Governance, Risk & Compliance (GRC) Service
ISO 27001 Compliance
ISO 27001 is an international information risk management standard that helps organizations keep their information assets secure. It includes all the legal, technical and physical controls of an organization’s information risk management processes. ISO 27001 is supported by its code of practice for information security management, ISO/IEC 27002:2013.
Achieving ISO 27001 certification shows that a business has:
- Protected information from getting into unauthorized hands
- Ensured information is accurate and can only be modified by authorized users
- Assessed the risks and mitigated the impact of a breach
- Been independently assessed to an international standard based on industry best practices
ISO 27001 certification demonstrates that you have identified the risks, assessed the implications and put in place systemized controls to limit any damage to the organization.
At Callens, we help companies to implement an ISO 27001 compliant information security management system (ISMS) by following these steps:
- Determine the scope of the project
- Conduct a risk assessment identifying key areas for review
- Implement the required controls and strengthen internal competence
- Develop documentation for the management system and conduct staff training
- Audit, review and analyze the information security management system
What are the benefits of ISO 27001 compliance?
- Increased reliability and security of systems and information
- Improved customer and business partner confidence
- Increased business resilience
- Alignment with customer requirements
- Improved management processes and integration with corporate risk strategies
GDPR Assessment Solutions
GDPR Assessment Solutions from Callens The General Data Protection Regulation came to power on May 25, 2018. Designed to protect and empower all EU citizens’ data privacy, the EU GDPR controls how organizations handle personal information about their users.
How does GDPR impact your business?
The breach of GDPR regulation can be fined up to 4% of the annual global turnover or 20€ million, whichever is greater. The government has a tiered approach to fines e.g. an organization can be fined 2% for not having their records in order (article 28), not notifying the supervising authority and data subject about a breach or not conducting impact assessment.
Why do you need a Data Protection Officer under the GDPR? You would need to appoint a DPO under the following cases:
- The processing (of personal data) is done by public authorities or a public body, with an exception for courts and independent judicial authorities.
- The processing is done by processors who regularly and systematically observe ‘data subjects’ (EU residents) on a large scale.
- The processing involves specific ‘special’ data categories (which are defined in the GDPR), again on a large scale, as processing these special types of personal data is part of your institution.
