Making the Connection ISO Master Class An Overview

What is ISO? Making the Connection What does ISO stand for? International Standards Organisation World wide recognised body for standardisation Why is ISO important? International standard recognised by other countries Defined and measured standards on which organisations can be measured and compared Do we need ISO accreditation? Simply put NO we don’t However some sectors require certain standards, e.g. Governments, Financial Services, Insurance What ISO Standards are required? Depends on what type of business we are Key standards are; ISO 22301 – Business Continuity ISO 9001 – Quality Management ISO 27001 – Information Security ISO – Non-governmental organisation Formed in 1926 and reformed in 1947 164 member countries Over 20,000 standards including manufacturing, technology, food safety, agriculture and healthcare Iso term used for a cd image based on iso 9260

ISO 22301 – Business Continuity Making the Connection What is ISO 22301 Business Continuity Management? ‘Specifies the requirements for a management system to protect against, reduce the likelihood of and ensure your business recovers from disruptive incidents’ What does that mean? ’If there is a disruption to the business what do we about it’ Do we need ISO 22301? No we don’t, but it would be good to know what we would do in case of a disruption And, if we are doing that, why shouldn’t we follow good practise Do other organisations look for ISO 22301? Again it depends on the organisation, most will ask for Business Continuity Plan (BCP) Not many ask for ISO 22301 accreditation Business Continuity covers three key elements Resilience – ensure critical business functions and supporting infrastructure are designed and engineered to be unaffected by most disruptions Recovery – arrangement are made to recover or restore critical and less critical business functions that may have failed Contingency – establish a general capacity and readiness to cope effectively with major incidents or disasters occur

ISO 9001 – Quality Management Making the Connection What is ISO 9001 – Quality Management System? ‘A management system to continually monitor and manage quality across all operations, outlines ways to achieve and benchmark consistent performance and service’ What does that mean? How do we become a better business, save money, increase profit, win more business and satisfy customers Do we need ISO 9001? No we don’t need it, but we should do it if we’re serious about quality Do other organisations look for ISO 9001? Yes they do, its one of the most widely recognised standards Lots of sectors adopt ISO 9001, including Manufacturing, Government, Pharmaceuticals Over 1 Million companies world wide accredited Most widely recognised standard in the world Covers all areas of a business including; Facilities People Training Services Equipment

ISO 27001 – Information Security Making the Connection What is ISO 27001 – Information Security Management System? ‘A management system to identify risks to your important information and put in place appropriate controls to help reduce the risk’ What does that mean? How we manage, process and protect data within our business Do we need ISO 27001? Yes we do, because we are a data processor Do other organisations look for ISO 27001? Yes they do, its another widely recognised standard Lots of sectors adopt ISO 27001, including Financial services, Insurance and Government Information Security Simply the process of keeping information secure Confidentiality Protecting data from being disclosed to unauthorised parties Integrity Protecting information from being changed by unauthorised parties Availability Provision of information to authorised parties only when requested

Data Protection What is Data Protection? Making the Connection What is Data Protection? ‘ There are strict rules called the data protection principles, to make sure information is used fairly and lawfully, use for limited stated purpose, used in a way which is adequate, relevant and not excessive, accurate and kept safe and not transferred outside the EU’ What does that mean? ‘It is the controls put in place on how your personal information is used by an organisation, business or government’ What’s the difference between Data Protection and ISO27001? ISO 27001 is about systems, processes and controls in place to handle data Data Protection is about what the data is used for Personal data shall be processed fairly and lawfully Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further process in any manner incompatible with that purpose Personal data shall be adequate, relevant and not excessive Personal data shall be accurate and kept up to date Personal data processed for any purpose shall not be kept for longer than is necessary Personal data shall be processed in accordance with rights of the data subject Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data Personal data shall not be transferred to a country outside the European Economic Area unless it ensures adequate level of protection

European Data Protection Regulation Making the Connection What is the European Data Protection Regulation (EDPR)? ‘It is a pan-European standard set of rules for personal data protection.’ What are the changes from current legislation? Single set of rules, across EU Increased responsibility and accountability for organisations processing personal data Will only have to deal with ‘local’ data protection authority (ICO) People will have easier access to their own data and able to transfer to other organisations A ’right to be forgotten’ Rules apply to any company who handles personal data in the EU When does it come into effect? Beginning of 2018

Summary What is ISO? Why do we have International Standards? Making the Connection What is ISO? Why do we have International Standards? What are the standards for Business Continuity? Quality Management? Information Security? What is EDPR? What are the key ideas? How does it affect me?