Eureka iTech Inc.’s Post

📢 Compliance is not security! Check out our latest blog post to learn why organizations should go beyond meeting regulatory requirements and focus on building a robust security strategy.

📢 Compliance is not security! Check out our latest blog post to learn why organizations should go beyond meeting regulatory requirements and focus on building a robust security strategy.

📢 Compliance is not security! Check out our latest blog post to learn why organizations should go beyond meeting regulatory requirements and focus on building a robust security strategy.

Information security management system ISO 27001:2022 How to define and describe the information security policy ( 5.2) and the scope (boundary) of the organisation (4.3) in which the policy is applicable ? .... The scope or boundary (4.3) covers products and services including the engagement model and information that requires protection by the parties concerned, location of the business and markets addressed and relevant matters of claims (included), disclaims (not included) and disclosure(risk liability explained). The information security policy(5.2) is specific to the scope of business in an organisation(4.3). If an organisation is involved in many businesses and each of businesses has a distinctive character, the policy includes privacy policy will be also distinctive as each policy(5.2) is appropriate to the scope (4.3) considering business requirements/context (4.1) and needs and expectations of interested parties( 4.2) in the business. By carefully evaluated business context, it is possible to make the policy and divide the responsibility amongst parties concerned in a way that it can avoid information security risks at policy level or can treat or, transfer or accept. Case study ABC is a medical device manufacturer and this device when used as a stand alone equipment captures medical images ( like x ray, MRI) and stores in memory of the device. The data or medical images captured by the device are property of patients held in custody of a test lab or hospital administration who have a business relationship with the data owner or patient. With regard to accuracy of image and science of images, device manufacturer is under an obligation for use of proven technology and process in devices. Error in medical images captured by the device can be an issue with the integrity of data. Requirements of memory of device and software used to capture images are a concern which is part of product quality. Device manufacturers have to take care of product warranty and post warranty support until the end of the life of all products across the entire population of products in uses and protection of the data of users and products used by them. These said data which an organisation can include in the scope of information security to take care during its life cycle (collect, keep, use, transfer or delete) in the business. Here, the device manufacturer has no role in data decisions and protecting data in the device. Information security policy of device manufacturer should carefully address this risk of security of medical image by use of the device information and avoids the risk by disclosure in the policy itself. GDPR/ laws of personally identifiable information is therefore not applicable if the information security policy of the device manufacturer is so designed and it effectively discloses and disclaims the business scope and the policy, to the interested parties (regulators) and is open to comments. Regards Krishna Gopal Misra

🔸Entering a new market is challenging not only because of the competition but also because of the need to comply with numerous laws, regulations, and standards that may be new to you. We have been through this process many times and can share practices to determine relevant requirements and efficiently maintain compliance. ⬇️Discover key IT compliance requirements and ways you can make your product compliant. #aprioritblog #CyberSecurity #cybersecurityawareness #CybersecurityChallenges #softwaredevelopment

If you’re preparing for a SOC2 audit and want to ensure your success, downloading our SOC 2 Compliance Project Plan will guide you along the process. This project plan can be used by IT Security and Compliance professionals to not only achieve SOC2 Compliance, but also to evaluate Cyber Risk. https://hubs.li/Q02K_lJZ0 #ControlCase #SOC1 #SOC2 #Compliance #Audit

If you’re preparing for a SOC2 audit and want to ensure your success, downloading our SOC 2 Compliance Project Plan will guide you along the process. This project plan can be used by IT Security and Compliance professionals to not only achieve SOC2 Compliance, but also to evaluate Cyber Risk. #ControlCase #SOC1 #SOC2 #Compliance #Audit https://lnkd.in/dsQNXkfX

If you’re preparing for a SOC2 audit and want to ensure your success, downloading our SOC 2 Compliance Project Plan will guide you along the process. This project plan can be used by IT Security and Compliance professionals to not only achieve SOC2 Compliance, but also to evaluate Cyber Risk.   #ControlCase #SOC1 #SOC2 #Compliance #Audit https://lnkd.in/ehxGX5gd

If you’re preparing for a SOC2 audit and want to ensure your success, downloading our SOC 2 Compliance Project Plan will guide you along the process. This project plan can be used by IT Security and Compliance professionals to not only achieve SOC2 Compliance, but also to evaluate Cyber Risk.   #ControlCase #SOC1 #SOC2 #Compliance #Audit

74% of data breaches last year... -were been caused by human error. Human error, often underestimated, poses a significant security risk for organizations. These errors come in two primary forms: skill-based and decision-based. Skill-based errors manifest when employees, well-versed in their tasks, slip up momentarily due to lapses in judgment or concentration. On the other hand, decision-based errors arise from employees jeopardizing sensitive data because of inadequate awareness or comprehension of the associated risks. In order to tackle this pervasive threat, organizations must grasp the intricate ways in which human error impacts their operations. Read on in our blog post 👇 https://ow.ly/wNMb50PSoru #databreach #cybersecurityawareness