Rebecca Laratte’s Post

Information security policy 5.2 of ISO 27001:2022 Information security policy is commitment of top management on behalf of the organisation which is documented and is made available to interested parties. Anytime when policy changes take place, such changes are notified to them. A policy is, foremost, a commitment of the top management towards external interested parties such as the customers, investors, regulatory bodies and public and children and so on. Policy is made by a thorough understanding of the business context and history and foresight of the organisation itself, and, the need and expectations of interested parties in the business. An information security policy cannot be a abstract or general statement. It should be appropriate for the purpose of the organisation ( its market, product and services) and should be able to give strategic direction to the organisation. It should help the functional managers find answers to their questions. For example, a company providing software development should explain it's business context clearly. The company - develops software application as per customer requirements and customers own the intellectual property rights of the product and the source code of software application or, - has it's own product and software application customisable to customer requirements and delivered to customers on dedicated licence to use - own product available at internet as software as service/plug and play, and available to subscribers (with or without KYC, KYC for financial transactions or other restrictive use I.e. unsuitable for children). Policies are commitments of the top management and they specially address needs and expectations of external interested parties. These must therefore be disclosed to the parties concerned. Policies also have a message for internal management or functional managers. Functional managers individually, by use of the policies, determine relevant objectives or expected result in defense of the policies. Top management may or may not set the objectives of each and every function but, it's policies provide a framework that lets individual functions decide their objectives in a way that the policy of the organisation is unharmed. Objectives of functions are kept higher (with safety margin) than the policy for the reason that policy is well defended from all sides. Many companies have information security policy but they keep it in files only to show it to auditors. In some cases, these are too abstract and not appropriate to the business of the organisation. It is not uncommon that the policies are unknown to the top management or the board and the chief information security officer is the one who approves as well as implements the policy. These kind of things don't come out in open because policy is not shared with external interested parties. Such practices are unfair and not in the conformity with ISO 27001 standard. regards Krishna Gopal Misra

What is information security policy? 5.2 ISO 27001:2022 Information security policy is a formal statement from top management which is 1. appropriate to the business context. -An OEM (e.g.,Microsoft) of software products has a different business context than Service Providers like resellers or who develop and support software applications for requirements of customers. - A Service Provider even though it develops and supports products for customers, has no product right, no right of source code and no role in handling data. - An OEM (Microsoft) owns product IPR, source code of software but not the customer data. - Banks or hospitals have another business context, as they acquire the software from OEM on use licence to run their business and keep data in it at their responsibility. 2. for confidence in external interested parties (public, customers, employees, regulators, investors etc) that it is committed to data protection within stated scope.of the organisation. It forms a basis of business agreement in parties concerned and risks to overcome. For every set of interested parties, an organisation or its relevant business processes can have subsets of the info sec policy such as the following in acquisition, processing, storage, transfer and deletion of data. Example of these are ... - privacy privacy, for personal information of individuals and employees, - data sharing agreement, for sensitive business information between parties concerned (customer, supplier, regulatory etc), - acceptable use/user responsibility policy, for the users of IT assets (internal and external, in various roles), - policy to protect intellectual property, design, logo and digital signature of the organisation itself, etc 2. a message to all relevant functions or departments and processes within the organisation, who have to proactively think and determine the objectives in their areas of work and plan and control/overcome the risks or hurdles in achieving the objectives ( by identifying and assess, and treatment of risk in their areas) to show how they can secure the policy or commitment made by the top management to external interested parties. 3. information security policy is not just the commitment but an assurance to parties concerned that - - these commitment or policy will be fulfilled by establishing a credible and verifiable management system (PDCA approach) in all relevant business processes inside the organisation, and 4. Going further, the top management will - - come back to the interested parties and do timely disclosures of the results of achivement of the commitment, - - foresee the challenges/risks and will proactively address them, - -will learn from errors or failures in the past, remove the weaknesses if any in risk treatment, to ensure that errors in the past do not repeat - -will continue to improve the benchmark of performance from past levels to pursue journey in the strategic direction. regards Krishna Gopal Misra

🔒 Protecting Your Business Data: Understanding Security Risks in Spreadsheets 🔒 As businesses, we rely extensively on spreadsheets for data management and decision-making. But how often do we consider the security risks associated with them? Our latest blog explores the critical importance of auditing security risks in spreadsheets to safeguard your valuable business data. From understanding the potential threats to implementing robust security measures, we cover essential strategies to protect your organisation. 👉 https://d36.co/1bRcS #DataSecurity #Spreadsheets

User access policies are crucial for security and compliance. Our IT Risk Advisory team advises that companies regularly review and update these policies to mitigate risks. Is your company's user access policy robust enough? #cybersecurity #compliance

User access policies are crucial for security and compliance. Our IT Risk Advisory team advises that companies regularly review and update these policies to mitigate risks. Is your company's user access policy robust enough? #cybersecurity #compliance

User access policies are crucial for security and compliance. Our IT Risk Advisory team advises that companies regularly review and update these policies to mitigate risks. Is your company's user access policy robust enough? #cybersecurity #compliance

#Compliance and #audit processes are essential for ensuring your access #governance practices align with regulatory requirements and industry standards. By following best practices and implementing a strong access governance solution, your organization can enhance #security, build trust with stakeholders, and protect its valuable data. Learn how ⬇️ https://lnkd.in/eNE4XpzS

Security compliance software ensures organizations adhere to regulatory standards and effectively protect sensitive data. This software streamlines assessing, monitoring, and managing compliance with various security regulations and standards, such as GDPR, HIPAA, PCI DSS, etc. It provides comprehensive features like risk assessment, policy management, audit trails, and automated compliance reporting, empowering businesses to proactively identify and address security gaps. Security compliance software helps organizations mitigate risks, safeguard their assets, and maintain trust with customers and regulatory bodies by centralizing compliance efforts and automating repetitive tasks. Five security compliance software in 2024:- 1. Vanta   It is a leading trust management platform that automates security compliance tasks. 2. Sprinto  It empowers tech companies' security programs with effective risk management and mitigation, evidence gathering, and compliance reporting. 3. Scrut Cloud Security   It provides organizations worldwide with tools to build a robust information security system to comply with regulatory standards. 4. Thoropass   It is an industry leader in compliance and information security audits. 5. CyberManager   It is a trusted leader in cybersecurity and is committed to protecting businesses in the cybersecurity field. #Security #compliance #resilient #cyber

Information security management system ISO 27001:2022 Case study 1 A company ABC providing IT services to its customers was acquired by another company XYZ. After acquiring ABC, customers of ABC became customers of XYZ. XYZ maintained an information security management system in its organisation but ABC didn't. XYZ conducted an audit for ABC to find a gap with regard to information security which it must fulfil in a given period. Auditors found out that ABC in its servers continued to keep the data of its de-boarded customers without their approval or knowledge. It was a non conformity or a detected failure of a given process of data deletion when a customer de-boarded. Procedure of XYZ required that it issues a DDRC ( Data Deletion/Return Certificate in accordance with data sharing agreement with customers) to its customer on the de-boarding. Management of XYZ asked internal auditors to check the activity log of servers in which such data of ABC resided. The purpose was to see whether the data of deboarded customers are untouched or touched; and even though, ABC didn't't have any such procedure and didn't follow the procedure, no risk occured. Auditors were to audit it and certify the fact about it. Auditors of XYZ certified that no data risk occurred. And in many cases, customers hope to come again and therefore, there was no clarity from the side of customers whether ABC should keep their data after the end of the agreement or not. The management of XYZ taken a decision that it should check with customers of ABC about their desire whether their data be returned to them or what should it do with them. Going further, XYZ information security policy and information security policy of its customers shall be included in data control obligation in the business agreement in them. Customers of ABC (now the customers of XYZ) shown pleasure with this way of XYZ giving them the visibility of the system as to how it will handle customer data and how it will return it after deboarding and will release a DDRC (certificate of data deletion and return in accordance with the agreement between parties concerned). regards Krishna Gopal Misra

https://lnkd.in/gAQWVdm8 Data security for compliance with 21 CFR Part 11, which governs electronic records and electronic signatures in the pharmaceutical and medical device industries, is crucial. Here are some key aspects to consider: 1. Access Control :-  Implement strong access controls to ensure that only authorized personnel have access to electronic records and signatures. This includes user authentication (e.g., username/password), role-based access control (RBAC), and logging access activities. 2. Data Encryption :- : Encrypt electronic records both in transit and at rest to protect them from unauthorized access or tampering. Use strong encryption algorithms and ensure encryption keys are managed securely. 3. Audit Trails :- : Maintain comprehensive audit trails that record all actions related to electronic records and signatures. These audit trails should be secure, time-stamped, and include details such as who accessed the data, what changes were made, and when they occurred. 4. Data Integrity :-  Implement measures to ensure the integrity of electronic records throughout their lifecycle. This includes controls to prevent unauthorized changes, such as checksums or digital signatures, and ensuring that data is stored in a manner that protects against loss or corruption. 5. System Validation :- Validate computer systems used to manage electronic records to ensure they are compliant with regulatory requirements and function as intended. This includes validating software, hardware, and systems configurations. 6. Backup and Recovery :- Implement robust data backup and recovery procedures to prevent data loss and ensure the availability of electronic records in the event of a system failure or disaster. Regularly test backup systems to verify their effectiveness. 7. Training and Awareness :-  Provide training to personnel on data security policies, procedures, and their roles and responsibilities in maintaining data security under 21 CFR Part 11. Foster a culture of security awareness to mitigate risks associated with human error. 8. Vendor Management :-  If using third-party vendors for electronic systems, ensure they adhere to data security requirements and have appropriate controls in place. This includes assessing their security practices and contractual obligations related to data protection. 9. Periodic Reviews and Audits :- Conduct periodic reviews and audits of data security measures to identify and address any vulnerabilities or non-compliance issues. This includes internal audits as well as audits by regulatory authorities or external auditors. 10. Documentation :- Maintain accurate and complete documentation of data security policies, procedures, and controls. This documentation should demonstrate compliance with 21 CFR Part 11 requirements and be readily available for inspection. Hema Sharma Rohit Gupta sarang J. krishankant Medatwal