Risk & Compliance/Legislation
C5: Optimize Your Information Security and Data Privacy Program with the ISO 27000 Family of Standards
Friday, June 9, 2023 9:30 AM - 10:30 AM
Room 403/404
IT security, cybersecurity, and privacy protection are vital for companies and organizations today. The ISO/IEC 27000 family of standards are designed to assist organizations in developing comprehensive information security and data privacy programs to avoid threats from evolving cybercrimes, lack of employee awareness and training, and violations of laws and regulations and the costly fines and reputational damages that could result should a breach or other incident occur. ISO/IEC 27001 is the perhaps one of the world’s best-known standards for information security management; however, additional best practices in data protection and cyber resilience are covered by several other standards in the ISO/IEC 27000 family. Together, these standards enable organizations of all industries and sizes to manage the security and privacy of their information assets and those entrusted to them by third parties. We’ll also discuss where these standards stand now that ISO/IEC 27001:2022 has been published as of late 2022. Specific standards that we will cover in our presentation will include: • ISO/IEC 27001 (ISMS) – the foundational element • ISO/IEC 27017 (cloud services security) • ISO/IEC 27018 (protection of PII in public clouds for PII processors) • ISO/IEC 27701 (PIMS) – and complementary GDPR certification frameworks such as Europrivacy Seal and the overlap with the EU Cloud Code of Conduct
| After this session, learner will: • Understand the application and intent of the main additional standards in the ISO/IEC 27000 family of standards outside of the most well-known in ISO/IEC 27001 • Understand why organizations would look to align their ISO/IEC 27001 certification with additional sector-specific standards in the ISO/IEC 27000 family and the associated benefits, including which organizations would be candidates for adopting each standard • Understand the additional effort included in aligning their ISO/IEC 27001 certification with additional sector-specific standards in the ISO/IEC 27000 family • Understand how their data privacy programs can be enhanced through the adoption of either ISO/IEC 27018 or ISO/IEC 27701 (or both) and know which is most beneficial for their organization • Understand how obtaining the Europrivacy Seal GDPR certification can be facilitated by already having an ISO/IEC 27701 certification and the overlap with the EU Cloud Code of Conduct |