The organization has established a procedure for conducting internal audits. The procedure shall describe at least:
Compliance with required laws, regulations, standards, and contractual obligations can be as challenging as dealing with an ever-changing threat environment and new forms of cyber-attacks.
The organization shall document the information security requirements and the organisation's operating model for meeting them.
It is important to note that a large part of the requirements (e.g. laws, standards) are evolving entities. It is recommended to define a review interval for the documentation to describe the frequency at which changes in the requirements should at least be checked.
With regard to the processing of personal data, the data subject must be provided with the information specified in the GDPR in a concise, comprehensible and easily accessible form. This is often done in the form of privacy statements, which are published, for example, on the organisation's website.
Where personal data have not been collected from the data subject himself, the descriptions shall state, in addition to the basic content:
The organization conducts internal audits in accordance with its internal audit procedure. The aim is to check:
Documented information on the execution and results of audits must be kept.
Top management shall review the organization's information security management system at planned intervals to ensure that it remains appropriate, relevant and effective.
The management review shall address and comment on at least the following:
Documented information on the execution and results of reviews must be maintained.
Whenever we process personal data, the data subject has certain rights, e.g. gain access to their data and, in certain situations, oppose processing or have their data deleted.
We have planned procedures for handling data subject requests, which may include e.g.: