Information Security And Data Protection Flashcards
Learn about legal requirements and standards in Information Security (IS).
Identify local (i.e. UK) legislation dealing with IS and data protection.
Computer Misuse Act 1990
Network and Information Systems Regulations (NIS Regulations)
Privacy and Electronic Communications Regulations (PECR)
Freedom of Information Act 2000
Data Protection 2018
Identify global standards and regulations applicable in the UK.
ISO/IEC 27001 standards
By following these frameworks, organisations can generate consistent output and ensure uniformity throughout their industry.
General Data Protection Regulation (GDPR)
Any organisation that processes personal data of EU residents must comply with GDPR.
What does ISO 27000 require?
To comply with ISO/IEC 27001, an organisation must:
Establish and continually improve an Information Security Management System (ISMS)
Conduct risk assessments, implement appropriate security controls, and maintain detailed documentation
Ensure a systematic approach to managing and protecting information assets.
What are GDPR requirements?
Any organisation is required to adhere to data protection principles, respect the rights of data subjects, GDPR requires that the organisations:
Conduct data protection impact assessments for high-risk processing.
Promptly report data breaches.
Demonstrate accountability through comprehensive data governance practices.
What are the Data Protection Act 2018 requirements?
That an organisation processes personal data lawfully, transparently, and securely.
Ensuring it is used for its intended purposes and safeguarded with adequate security measures.
Individuals are able to access, amend, or remove their data, reinforcing their privacy rights.
What requirements does the Privacy and Electronic Communications Regulations (PECR) place on organisations?
Ensuring that they have consent to send electronic marketing messages.
Providing clear information and obtain consent regarding cookies (unless the cookies are strictly necessary).
Maintaining the security and confidentiality of their electronic communications services.
What does Computer Misuse Act 1990 stipulate?
An organisation must ensure that their systems are secure against unauthorised access.
Organisations have to make sure that the employees are aware of and comply with the legal standards regarding the use of computer systems.
What demands does Network and Information Systems Regulations (NIS Regulations) place on organisations?
Any organisation needs to assess their cybersecurity risks, implement effective security measures.
They ought to have a plan in place for responding to and reporting significant cybersecurity incidents.
What are the organisation’s responsibilities according to the Freedom of Information Act 2000?
If an organisation works with public bodies or hold information on behalf of the public sector, they may need to comply with requests for information under this Act.
It needs to be aware of the types of information that might be subject to such requests.
It is bound to have processes in place to manage and respond to them appropriately.
What are the general consequences of non-compliance?
Operational disruptions: a data breach might require significant resources to address, diverting attention from normal business activities.
This can disrupt services, reduce operational efficiency, and increase operational costs, affecting the company’s bottom line.
Impact on International Operations
Non-compliance in one jurisdiction can have cascading effects on global operation, e.g. GDPR non-compliance can result in restrictions on data transfers between the EU and other regions. potentially disrupting international operations.
What are the implications of ISO/IEC 27001 non-compliance?
While not a legal requirement, noncompliance where a certification is required can lead to:
Loss in certification
Reputational damage
Loss of business
Breach of contract.
What are the implications of Data Protection Act 2018/GDPR non-compliance?
The UK’s Data Protection Act 2018 enforces GDPR standards, and non-compliance can result in following:
Fines can reach up to £17.5 million or 4% of the annual global turnover,
Enforcement actions,
Mandatory audits,
Loss of trust among customers and partners
What are the possible implications of Privacy and Electronic Communications Regulations (PECR) non-compliance?
Violations of PECR can lead to:
Fines of up to £500,000, which includes breaches involving unsolicited communications and improper use of cookies and similar technologies.
What are the possible consequences of Network and Information Systems Regulations (NIS Regulations) non-compliance?
Failure to comply with the NIS Regulations can result in:
Fines up to £17 million the annual global turnover.
These sanctions are imposed for inadequate cybersecurity measures or failure to report significant incidents.
What are the repercussions for Computer Misuse Act 1990 non-compliance?
Breaching the Computer Misuse Act by unauthorised access to computer material can lead to:
Criminal charges, with penalties including fines and imprisonment.
This affects not just the corporation but also individual employees involved in such activities.
