust with their customers by ensuring robust protection of personal data

ISO 27701

ISO 27701 is an extension to ISO 27001 and ISO 27002 for Privacy Information Management. It provides guidelines for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS). This standard helps organisations manage personal data and comply with privacy regulations such as GDPR. Key aspects include:

Privacy Risk Assessments: Identifying and managing privacy risks.
Privacy Controls: Implementing controls to protect personal data.
Roles and Responsibilities: Defining roles and responsibilities related to privacy management.
Consent Management: Ensuring proper management of consent from data subjects.
Data Subject Rights: Handling requests from individuals regarding their personal data.
Incident Response: Establishing processes for responding to data breaches and privacy incidents.

Both standards aim to enhance organisational processes and ensure compliance with relevant regulations, but they focus on different aspects of management—quality for ISO 9001 and privacy for ISO 27701

Data Compliant International

International data protection consultants and DPOs.

22 Friars Street, Sudbury, Suffolk, CO10 2AA

Email: dc@datacompliant.co.uk

Tel No.: +44 (0) 1787 277 742