Free ebook: NIS2 ready using ISO 27001 best practices
Download ebook

Data system listing and owner assignment

Critical
High
Normal
Low

Organisation must maintain a listing of used data systems and their owners. Owner is responsible for completing the related documentation and possible other security actions directly related to the data system.

Data system documentation must include at least:

  • System purpose and linked responsibilities
  • System's data location (covered in a separate task)
  • System's maintenance and development responsibilities and linked partners (covered in a separate task)
  • When necessary system's access roles and authentication methods (covered in a separate task)
  • When necessary systems interfaces to other systems (covered in a separate task)
Connected other frameworks and requirements:
I06: Pääsyoikeuksien hallinnointi
4 luku, 13 §: Tietoaineistojen ja tietojärjestelmien tietoturvallisuus
24. Responsibility of the controller
GDPR
5. Principles relating to processing of personal data
GDPR
32. Security of processing
GDPR

Documentation of partner contract status

Critical
High
Normal
Low

A supplier agreement will be drawn up with all partners directly or indirectly involved in the processing of data. The aim is to ensure that there is no misunderstanding between the organization and the supplier of parties' obligations regarding to complying with security requirements.

The organization shall include in the supplier agreement, as appropriate:

  • the data used by the supplier (and possible data classification) and staff receiving access to data
  • rules on the acceptable use of data
  • confidentiality requirements for data processing staff
  • parties responsibilities in meeting regulatory requirements
  • parties' concrete responsibilities in relation to data security (e.g. access control, monitoring)
  • reporting and correcting incidents
  • requirements for the use of subcontractors
  • allowing auditing supplier processes and controls related to the contract (and committing to correcting non-conformities)
  • a commitment to return or destroy data at the end of the contract
  • the supplier's responsibility to comply with organization's security guidelines
Connected other frameworks and requirements:
28. Processor
GDPR
15.1.3: Information and communication technology supply chain
ISO 27001
A.7.2.6: Contracts with PII processors
ISO 27701
5.21: Managing information security in the ICT supply chain
ISO 27001

Data processing partner listing and owner assignment

Critical
High
Normal
Low

The organization must maintain a list of partners who have access to confidential information. System vendors and processors of personal data are listed separately from other stakeholders because they play an active role in the processing of data.

Connected other frameworks and requirements:
28. Processor
GDPR
44. General principle for transfers
GDPR
26. Joint controllers
GDPR
15.1.1: Information security policy for supplier relationships
ISO 27001
8.1.1: Inventory of assets
ISO 27001

Documentation of data disclosures for data stores

Critical
High
Normal
Low

The data in a data store are, in principle, only available to that controller and under the same responsibility. If you pass data on to another organization for other use, you must clearly inform about it and state e.g. the recipient of the transfer and the legal basis.

Connected other frameworks and requirements:
12. Transparent information, communication and modalities for the exercise of the rights of the data subject
GDPR
28. Processor
GDPR
30. Records of processing activities
GDPR
A.6.2: Recording of PII disclosures
ISO 27018
A.7.3.7: PII controllers' obligations to inform third parties
ISO 27701

Inventory and documentation of data processing agreements

Critical
High
Normal
Low

The processors of personal data (e.g. providers of data systems, other partners using our employee or customer data) and the agreements related to the processing of personal data have been documented. The documentation includes e.g.:

  • Processor name and location
  • Purpose of processing data
  • Status of agreement
Connected other frameworks and requirements:
28. Processor
GDPR
13.2.2: Agreements on information transfer
ISO 27001
15.1.2: Addressing security within supplier agreements
ISO 27001
A.8.2.4: Infringing instruction
ISO 27701
5.14: Information transfer
ISO 27001

Evaluation of data processing agreement for important data processors

Critical
High
Normal
Low

Data processing agreements bind the actions of a personal data processing partner.

It can be important for us to require an important partner to take care of e.g. ensuring the confidentiality requirements for its personnel and restricting the use of other processors of personal data in connection with our data.

Connected other frameworks and requirements:
28. Processor
GDPR
15.1.2: Addressing security within supplier agreements
ISO 27001
5.20: Addressing information security within supplier agreements
ISO 27001

Data processing agreement analysis for most important system providers

Critical
High
Normal
Low

The processing agreement binds the actions of the data processor (such as the system vendor).

It can be important for us to ensure an important partner takes responsibility of e.g. access control (logging) and data recovery at the end of the contract according to our preferred policies.

Connected other frameworks and requirements:
28. Processor
GDPR
14.1.1: Information security requirements analysis and specification
ISO 27001
15.1.2: Addressing security within supplier agreements
ISO 27001
5.19: Information security in supplier relationships
ISO 27001
No items found.