INFORMATION SECURITY CERTIFICATION

ISO 27701 is a standard that provides guidelines for managing and processing personally identifiable information (PII). It is an extension of the widely used ISO 27001 standard for information security management systems (ISMS), and helps bridge the gap between privacy and security.

The standard is intended to provide a point of integration between privacy protection and the management of PII within organizations. The standard specifically addresses requirements under the General Data Protection Regulation (GDPR) but also allows organizations to incorporate other privacy laws, regulations, and requirements into their privacy information management system (PIMS).

Implementing a PIMS using ISO 27701 can help organizations demonstrate effective privacy data management and provide a framework for privacy protection.

There are many potential benefits to having a robust PIMS, including building trust with stakeholders, providing transparency, clarifying roles and responsibilities, supporting compliance with privacy regulations, and reducing complexity by integrating with ISO 27001.

The process of obtaining ISO 27701 certification generally involves completing a request form for a formal quote, receiving a signed quotation, and preparing for the audit.

After certification, you will receive a certificate that is valid for three years, and your certification body will visit regularly to ensure that your system remains compliant and continues to improve.

The General Data Protection Regulation (GDPR) is a regulation in EU law on data protection and privacy for all individuals within the European Union (EU) and the European Economic Area (EEA).

Certification in GDPR is a process to demonstrate that an organization has implemented processes and procedures to comply with the regulations.

Baltum Bureau, as a certification body, offers a voluntary Data Protection Certification Scheme to help companies comply with GDPR standards.

The scheme is based on a Technical Standard that enables companies to implement comprehensive data protection processes and prevent potential security breaches, safeguard customer privacy, and protect critical data assets. To obtain GDPR compliance certification, an organization must prepare for certification by defining a personal data policy, creating a list of processing activities, defining a process to manage data subject rights, running a data protection impact assessment (DIPA), and making personal data transfers safe.

It is important to note that GDPR certification does not necessarily mean that an organization is GDPR compliant. The certification only signifies that the organization has implemented processes and procedures to comply with the regulations. The certification bodies are responsible for the proper assessment leading to the certification or the withdrawal of such certification, however, the controller or processor is still responsible for compliance with the regulation.

Achieving certification in GDPR compliance can bring several benefits to an organization. For example, certification can help organizations meet many of the requirements of GDPR, and is increasingly recognized as best practice for demonstrating progress towards compliance.

In addition to ensuring that security risks, threats and vulnerabilities are identified, prioritized and cost-effectively managed, organizations can also benefit from being certified in ISO/IEC 27001 and BS 10012.

The California Consumer Privacy Act (CCPA) is a privacy law enacted in 2018 by the state of California, USA, aimed at regulating the way businesses collect, use and share the personal information of California residents.

The CCPA is considered one of the strictest privacy laws in the United States and provides California residents with the ability to control how businesses process their personal information. Businesses are now required to honor requests from California residents to access, delete, and opt out of sharing or selling their information.

The CCPA aims to give users greater access to the information that is collected from them. Consumers can now know how businesses treat and share that information, creating a culture of transparency around consumer data.

Under the CCPA, consumers may request that businesses disclose to them information collected and the sources of the collected records. Businesses that are subject to the CCPA have several responsibilities, including responding to consumer requests to exercise their rights and giving consumers certain notices explaining their privacy practices.

The CCPA applies to many businesses, including data brokers, and businesses will have to bear the cost of compliance.

HIPAA certification is a process that assists organizations in becoming compliant with the Health Insurance Portability and Accountability Act (HIPAA).

HIPAA sets standards for the protection of electronic protected health information (ePHI) and the privacy of individuals. There are various private companies in the health sector that provide HIPAA certification, and it comes in different sizes, shapes, and formats.

The certification involves a third-party review of an organization’s compliance with the administrative, technical, and physical safeguards of the HIPAA Security Rule. In addition, there are various HIPAA certifications available, including CHPA, CHPE, CHSE, and CHPSE.

It is important for organizations to choose the right certification based on their exposure to protected health information (PHI) and involvement in compliance.

Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards designed to ensure that all companies that accept, process, store or transmit credit card information maintain a secure environment.

The goal of the PCI DSS is to protect against credit card fraud through increased controls around data and its exposure to compromise.

To obtain PCI DSS certification, a company must meet twelve requirements outlined by the PCI Security Council. The assessment of a company’s compliance with the PCI DSS standards is carried out by a Qualified Security Assessor (QSA). The PCI Security Council provides resources for merchants, such as credit card data security standards documents, PCI-compliant software and hardware, and qualified security assessors, to help them achieve and maintain PCI DSS compliance.

Cloud Security Alliance (CSA) is a leading organization dedicated to defining and promoting best practices for ensuring a secure cloud computing environment. The CSA offers the Certificate of Cloud Security Knowledge (CCSK) certification, which is widely recognized as the standard of expertise for cloud security. The CSA provides resources to help individuals prepare for and earn the CCSK credential, which covers a vendor-neutral understanding of how to secure data in the cloud.

The CCSP cloud security alliance certification, offered by (ISC), is another certification option for IT and cybersecurity professionals looking to apply cloud security best practices in their organizations. The CCSP demonstrates advanced technical skills and knowledge in the design, management, and security of data, applications, and infrastructure in the cloud, and provides support from a community of cybersecurity leaders.

Cyber Essentials is a certification program designed to help organizations demonstrate their commitment to cybersecurity. The certification is self-assessed, which means that organizations are required to answer a questionnaire provided by a certification body, such as Baltum Buroo. After evaluating the answers and performing an external vulnerability scan on the organization’s IP addresses, the certification body will determine whether the organization meets the requirements for certification.

Baltum Buroo may offer a range of services to help you prepare for and achieve certification, including support throughout the certification process.

SOC 2 (System and Organization Controls 2) is a compliance standard that was created by the American Institute of CPAs (AICPA) to define criteria for managing customer data based on five trust service principles: security, availability, processing integrity, confidentiality, and privacy.

The SOC 2 certification has become increasingly important as more companies collect and store customer data, as it holds businesses to a standard that protects consumer data and provides peace of mind for consumers.

The process of becoming SOC 2 compliant involves building a roadmap with the help of an auditor and dedicating a significant amount of time to building SOC 2 compliant systems and processes. Once the compliant processes have been established, it is important to follow them consistently in order to maintain SOC 2 certification.

It is important to note that SOC 2 reports are unique to each organization and are different from PCI DSS, which has very rigid requirements.

TISAX certification is a highly sought after information security assessment mechanism for enterprises in the automotive industry. The Trusted Information Security Assessment Exchange (TISAX) is a European automotive industry-standard information security assessment catalog that helps companies ensure the security of their information systems.

The TISAX certification confirms that a company’s information security management system complies with defined security levels and allows for sharing of assessment results across a designated platform.

At Baltum Buroo, we offer TISAX certification services to help you prove your readiness when it comes to information security management.

The TISAX assessments by Baltum Buroo help you to drive trust and boost overall customer satisfaction, both of which can facilitate the renewal of your existing supplier contracts.

TISAX supports enterprises in reducing their efforts when it comes to processing sensitive information from customers or evaluating the information security of their own suppliers. TISAX enables you to demonstrate your commitment to information security, which can have a positive impact on your business and increase customer confidence.

At Baltum Buroo, our global network of TISAX auditors are here to help you achieve TISAX certification and enhance the security of your information systems. If you want to learn more about our TISAX certification services, please don’t hesitate to reach out to us.

The CryptoCurrency Certification Consortium (C4) is a non-profit organization that provides certifications to professionals who perform cryptocurrency-related services. The organization provides certifications that demonstrate comprehensive knowledge in various disciplines related to cryptocurrency, ranging from basic cryptography to low-level cryptocurrency development.

The C4 also establishes cryptocurrency standards that aim to balance openness, privacy, security, usability, and decentralization. The organization provides a free and open set of industry guidelines and best practices for securing cryptocurrency and related systems through the CryptoCurrency Security Standard (CCSS).

The CCSS recommends implementing a variety of security controls to protect cryptocurrency holdings. The C4 has designated certifications such as Self Custody, Qualified Service Provider (QSP), and Full System (FS).

With the advancements in technology and online transactions, there is a growing demand for cryptocurrency certification programs to help professionals learn and demonstrate new skills in the field.

ISO 22301 establishes the requirements for an organization to create, implement, maintain and improve a BCMS (Business Continuity Management System).

This management system will allow the Company to:

－provide and maintain conditions for protection against violations of its activities;

－prepare measures to respond to violations without stopping its operation;

－prepare for recovery after the violations that have occurred (Examples of violations may be: natural disasters, cyber attacks and other events).

ISO 22301 is intended to use for all organizations or parts of them, regardless of the type, size and characteristics of the organization. But it is most relevant for organizations of critical infrastructure operating in such areas as energy, transport, financial sector, etc.

This standard is based on the PDCA (Plan-Do-Check-Act) cycle, and is also coordinated with other standards such as ISO 9001, ISO 14001, ISO/IEC 27001, etc., which allows for consistent and effective integration of the BCMS into existing management systems.

Baltum Buroo can offer a number of services to help you prepare for and complete certification, including support throughout the certification process.

The certification process includes a comprehensive assessment of the organization’s BCMS, including a review of all its processes. In case of compliance with the requirements of ISO 22301, the organization receives an international certificate based on the results of the audit.

ISO 22301 certification provides organizations with a number of benefits:

－identify potential risks and develop preventive measures;

－minimize damage from existing violations;

－improve the risk management process;

－ensure business continuity in emergency situations;

－reduce the risks of downtime;

－strengthen the reputation and trust of the organization.

ISO/TR 23244:2020. Blockchain and distributed ledger technologies – Considerations for the protection of privacy and personal information.

Blockchain technology is a technology for distributing registers designed to protect against unauthorized access and create records that cannot be corrected. This approach is attractive for many industries, as well as for the financial sector, healthcare, agriculture, etc.

Nowadays, the rapid development of blockchain technology has led to the need to develop standards in this direction: the ISO expert committee has already published the first documents, a number of standards are still under development.

One of the relevant documents is the ISO/TR 23244 standard, which contains an analysis of the main problems related to personal data protection (PII) and confidentiality when using blockchain and distributed ledger technology (DLT).

ISO/TR 23244 certification will allow organizations to:

• manage the risks associated with confidentiality;
• identify ways to reduce risks;
• use the potential of blockchain and distributed ledger technology in order to increase privacy;
• increase the trust in the organization;
• minimize costs.

ISO/TR 23576:2020. Blockchain and distributed ledger technologies – Security management of digital asset custodians.

ISO/TR 23576 is one of the most relevant documents in the field of blockchain technology management and distributed ledger technology. The standard considers the main threats, risks and controls associated with:

— systems that provide digital asset storage and/or service exchange services to their customers (consumers and businesses) and security management in the event of an incident;

— asset information (including the digital asset signature key) that the digital asset custodian provides to its customers (consumers and businesses). Appropriate management of signature keys by digital asset custodians is a key issue in order to prevent improper use and transactions by unauthorized persons.

Beyond the scope of this document are:

— basic security controls for blockchain and DLT systems;

— business risks of digital asset custodians;

— separation of client assets;

— management issues.

ISO 37301 “Compliance Management System”.

A CMS is a set of processes created to ensure that an organization complies with all applicable laws, regulations, and codes of conduct. An effective compliance management system (CMS) is able to identify relevant requirements, ensure their compliance throughout the organization, as well as monitor and optimize the implementation of these requirements.

ISO 37301 establishes requirements and provides guidelines for the creation, development, implementation, evaluation, maintenance and continuous improvement of a CMS.

ISO 37301 is applicable to any organization, regardless of sector (public, private, non-profit), size and nature of activity.

Certification for compliance with ISO 37301 is voluntary, but more and more companies are striving to implement a CMS management system and confirm their compliance with leading compliance practices.

The certification procedure is carried out in two stages.

An independent accredited body conducts a preliminary audit in order to assess the existing management system in the organization: an analysis of documentation, company goals, internal audit results, etc. is carried out.

At the second stage, a Certification audit is conducted, which includes:

－verification of the documentation package for compliance with ISO 37301 requirements;

－ analysis of information on the functioning of the company from independent sources in order to assess the functioning of the compliance management system;

－interaction with the company’s staff and evaluation of their awareness, familiarization with documentation and development of compliance culture.

When nonconformities are identified, a number of comments and recommendations are prepared for the organization.

If all the requirements of the standard are met, the company receives an international certificate of compliance with ISO 37301. The certificate is valid for 3 years, in addition, technical supervision is carried out annually.

The benefits of ISO 37301 certification are:

1. demonstrating commitment to the principles of fair and ethical business conduct in the market, as well as among regulators, investors, employees and other interested parties;
2. increasing the level of customer trust and loyalty;
3. effective risk management through the implementation and development of a compliance culture;
4. reducing the risks of violating legislative and regulatory requirements.

ISO 18788 “Security Operations Management System”

ISO 18788 establishes guidelines and provides support to organizations that carry out security activities. The standard acts as the basis:

• the development, implementation, monitoring, evaluation, support, maintenance and improvement of the Security Operations Management System (SOMS);
• risk assessment and compliance with legislation;
• for incident management and operational control;
• concepts of respect for human rights and compliance with existing rules and laws.

A security operations management system (eng. SOMS – security operations management system) is a set of procedures, policies, and controls that allows an organization to effectively and efficiently manage its security operations.

Therefore, the ISO 18788 certificate of conformity will be relevant for any private security organization involved in conducting or concluding contracts for security operations, namely:

－security (armed, unarmed, patrol and response officers, cash transportation specialists, cynologists) and VIP security;

－control point (video monitoring);

－consultations on safety and risks;

－personnel verification;

－training in various security operations;

－investigations (investigators, polygraphs);

－security technologies (alarm systems, video surveillance, software, etc.).

For successful ISO 18788 certification, it is necessary to develop and implement SOMS in an organization, conduct internal audits to assess the management system, identify any nonconformities and search for potential to improve SOMS.

The next stage is the certification audit, which is conducted by an accredited certification body in order to verify compliance with the requirements of ISO 18788.

Baltum Buroo can offer a number of services to help you prepare for and complete certification, including support throughout the certification process.

ISO 18788 certification will help the organization:

1) increase the trust of customers, the state and other interested parties;

2) to increase competitiveness and reputation in the field of private security activities;

3) to confirm the level of professionalism and quality of services;

4) to increase the efficiency of activities through the use of best practices;

5) demonstrate commitment to national and international laws, as well as the protection of human rights.

ISO/IEC 27035 “Information Security Incident Management”

ISO/IEC 27035-1:2023 “Information technology — Information security incident management. Part 1: Principles and process”.

This document is the basis of the ISO/IEC 27035 series of standards and contains the basic principles and processes for information security incident management, which provide a structured approach to incident preparation, detection, reporting, assessment and response.

ISO/IEC 27035-1:2023 is intended for all organizations, regardless of their type, size or nature of activity, and is also applicable to external organizations providing information security incident management services.

ISO/IEC 27035-2:2023 “Information technology — Information security incident management. Part 2: Guidelines to plan and prepare for incident response” contains recommendations for planning and preparing for incident response, as well as for learning lessons from the incident response process. The basis for this document is the main stages of the information security incident management model presented in ISO/IEC 27035-1:2023, namely the stages of “planning and preparation” and “learning lessons”.

The main points of the “planning and preparation” stage include:

— information security incident management policy and commitment of senior management;

— information security policies, including those related to risk management, updated both at the organizational level and at the level of systems, services and networks;

— information security incident management plan;

— the formation of the Incident Management Group (IMT);

— establishing relationships and connections with internal and external organizations;

— technical and other support (including organizational and operational);

— briefings and training on incident management in the field of information security.

The “learning lessons” stage includes:

— identification of areas requiring improvement;

— identification and introduction of necessary improvements;

— evaluation of the work of the Incident Response Team (IRT).

The recommendations given in ISO/IEC 27035-2:2023 are general and intended for use in all organizations, regardless of their type, size or nature. This document is also applicable to external organizations providing information security incident management services.

ISO/IEC 27035 certification will allow an organization to effectively manage information security incidents by applying relevant concepts, tools and methods based on the best practices of ISO/IEC 27035.

The ISO/IEC 27033 series consists of the following parts under one general heading “Information technology — Security techniques — Network security”:

Part 1: Overview and concepts

Part 2: Guidelines for the design and implementation of network security

Part 3: Reference networking scenarios — Threats, design techniques and control issues

Part 4: Securing communications between networks using security gateways

Part 5: Securing communications across networks using Virtual Private Networks (VPNs)

Part 6: Securing wireless IP network access

ISO/IEC 27033 defines and describes concepts related to network security and provides recommendations for network security management.

ISO/IEC 27033 certification will ensure:

– protection of IT networks from threats and vulnerabilities;

– secure information exchange through the use of encryption, secure network architecture, etc.;

– improving the reputation of the organization and the trust of customers through confidence in the security of the organization’s digital infrastructure.

– effective management and control of network security risks.

The ISO 31000 international standard is applicable to all organizations, regardless of shape, size, and field of activity, in order to develop and implement a risk management system. This system will allow the organization to:

1) improve the quality and safety of manufactured goods/services provided;

2) optimize the company’s activities and improve the efficiency of business process management;

3) increase the trust of customers, suppliers, investors and other interested parties;

4) minimize costs and downtime by improving the efficiency of planning;

Thus, the ISO 31000 certificate is a document that demonstrates to all interested parties (customers, partners, supervisory authorities, employees of the company, etc.) confirmation of:

– effective management of the organization;

– effective risk management and various threats;

– rational use of resources.

Baltum Buroo is ready to offer a number of services that will help you prepare for and complete certification, including support throughout the certification process.