1. Making the Connection
ISO Master Class
An Overview

2. What is ISO? Making the Connection What does ISO stand for?
International Standards Organisation
World wide recognised body for standardisation
Why is ISO important?
International standard recognised by other countries
Defined and measured standards on which organisations can be measured and compared
Do we need ISO accreditation?
Simply put NO we don’t
However some sectors require certain standards, e.g. Governments, Financial Services, Insurance
What ISO Standards are required?
Depends on what type of business we are
Key standards are;
ISO – Business Continuity
ISO 9001 – Quality Management
ISO – Information Security
ISO – Non-governmental organisation
Formed in 1926 and reformed in 1947
164 member countries
Over 20,000 standards including manufacturing, technology, food safety, agriculture and healthcare
Iso term used for a cd image based on iso 9260

3. ISO 22301 – Business Continuity
Making the Connection
What is ISO Business Continuity Management?
‘Specifies the requirements for a management system to protect against, reduce the likelihood of and ensure your business recovers from disruptive incidents’
What does that mean?
’If there is a disruption to the business what do we about it’
Do we need ISO 22301?
No we don’t, but it would be good to know what we would do in case of a disruption
And, if we are doing that, why shouldn’t we follow good practise
Do other organisations look for ISO 22301?
Again it depends on the organisation, most will ask for Business Continuity Plan (BCP)
Not many ask for ISO accreditation
Business Continuity covers three key elements
Resilience – ensure critical business functions and supporting infrastructure are designed and engineered to be unaffected by most disruptions
Recovery – arrangement are made to recover or restore critical and less critical business functions that may have failed
Contingency – establish a general capacity and readiness to cope effectively with major incidents or disasters occur

4. ISO 9001 – Quality Management
Making the Connection
What is ISO 9001 – Quality Management System?
‘A management system to continually monitor and manage quality across all operations, outlines ways to achieve and benchmark consistent performance and service’
What does that mean?
How do we become a better business, save money, increase profit, win more business and satisfy customers
Do we need ISO 9001?
No we don’t need it, but we should do it if we’re serious about quality
Do other organisations look for ISO 9001?
Yes they do, its one of the most widely recognised standards
Lots of sectors adopt ISO 9001, including Manufacturing, Government, Pharmaceuticals
Over 1 Million companies world wide accredited
Most widely recognised standard in the world
Covers all areas of a business including;
Facilities
People
Training
Services
Equipment

5. ISO 27001 – Information Security
Making the Connection
What is ISO – Information Security Management System?
‘A management system to identify risks to your important information and put in place appropriate controls to help reduce the risk’
What does that mean?
How we manage, process and protect data within our business
Do we need ISO 27001?
Yes we do, because we are a data processor
Do other organisations look for ISO 27001?
Yes they do, its another widely recognised standard
Lots of sectors adopt ISO 27001, including Financial services, Insurance and Government
Information Security
Simply the process of keeping information secure
Confidentiality
Protecting data from being disclosed to unauthorised parties
Integrity
Protecting information from being changed by unauthorised parties
Availability
Provision of information to authorised parties only when requested

6. Data Protection What is Data Protection?
Making the Connection
What is Data Protection?
‘ There are strict rules called the data protection principles, to make sure information is used fairly and lawfully, use for limited stated purpose, used in a way which is adequate, relevant and not excessive, accurate and kept safe and not transferred outside the EU’
What does that mean?
‘It is the controls put in place on how your personal information is used by an organisation, business or government’
What’s the difference between Data Protection and ISO27001?
ISO is about systems, processes and controls in place to handle data
Data Protection is about what the data is used for
Personal data shall be processed fairly and lawfully
Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further process in any manner incompatible with that purpose
Personal data shall be adequate, relevant and not excessive
Personal data shall be accurate and kept up to date
Personal data processed for any purpose shall not be kept for longer than is necessary
Personal data shall be processed in accordance with rights of the data subject
Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data
Personal data shall not be transferred to a country outside the European Economic Area unless it ensures adequate level of protection

7. European Data Protection Regulation
Making the Connection
What is the European Data Protection Regulation (EDPR)?
‘It is a pan-European standard set of rules for personal data protection.’
What are the changes from current legislation?
Single set of rules, across EU
Increased responsibility and accountability for organisations processing personal data
Will only have to deal with ‘local’ data protection authority (ICO)
People will have easier access to their own data and able to transfer to other organisations
A ’right to be forgotten’
Rules apply to any company who handles personal data in the EU
When does it come into effect?
Beginning of 2018

8. Summary What is ISO? Why do we have International Standards?
Making the Connection
What is ISO?
Why do we have International Standards?
What are the standards for
Business Continuity?
Quality Management?
Information Security?
What is EDPR?
What are the key ideas?
How does it affect me?