IT Governance Publishing – förlag

Protect your information assets with effective risk managementIn today’s information economy, the development, exploitation and protection of information and associated assets are key to the long-term competitiveness and survival of corporations and entire economies. The protection of information and associated assets – information security – is therefore overtaking physical asset protection as a fundamental corporate governance responsibility. Information security management system requirementsISO 27000, which provides an overview for the family of international standards for information security, states that “An organisation needs to undertake the following steps in establishing, monitoring, maintaining and improving its ISMS […] assess information security risks and treat information security risks”. The requirements for an ISMS are specified in ISO 27001. Under this standard, a risk assessment must be carried out to inform the selection of security controls, making risk assessment the core competence of information security management and a critical corporate discipline.Plan and carry out a risk assessment to protect your informationInformation Security Risk Management for ISO 27001 / ISO 27002:Provides information security and risk management teams with detailed, practical guidance on how to develop and implement a risk assessment in line with the requirements of ISO 27001.Draws on national and international best practice around risk assessment, including BS 7799-3:2017 (BS 7799-3).Covers key topics such as risk assessment methodologies, risk management objectives, information security policy and scoping, threats and vulnerabilities, risk treatment and selection of controls.Includes advice on choosing risk assessment software.Ideal for risk managers, information security managers, lead implementers, compliance managers and consultants, as well as providing useful background material for auditors, this book will enable readers to develop an ISO 27001-compliant risk assessment framework for their organisation and deliver real, bottom-line business benefits.Buy your copy today!About the authorsAlan Calder is the Group CEO of GRC International Group plc, the AIM-listed company that owns IT Governance Ltd. Alan is an acknowledged international cyber security guru and a leading author on information security and IT governance issues. He has been involved in the development of a wide range of information security management training courses that have been accredited by IBITGQ (International Board for IT Governance Qualifications). Alan has consulted for clients in the UK and abroad, and is a regular media commentator and speaker. Steve Watkins is an executive director at GRC International Group plc. He is a contracted technical assessor for UKAS – advising on its assessments of certification bodies offering ISMS/ISO 27001 and ITSMS/ISO 20000-1 accredited certification. He is a member of ISO/IEC JTC 1/SC 27, the international technical committee responsible for information security, cyber security and privacy standards, and chairs the UK National Standards Body’s technical committee IST/33 (information security, cyber security and privacy protection) that mirrors it. Steve was an active member of IST/33/-/6, which developed BS 7799-3.

ITIL 4 is the latest evolution of the leading best-practice framework for ITSM (IT service management). It has been significantly updated from ITIL v3 and addresses new ITSM challenges, includes new technologies and incorporates new ways of working.ITIL® Foundation Essentials ITIL 4 Edition is the ultimate revision guide for candidates preparing for the ITIL 4 Foundation exam. It is fully aligned with the Foundation course syllabus and gives a clear and concise overview of the facts. Whether you are taking an ITIL 4 Foundation training course or are a self-study candidate, new to the framework or looking to upgrade your ITIL 2011 certification, this guide is the essential companion. It:Provides definitions of the key terms and concepts used in ITIL 4;Presents detailed information in clear, user-friendly and easy-to-follow ways through tables, bullet points and diagrams; andExplains the key figures and diagrams in the ITIL syllabus.This second edition has been updated to align with amendments to the ITIL® 4 Foundation syllabus, including:Replacing ‘change control’ with ‘change enablement’ throughout;The removal of ‘IT’ from the definition of a change; andUpdating definitions for customer, sponsor and user.Start preparing for your ITIL Foundation exam – order your copy today.ITIL® is a registered trade mark of the PeopleCert group. Used under licence from PeopleCert. All rights reserved.

Protect your information assets with effective risk management

In today’s information economy, the development, exploitation and protection of information and associated assets are key to the long-term competitiveness and survival of corporations and entire economies. The protection of information and associated assets – information security – is therefore overtaking physical asset protection as a fundamental corporate governance responsibility. 

Information security management system requirements

ISO 27000, which provides an overview for the family of international standards for information security, states that “An organisation needs to undertake the following steps in establishing, monitoring, maintaining and improving its ISMS […] assess information security risks and treat information security risks”. The requirements for an ISMS are specified in ISO 27001. Under this standard, a risk assessment must be carried out to inform the selection of security controls, making risk assessment the core competence of information security management and a critical corporate discipline.

Plan and carry out a risk assessment to protect your information

Information Security Risk Management for ISO 27001 / ISO 27002:

Provides information security and risk management teams with detailed, practical guidance on how to develop and implement a risk assessment in line with the requirements of ISO 27001.Draws on national and international best practice around risk assessment, including BS 7799-3:2017 (BS 7799-3).Covers key topics such as risk assessment methodologies, risk management objectives, information security policy and scoping, threats and vulnerabilities, risk treatment and selection of controls.Includes advice on choosing risk assessment software.

Ideal for risk managers, information security managers, lead implementers, compliance managers and consultants, as well as providing useful background material for auditors, this book will enable readers to develop an ISO 27001-compliant risk assessment framework for their organisation and deliver real, bottom-line business benefits.

Buy your copy today!

About the authors

Alan Calder is the Group CEO of GRC International Group plc, the AIM-listed company that owns IT Governance Ltd. Alan is an acknowledged international cyber security guru and a leading author on information security and IT governance issues. He has been involved in the development of a wide range of information security management training courses that have been accredited by IBITGQ (International Board for IT Governance Qualifications). Alan has consulted for clients in the UK and abroad, and is a regular media commentator and speaker. 

Steve Watkins is an executive director at GRC International Group plc. He is a contracted technical assessor for UKAS – advising on its assessments of certification bodies offering ISMS/ISO 27001 and ITSMS/ISO 20000-1 accredited certification. He is a member of ISO/IEC JTC 1/SC 27, the international technical committee responsible for information security, cyber security and privacy standards, and chairs the UK National Standards Body’s technical committee IST/33 (information security, cyber security and privacy protection) that mirrors it. Steve was an active member of IST/33/-/6, which developed BS 7799-3. 

This concise guide is essential reading for EU organisations wanting an easy to follow overview of the new regulation and the compliance obligations for handling data of EU citizens.The EU General Data Protection Regulation (GDPR) will unify data protection and simplify the use of personal data across the EU, and automatically supersedes member states domestic data protection laws.It will also apply to every organisation in the world that processes personal information of EU residents.The Regulation introduces a number of key changes for all organisations that process EU residents’ personal data.EU GDPR: A Pocket Guide provides an essential introduction to this new data protection law, explaining the Regulation and setting out the compliance obligations for EU organisations.This second edition has been updated with improved guidance around related laws such as the NIS Directive and the future ePrivacy Regulation.EU GDPR – A Pocket Guide sets out:A brief history of data protection and national data protection laws in the EU (such as the German BDSG, French LIL and UK DPA).The terms and definitions used in the GDPR, including explanations.The key requirements of the GDPR, including: Which fines apply to which Articles;The six principles that should be applied to any collection and processing of personal data;The Regulation’s applicability;Data subjects’ rights;Data protection impact assessments (DPIAs);The role of the data protection officer (DPO) and whether you need one;Data breaches, and the notification of supervisory authorities and data subjects;Obligations for international data transfers.How to comply with the Regulation, including: Understanding your data, and where and how it is used (e.g. Cloud suppliers, physical records);The documentation you need to maintain (such as statements of the information you collect and process, records of data subject consent, processes for protecting personal data);The “appropriate technical and organisational measures” you need to take to ensure your compliance with the Regulation.A full index of the Regulation, enabling you to find relevant Articles quickly and easily.Buy your copy today.

ITIL 4 is the latest evolution of the leading best-practice framework for ITSM (IT service management). It has been significantly updated from ITIL v3 and addresses new ITSM challenges, includes new technologies and incorporates new ways of working.

ITIL® Foundation Essentials ITIL 4 Edition is the ultimate revision guide for candidates preparing for the ITIL 4 Foundation exam. It is fully aligned with the Foundation course syllabus and gives a clear and concise overview of the facts. 

Whether you are taking an ITIL 4 Foundation training course or are a self-study candidate, new to the framework or looking to upgrade your ITIL 2011 certification, this guide is the essential companion. It:

Provides definitions of the key terms and concepts used in ITIL 4;Presents detailed information in clear, user-friendly and easy-to-follow ways through tables, bullet points and diagrams; andExplains the key figures and diagrams in the ITIL syllabus.

This second edition has been updated to align with amendments to the ITIL® 4 Foundation syllabus, including:

Replacing ‘change control’ with ‘change enablement’ throughout;The removal of ‘IT’ from the definition of a change; andUpdating definitions for customer, sponsor and user.

Start preparing for your ITIL Foundation exam – order your copy today.

ITIL® is a registered trade mark of the PeopleCert group. Used under licence from PeopleCert. All rights reserved.

ITIL is the leading best-practice framework for ITSM (IT service management) and is globally adopted in both the public and private sectors. The latest evolution of the framework – ITIL 4 – has been significantly updated and addresses new ITSM challenges, includes new technologies and incorporates new ways of working.ITIL 4 has evolved to a value system-focused approach that can be integrated with other management practices and ways of working, such as Agile and DevOps. Its end-to-end digital operation model has been designed to help IT teams create, deliver and operate technical products and services that fit their organisation’s wider business strategy.ITIL® 4 Essentials contains everything you need to know to pass the ITIL 4 Foundation Certificate, plus more. It covers practices and concepts that are not addressed as part of the Foundation syllabus, making it ideal for newly qualified practitioners.The book offers practical tips – based on the author’s extensive experience – for applying service management in the real world, with symbols used throughout to highlight which content is related to the ITIL 4 Foundation syllabus and which is not.Ideal for self-study candidates and training participants, ITIL 4 Essentials will prove a helpful companion to their studies and a practical aid for their professional development. Project managers, contractors or consultants with limited study time will also find it essential to their part-time education.This second edition has been updated to align with amendments to the ITIL® 4 Foundation syllabus, including:Replacing ‘change control’ with ‘change enablement’ throughout;The removal of ‘IT’ from the definition of a change; andUpdating definitions for customer, sponsor and user.A perfect companion before, during and after your ITIL exam – buy your copy today.ITIL® is a registered trade mark of the PeopleCert group. Used under licence from PeopleCert. All rights reserved.

A global perspective on AIThe rise of AI and super-intelligent AI raises ethical issues. AI is the power behind Google’s search engine, enables social media sites to serve up targeted advertising, gives Alexa and Siri their voices, and enables OpenAI’s ChatGPT to produce written responses from just a few prompts by the user. It is also the technology enabling self-driving vehicles, predictive policing, and autonomous weapons that can kill without direct human intervention. All of these bring up complex ethical issues that are still unresolved and will continue to be the subject of ongoing debate. This book:Explores the complex topic of AI ethics in a cross-functional way;Enables understanding of the associated ethical challenges of AI technologies;Provides an up-to-date overview of the potential positive and negative outcomes of AI implementations; andHas been updated to reflect the ethical challenges of AI in 2024 and beyond, and the moral imperative of navigating this new terrain.This book presents a concrete approach to identifying appropriate ethical principles in AI solutions

Following the success of the first edition, this book has been re-released to reflect the ISO/IEC 27001:2022 and ISO/IEC 27002:2022 updates. Ideal for information security managers, auditors, consultants and organisations preparing for ISO 27001:2022 certification, this book will help readers understand the requirements of an ISMS (information security management system) based on ISO 27001:2022. Similarly, for anyone involved in internal or external audits, the book includes the definitive requirements that auditors must address when certifying organisations to ISO 27001:2022. The auditing guidance covers what evidence an auditor should look for to satisfy themselves that the requirement has been met. This guidance is useful for internal auditors and consultants, as well as information security managers and lead implementers as a means of confirming that their implementation and evidence to support it will be sufficient to pass an audit. This guide is intended to be used by those involved in: Designing, implementing and/or maintaining an ISMS;Preparing for ISMS audits and assessments; orUndertaking both internal and third-party ISMS audits and assessments.

This beginner’s book explains the basics of ITIL and its implementation and interpretation in an easy, selfstudy approach for all technical and business staff in your organisation. The entire book is written in a question and answer format for easy comprehension and speedy reading. Each chapter covers only one specific area of ITIL, and each topic is explained concisely, with very few answers extending beyond a page. Practical and real-life examples with a little bit of humour are used throughout. This self-help book is designed to be a small stepping stone to the official books on ITIL published by OGC.

A clear, concise primer on the GDPRThe GDPR aims to unify data protection and ease the flow of personal data across the EU. It applies to every organisation in the world that handles EU residents’ personal data.While the GDPR is not law in countries outside the EU, it is effectively part of the legislative environment for organisations that do business with the EU. This is enforced through a combination of international trade law and business pressure – after all, a partner in the EU is unlikely to want to risk engaging with a company in the US, Australia or Singapore (or anywhere else) that will put them at risk.EU GDPR – An international guide to compliance is the ideal resource for anyone wanting a clear primer on the principles of data protection and their obligations under the GDPR.A concise pocket guide, it will help you understand:The terms and definitions used in the GDPR, including explanations;The key requirements of the GDPR, including:Which fines apply to which Articles;The principles that should be applied to any collection and processing of personal data;The Regulation’s applicability;Data subjects’ rights;Data protection impact assessments;The data protection officer role and whether you need one;Data breaches, and notifying supervisory authorities and data subjects; andObligations for international data transfers.How to comply with the Regulation, including:Understanding your data, and where and how it is used (e.g. Cloud suppliers, physical records);The documentation you must maintain (such as statements of the information you collect and process, records of data subject consent, processes for protecting personal data); andThe “appropriate technical and organisational measures” you need to take to ensure compliance with the Regulation.A full index of the Regulation, enabling you to find relevant Articles quickly and easily.Supplemental material While most of the EU GDPR’s requirements are broadly unchanged in the UK GDPR, the context is quite different and will have knock-on effects. You may need to update contracts regarding EU–UK data transfers, incorporate standard contractual clauses into existing agreements, and update your policies, processes and procedural documentation as a result of these changes.  We have published a supplement that sets out specific extra or amended information for this pocket guide. Click here to download the supplement. About the authorAlan Calder is the Group CEO of GRC International Group plc, the AIM-listed company that owns IT Governance Ltd. He is an internationally acknowledged cyber security expert, and a leading author on information security and IT governance issues. He co-wrote the definitive compliance guide IT Governance: An International Guide to Data Security and ISO27001/ISO27002, which is the basis for the Open University’s postgraduate course on information security, and has been involved in the development of a wide range of information security management training courses that have been accredited by IBITGQ (International Board for IT Governance Qualifications). Alan has consulted on data security for numerous clients in the UK and abroad, and is a regular media commentator and speaker.

Recommended textbook for the Open University’s postgraduate information security course and the recommended text for all IBITGQ ISO 27001 courses

In this updated edition, renowned ISO 27001/27002 experts Alan Calder and Steve Watkins:

Discuss the ISO 27001/27002:2022 updates;Provide guidance on how to establish a strong IT governance system and an ISMS (information security management system) that complies with ISO 27001 and ISO 27002;Highlight why data protection and information security are vital in our ever-changing online and physical environments;Reflect on changes to international legislation, e.g. the GDPR (General Data Protection Regulation); andReview key topics such as risk assessment, asset management, controls, security, supplier relationships and compliance.

Fully updated to align with ISO 27001/27002:2022

IT Governance – An international guide to data security and ISO 27001/ISO 27002, Eighth edition provides:

Expert information security management and governance guidance based on international best practice;Guidance on how to protect and enhance your organisation with an ISO 27001:2022-compliant ISMS; andDiscussion around the changes to international legislation, including ISO 27001:2022 and ISO 27002:2022.

As cyber threats continue to increase in prevalence and ferocity, it is more important than ever to implement a secure ISMS to protect your organisation. Certifying your ISMS to ISO 27001 and ISO 27002 demonstrates to customers and stakeholders that your organisation is handling data securely.

Effective cyber resilience requires a culture of preparedness that considers risk management and recovery planning to be at least as important as cyber defences.This book discusses:What cyber resilience is;How an organisation can achieve cyber resilience;How a cyber resilience strategy can be implemented, with a focus on ISO 27001 and ISO 22301; andThe certification and auditing process for standards such as ISO 27001 and ISO 22301.This book will explore the core principles of cyber resilience and explain how you can use ISO 27001 and ISO 22301 to implement a cyber resilience programme in your organisation. By the end of the book, you will understand how to implement both standards and combine them to form an effective, integrated system that will both enhance cyber security and ensure your organisation can respond effectively to a cyber attack or disruption.

Protect your information assets with effective risk management

In today’s information economy, the development, exploitation and protection of information and associated assets are key to the long-term competitiveness and survival of corporations and entire economies. The protection of information and associated assets – information security – is therefore overtaking physical asset protection as a fundamental corporate governance responsibility. 

Information security management system requirements

ISO 27000, which provides an overview for the family of international standards for information security, states that “An organisation needs to undertake the following steps in establishing, monitoring, maintaining and improving its ISMS […] assess information security risks and treat information security risks”. The requirements for an ISMS are specified in ISO 27001. Under this standard, a risk assessment must be carried out to inform the selection of security controls, making risk assessment the core competence of information security management and a critical corporate discipline.

Plan and carry out a risk assessment to protect your information

Information Security Risk Management for ISO 27001 / ISO 27002:

Provides information security and risk management teams with detailed, practical guidance on how to develop and implement a risk assessment in line with the requirements of ISO 27001.Draws on national and international best practice around risk assessment, including BS 7799-3:2017 (BS 7799-3).Covers key topics such as risk assessment methodologies, risk management objectives, information security policy and scoping, threats and vulnerabilities, risk treatment and selection of controls.Includes advice on choosing risk assessment software.

Ideal for risk managers, information security managers, lead implementers, compliance managers and consultants, as well as providing useful background material for auditors, this book will enable readers to develop an ISO 27001-compliant risk assessment framework for their organisation and deliver real, bottom-line business benefits.

Buy your copy today!

About the authors

Alan Calder is the Group CEO of GRC International Group plc, the AIM-listed company that owns IT Governance Ltd. Alan is an acknowledged international cyber security guru and a leading author on information security and IT governance issues. He has been involved in the development of a wide range of information security management training courses that have been accredited by IBITGQ (International Board for IT Governance Qualifications). Alan has consulted for clients in the UK and abroad, and is a regular media commentator and speaker. 

Steve Watkins is an executive director at GRC International Group plc. He is a contracted technical assessor for UKAS – advising on its assessments of certification bodies offering ISMS/ISO 27001 and ITSMS/ISO 20000-1 accredited certification. He is a member of ISO/IEC JTC 1/SC 27, the international technical committee responsible for information security, cyber security and privacy standards, and chairs the UK National Standards Body’s technical committee IST/33 (information security, cyber security and privacy protection) that mirrors it. Steve was an active member of IST/33/-/6, which developed BS 7799-3. 

Learn how to integrate well-known concepts, methods and processes from ITIL® and COBIT®, combining the best from each approach. IT4B is not about reinventing your favourite method, but putting it into the context of improvement and identifying any potential gaps.

Written by service management experts with years of real-life experience, ensuring sensible, practical and effective advice.

This book reads like a conversation on IT service management. Rather than reinventing traditional IT frameworks or methods, IT4B provides a coherent understanding of digital readiness for your enterprise. It offers insight and coaching, rather than ready-made advice. This book aims to:

Use well-known service management concepts, methods and processes to focus on digital innovation;Promote a reuse-reduce-recycle approach to improve projects, rather than grow-expand-explode; andUse the IT4B framework as a lens that will guide all your projects.

 

So what is IT4B?

IT ‘4’ for business is an acronym for the business community to use, and is intended to help the business side of a company determine whether their IT is ‘aligned’ or ‘integrated’ and what is missing.

This book serves as a guide for the identification and the implementation of IT methods.

Brian Johnson has held key leadership and strategic roles in government and private companies. He was part of the UK government team that created the ITIL approach. He has written a number of books on ITIL, the software lifecycle and the role of IT in business. When he isn’t working or writing, Brian’s passion is playing football.

Walter Zondervan is a digital innovator who is always looking to help organisations reach their full potential. In his 20+ years of experience, he became fascinated with translating business goals into IT strategy. As a digital transformation strategist, he developed a comprehensive approach to this, which has been partially adopted by the BiSL® Next framework for business information management. Working with Brian Johnson on BiSL® Next, they decided to take it a step further and combine their insights to create a practical IT4B approach to digital transformation.

Learn how to integrate well-known concepts, methods and processes from ITIL® and COBIT®, combining the best from each approach. IT4B is not about reinventing your favourite method, but putting it into the context of improvement and identifying any potential gaps.

Written by service management experts with years of real-life experience, ensuring sensible, practical and effective advice.

This book reads like a conversation on IT service management. Rather than reinventing traditional IT frameworks or methods, IT4B provides a coherent understanding of digital readiness for your enterprise. It offers insight and coaching, rather than ready-made advice. This book aims to:

Use well-known service management concepts, methods and processes to focus on digital innovation;Promote a reuse-reduce-recycle approach to improve projects, rather than grow-expand-explode; andUse the IT4B framework as a lens that will guide all your projects.

 

So what is IT4B?

IT ‘4’ for business is an acronym for the business community to use, and is intended to help the business side of a company determine whether their IT is ‘aligned’ or ‘integrated’ and what is missing.

This book serves as a guide for the identification and the implementation of IT methods.

Brian Johnson has held key leadership and strategic roles in government and private companies. He was part of the UK government team that created the ITIL approach. He has written a number of books on ITIL, the software lifecycle and the role of IT in business. When he isn’t working or writing, Brian’s passion is playing football.

Walter Zondervan is a digital innovator who is always looking to help organisations reach their full potential. In his 20+ years of experience, he became fascinated with translating business goals into IT strategy. As a digital transformation strategist, he developed a comprehensive approach to this, which has been partially adopted by the BiSL® Next framework for business information management. Working with Brian Johnson on BiSL® Next, they decided to take it a step further and combine their insights to create a practical IT4B approach to digital transformation.

With a view to helping managers ask the right questions, Data Protection and the Cloud explains how you can effectively manage the risks associated with the Cloud and meet regulatory requirements. This book discusses:The controller–processor relationship and what you should pay attention to;How to mitigate security risks in the Cloud to comply with Article 32 of the EU GDPR (General Data Protection Regulation);How to comply with Chapter V of the GDPR when transferring data to third countries; andThe implications of the NIS Directive (Directive on security of network and information systems) for Cloud providers.One of the most dramatic recent developments in computing has been the rapid adoption of Cloud applications. According to the 2018 Bitglass Cloud Adoption Report, more than 81% of organisations have now adopted the Cloud in some form, compared with only 24% in 2014. And there are no signs that this is slowing down.The GDPR was enforced on 25 May 2018, superseding the 1995 Data Protection Directive and all local implementations. Bringing data protection into the 21st century, the Regulation expands the rights of individuals, but also introduces new, stricter requirements for organisations. This pocket guide discusses the GDPR requirements relating to Cloud sourcing and the risks involved.With a view to helping managers ask the right questions, Data Protection and the Cloud explains how you can effectively manage the risks associated with the Cloud and meet regulatory requirements. This book discusses:The controller–processor relationship and what you should pay attention to;How to mitigate security risks in the Cloud to comply with Article 32 of the EU GDPR (General Data Protection Regulation);How to comply with Chapter V of the GDPR when transferring data to third countries; andThe implications of the NIS Directive (Directive on security of network and information systems) for Cloud providers.One of the most dramatic recent developments in computing has been the rapid adoption of Cloud applications. According to the 2018 Bitglass Cloud Adoption Report, more than 81% of organisations have now adopted the Cloud in some form, compared with only 24% in 2014. And there are no signs that this is slowing down.The GDPR was enforced on 25 May 2018, superseding the 1995 Data Protection Directive and all local implementations. Bringing data protection into the 21st century, the Regulation expands the rights of individuals, but also introduces new, stricter requirements for organisations. This pocket guide discusses the GDPR requirements relating to Cloud sourcing and the risks involved.Supplemental material While most of the EU GDPR’s requirements are broadly unchanged in the UK GDPR, the context is quite different and will have knock-on effects. You may need to update contracts regarding EU–UK data transfers, incorporate standard contractual clauses into existing agreements, and update your policies, processes and procedural documentation as a result of these changes.  We have published a supplement that sets out specific extra or amended information for this pocket guide. Click here to download the supplement. Buy today and learn how to meet your data protection obligations when using Cloud services.

With a view to helping managers ask the right questions, Data Protection and the Cloud explains how you can effectively manage the risks associated with the Cloud and meet regulatory requirements. This book discusses:

The controller–processor relationship and what you should pay attention to;How to mitigate security risks in the Cloud to comply with Article 32 of the EU GDPR (General Data Protection Regulation);How to comply with Chapter V of the GDPR when transferring data to third countries; andThe implications of the NIS Directive (Directive on security of network and information systems) for Cloud providers.

One of the most dramatic recent developments in computing has been the rapid adoption of Cloud applications. According to the 2018 Bitglass Cloud Adoption Report, more than 81% of organisations have now adopted the Cloud in some form, compared with only 24% in 2014. And there are no signs that this is slowing down.

The GDPR was enforced on 25 May 2018, superseding the 1995 Data Protection Directive and all local implementations. Bringing data protection into the 21st century, the Regulation expands the rights of individuals, but also introduces new, stricter requirements for organisations. This pocket guide discusses the GDPR requirements relating to Cloud sourcing and the risks involved.

With a view to helping managers ask the right questions, Data Protection and the Cloud explains how you can effectively manage the risks associated with the Cloud and meet regulatory requirements. This book discusses:

The controller–processor relationship and what you should pay attention to;How to mitigate security risks in the Cloud to comply with Article 32 of the EU GDPR (General Data Protection Regulation);How to comply with Chapter V of the GDPR when transferring data to third countries; andThe implications of the NIS Directive (Directive on security of network and information systems) for Cloud providers.

One of the most dramatic recent developments in computing has been the rapid adoption of Cloud applications. According to the 2018 Bitglass Cloud Adoption Report, more than 81% of organisations have now adopted the Cloud in some form, compared with only 24% in 2014. And there are no signs that this is slowing down.

The GDPR was enforced on 25 May 2018, superseding the 1995 Data Protection Directive and all local implementations. Bringing data protection into the 21st century, the Regulation expands the rights of individuals, but also introduces new, stricter requirements for organisations. This pocket guide discusses the GDPR requirements relating to Cloud sourcing and the risks involved.

Supplemental material 

While most of the EU GDPR’s requirements are broadly unchanged in the UK GDPR, the context is quite different and will have knock-on effects. You may need to update contracts regarding EU–UK data transfers, incorporate standard contractual clauses into existing agreements, and update your policies, processes and procedural documentation as a result of these changes.  

We have published a supplement that sets out specific extra or amended information for this pocket guide. Click here to download the supplement. 

Buy today and learn how to meet your data protection obligations when using Cloud services.

 

 

 

With a view to helping managers ask the right questions, Data Protection and the Cloud explains how you can effectively manage the risks associated with the Cloud and meet regulatory requirements. This book discusses:

The controller–processor relationship and what you should pay attention to;How to mitigate security risks in the Cloud to comply with Article 32 of the EU GDPR (General Data Protection Regulation);How to comply with Chapter V of the GDPR when transferring data to third countries; andThe implications of the NIS Directive (Directive on security of network and information systems) for Cloud providers.

One of the most dramatic recent developments in computing has been the rapid adoption of Cloud applications. According to the 2018 Bitglass Cloud Adoption Report, more than 81% of organisations have now adopted the Cloud in some form, compared with only 24% in 2014. And there are no signs that this is slowing down.

The GDPR was enforced on 25 May 2018, superseding the 1995 Data Protection Directive and all local implementations. Bringing data protection into the 21st century, the Regulation expands the rights of individuals, but also introduces new, stricter requirements for organisations. This pocket guide discusses the GDPR requirements relating to Cloud sourcing and the risks involved.

With a view to helping managers ask the right questions, Data Protection and the Cloud explains how you can effectively manage the risks associated with the Cloud and meet regulatory requirements. This book discusses:

The controller–processor relationship and what you should pay attention to;How to mitigate security risks in the Cloud to comply with Article 32 of the EU GDPR (General Data Protection Regulation);How to comply with Chapter V of the GDPR when transferring data to third countries; andThe implications of the NIS Directive (Directive on security of network and information systems) for Cloud providers.

One of the most dramatic recent developments in computing has been the rapid adoption of Cloud applications. According to the 2018 Bitglass Cloud Adoption Report, more than 81% of organisations have now adopted the Cloud in some form, compared with only 24% in 2014. And there are no signs that this is slowing down.

The GDPR was enforced on 25 May 2018, superseding the 1995 Data Protection Directive and all local implementations. Bringing data protection into the 21st century, the Regulation expands the rights of individuals, but also introduces new, stricter requirements for organisations. This pocket guide discusses the GDPR requirements relating to Cloud sourcing and the risks involved.

Supplemental material 

While most of the EU GDPR’s requirements are broadly unchanged in the UK GDPR, the context is quite different and will have knock-on effects. You may need to update contracts regarding EU–UK data transfers, incorporate standard contractual clauses into existing agreements, and update your policies, processes and procedural documentation as a result of these changes.  

We have published a supplement that sets out specific extra or amended information for this pocket guide. Click here to download the supplement. 

Buy today and learn how to meet your data protection obligations when using Cloud services.

 

 

 

Take the first steps to ISO 14001 certification with this practical overview.This book provides practical advice on how to achieve compliance with ISO 14001:2015, the international standard for an EMS (environmental management system). With an EMS certified to ISO 14001, you can improve the efficiency of your business operations and fulfil compliance obligations, while reassuring your employees, clients and other stakeholders that you are monitoring your environmental impact.This easy-to-follow guide takes a step-by-step approach, and provides many sample documents to help you understand how to record and monitor your organisation’s EMS processes.Ideal for compliance managers, IT and general managers, environmental officers, auditors and trainers, this book will provide you with:The confidence to plan and design an EMS. Detailed descriptions of the ISO 14001:2015 requirements will give you a clear understanding of the standard, even if you lack specialist knowledge or previous experience;Guidance to build stakeholder support for your EMS. Information on why it is important for an organisation to have an environmental policy, and a sample communications procedure will help you to raise awareness of the benefits of implementing an EMS; andAdvice on how to become an ISO 14001-certified organisation. The book takes a step-by-step approach to implementing an ISO 14001-compliant EMS.Key features:A concise summary of the ISO 14001:2015 requirements and how you can meet them.An overview of the documentation needed to achieve ISO 14001:2015 accreditation.Sample documents to help you understand how to record and monitor your organisation’s environmental management processes.New for the second edition:Updated for ISO 14001:2015, including terms, definitions and references;Revised approach to take into account requirements to address “risks and opportunities”.Your practical guide to implementing an EMS that complies with ISO 14001:2015 – buy this book today to get the help and guidance you need!

Take the first steps to ISO 14001 certification with this practical overview.

This book provides practical advice on how to achieve compliance with ISO 14001:2015, the international standard for an EMS (environmental management system). With an EMS certified to ISO 14001, you can improve the efficiency of your business operations and fulfil compliance obligations, while reassuring your employees, clients and other stakeholders that you are monitoring your environmental impact.

This easy-to-follow guide takes a step-by-step approach, and provides many sample documents to help you understand how to record and monitor your organisation’s EMS processes.

Ideal for compliance managers, IT and general managers, environmental officers, auditors and trainers, this book will provide you with:

The confidence to plan and design an EMS. Detailed descriptions of the ISO 14001:2015 requirements will give you a clear understanding of the standard, even if you lack specialist knowledge or previous experience;Guidance to build stakeholder support for your EMS. Information on why it is important for an organisation to have an environmental policy, and a sample communications procedure will help you to raise awareness of the benefits of implementing an EMS; andAdvice on how to become an ISO 14001-certified organisation. The book takes a step-by-step approach to implementing an ISO 14001-compliant EMS.

Key features:

A concise summary of the ISO 14001:2015 requirements and how you can meet them.An overview of the documentation needed to achieve ISO 14001:2015 accreditation.Sample documents to help you understand how to record and monitor your organisation’s environmental management processes.

 New for the second edition:

Updated for ISO 14001:2015, including terms, definitions and references;Revised approach to take into account requirements to address “risks and opportunities”.

Your practical guide to implementing an EMS that complies with ISO 14001:2015 – buy this book today to get the help and guidance you need!

Take the first steps to ISO 14001 certification with this practical overview.

This book provides practical advice on how to achieve compliance with ISO 14001:2015, the international standard for an EMS (environmental management system). With an EMS certified to ISO 14001, you can improve the efficiency of your business operations and fulfil compliance obligations, while reassuring your employees, clients and other stakeholders that you are monitoring your environmental impact.

This easy-to-follow guide takes a step-by-step approach, and provides many sample documents to help you understand how to record and monitor your organisation’s EMS processes.

Ideal for compliance managers, IT and general managers, environmental officers, auditors and trainers, this book will provide you with:

The confidence to plan and design an EMS. Detailed descriptions of the ISO 14001:2015 requirements will give you a clear understanding of the standard, even if you lack specialist knowledge or previous experience;Guidance to build stakeholder support for your EMS. Information on why it is important for an organisation to have an environmental policy, and a sample communications procedure will help you to raise awareness of the benefits of implementing an EMS; andAdvice on how to become an ISO 14001-certified organisation. The book takes a step-by-step approach to implementing an ISO 14001-compliant EMS.

Key features:

A concise summary of the ISO 14001:2015 requirements and how you can meet them.An overview of the documentation needed to achieve ISO 14001:2015 accreditation.Sample documents to help you understand how to record and monitor your organisation’s environmental management processes.

 New for the second edition:

Updated for ISO 14001:2015, including terms, definitions and references;Revised approach to take into account requirements to address “risks and opportunities”.

Your practical guide to implementing an EMS that complies with ISO 14001:2015 – buy this book today to get the help and guidance you need!

This pocket guide serves as an introduction to the National Institute of Standards and Technology (NIST) and to its Cybersecurity Framework (CSF).

Now more than ever, organizations need to have a strong and flexible cybersecurity strategy in place in order to both protect themselves and be able to continue business in the event of a successful attack.  

The NIST CSF is a framework for organizations to manage and mitigate cybersecurity risk based on existing standards, guidelines, and practices.

With this pocket guide you can:

Adapt the CSF for organizations of any size to implementEstablish an entirely new cybersecurity program, improve an existing one, or simply provide an opportunity to review your cybersecurity practicesBreak down the CSF and understand how other frameworks, such as ISO 27001 and ISO 22301, can integrate into your cybersecurity framework

By implementing the CSF in accordance with their needs, organizations can manage cybersecurity risks in the most cost-effective way possible, maximizing the return on investment in the organization’s security. This pocket guide also aims to help you take a structured, sensible, risk-based approach to cybersecurity.

This pocket guide serves as an introduction to the National Institute of Standards and Technology (NIST) and to its Cybersecurity Framework (CSF).

Now more than ever, organizations need to have a strong and flexible cybersecurity strategy in place in order to both protect themselves and be able to continue business in the event of a successful attack.  

The NIST CSF is a framework for organizations to manage and mitigate cybersecurity risk based on existing standards, guidelines, and practices.

With this pocket guide you can:

Adapt the CSF for organizations of any size to implementEstablish an entirely new cybersecurity program, improve an existing one, or simply provide an opportunity to review your cybersecurity practicesBreak down the CSF and understand how other frameworks, such as ISO 27001 and ISO 22301, can integrate into your cybersecurity framework

By implementing the CSF in accordance with their needs, organizations can manage cybersecurity risks in the most cost-effective way possible, maximizing the return on investment in the organization’s security. This pocket guide also aims to help you take a structured, sensible, risk-based approach to cybersecurity.

This pocket guide is a primer for any DSPs (digital service providers) that needs to comply with the NIS Regulations, and explores who they are, and why the NIS Regulations are different for them.An introduction to the new NIS Regulations 2018 that bring the EU’s NIS Directive and Implementing Regulation into UK law.  This guide outlines the key requirements, details exactly which digital service providers are within scope, and explains how the security objectives from ENISA’s Technical Guidelines and international standards can help DSPs achieve compliance.This guide will help you:Clarify how to identify if you are within the scope of the NIS RegulationsGain an insight into the NIS DirectiveUnravel the key definitions, authorities and points of contactUnderstand the benefits of a good cyber resilience planYour essential guide to understanding the NIS Regulations – buy this book today and get the help and guidance you need.

This pocket guide is a primer for any DSPs (digital service providers) that needs to comply with the NIS Regulations, and explores who they are, and why the NIS Regulations are different for them.

An introduction to the new NIS Regulations 2018 that bring the EU’s NIS Directive and Implementing Regulation into UK law.  

This guide outlines the key requirements, details exactly which digital service providers are within scope, and explains how the security objectives from ENISA’s Technical Guidelines and international standards can help DSPs achieve compliance.

This guide will help you:

Clarify how to identify if you are within the scope of the NIS RegulationsGain an insight into the NIS DirectiveUnravel the key definitions, authorities and points of contactUnderstand the benefits of a good cyber resilience plan

Your essential guide to understanding the NIS Regulations – buy this book today and get the help and guidance you need.

 

 

 

This pocket guide is a primer for any DSPs (digital service providers) that needs to comply with the NIS Regulations, and explores who they are, and why the NIS Regulations are different for them.

An introduction to the new NIS Regulations 2018 that bring the EU’s NIS Directive and Implementing Regulation into UK law.  

This guide outlines the key requirements, details exactly which digital service providers are within scope, and explains how the security objectives from ENISA’s Technical Guidelines and international standards can help DSPs achieve compliance.

This guide will help you:

Clarify how to identify if you are within the scope of the NIS RegulationsGain an insight into the NIS DirectiveUnravel the key definitions, authorities and points of contactUnderstand the benefits of a good cyber resilience plan

Your essential guide to understanding the NIS Regulations – buy this book today and get the help and guidance you need.

 

 

 

This pocket guide is a primer for any OES (operators of essential services) that needs to comply with the NIS Regulations, and explores who they are, and why the NIS Regulations are different for them.An introduction to the new NIS Regulations 2018 that bring the EU’s NIS Directive and Implementing Regulation into UK law.This guide outlines the requirements for operators of essential services based on the Cyber Assessment Framework established by the National Cyber Security Centre (NCSC), including an explanation of the objectives, principles and indicators of good practice, and offers implementation guidance.This guide will help you:Understand how to comply with NIS Regulations, and avoid penalties associated with non-complianceUnravel the key definitions, authorities and points of contactLearn the benefits of a good Cyber Resilience planInterpret and ensure compliance with the Cyber Assessment FrameworkEstablish the NCSC’s cyber security objectives, principles and indicators of good practiceYour essential guide to understanding the NIS Regulations – buy this book today and get the help and guidance you need.

This pocket guide is a primer for any OES (operators of essential services) that needs to comply with the NIS Regulations, and explores who they are, and why the NIS Regulations are different for them.

An introduction to the new NIS Regulations 2018 that bring the EU’s NIS Directive and Implementing Regulation into UK law.

This guide outlines the requirements for operators of essential services based on the Cyber Assessment Framework established by the National Cyber Security Centre (NCSC), including an explanation of the objectives, principles and indicators of good practice, and offers implementation guidance.

This guide will help you:

Understand how to comply with NIS Regulations, and avoid penalties associated with non-complianceUnravel the key definitions, authorities and points of contactLearn the benefits of a good Cyber Resilience planInterpret and ensure compliance with the Cyber Assessment FrameworkEstablish the NCSC’s cyber security objectives, principles and indicators of good practice

Your essential guide to understanding the NIS Regulations – buy this book today and get the help and guidance you need.

This pocket guide is a primer for any OES (operators of essential services) that needs to comply with the NIS Regulations, and explores who they are, and why the NIS Regulations are different for them.

An introduction to the new NIS Regulations 2018 that bring the EU’s NIS Directive and Implementing Regulation into UK law.

This guide outlines the requirements for operators of essential services based on the Cyber Assessment Framework established by the National Cyber Security Centre (NCSC), including an explanation of the objectives, principles and indicators of good practice, and offers implementation guidance.

This guide will help you:

Understand how to comply with NIS Regulations, and avoid penalties associated with non-complianceUnravel the key definitions, authorities and points of contactLearn the benefits of a good Cyber Resilience planInterpret and ensure compliance with the Cyber Assessment FrameworkEstablish the NCSC’s cyber security objectives, principles and indicators of good practice

Your essential guide to understanding the NIS Regulations – buy this book today and get the help and guidance you need.