InfoSec Insider

Technological Controls in ISO 27001

In this episode of InfoSec Insider, Wayne Armstrong, Senior Consultant at URM, provides his insights on the 34 technological controls in Annex A of ISO 27001 and how these can be implemented by organisations looking to conform or certify to the Standard.  Wayne leverages his 30+ years of experience in information security and risk management to discuss:
What the technological controls in ISO 27001 are designed to achieve
How you can go about selecting the most appropriate technological controls for your organisation
How the guidance contained in ISO 27002, the supplementary standard to ISO 27001, can help your organisation meet the Standard’s requirements in relation to technological controls
The constraints that may prevent your organisation from implementing certain controls, and how these can be overcome
The importance of balancing security and operational effectiveness and efficiency.
Learn more about this topic:  https://www.urmconsulting.com/blog/implementing-technological-controls-in-iso-27001
If you enjoyed this episode of InfoSec Insider, you can leave us a rating and review here:  https://ratethispodcast.com/infosecinsider   
You can find more episodes of InfoSec Insider here:   https://urmconsulting.com/podcasts   
Brought to you by URM, the UK’s leading information and cyber security specialists.  

ISO 27001 – Physical Security Controls

In this episode of InfoSec Insider, Wayne Armstrong, Senior Consultant at URM, breaks down the ‘Physical’ control theme from Annex A of ISO 27001, which are a set of security measures aimed at protecting an organisation’s physical assets and environment, such as their buildings, equipment, and paper copies of documents.  Wayne leverages his 30+ of experience with information security to discuss:
Why the physical security controls are important and what physical controls are recommended by ISO 27001
Whether you still need to consider physical security when all your data is stored in and accessible from the cloud
The benefits of controls such as access cards and visible IDs for staff accessing business premises
The relevance of physical controls for remote workers
How to overcome the common pitfalls associated with operating and managing physical security controls.
Learn more about this topic: https://www.urmconsulting.com/blog/iso-27001-2022-annex-a-physical-controls
 If you enjoyed this episode of InfoSec Insider, you can leave us a rating and review here: https://ratethispodcast.com/infosecinsider  
You can find more episodes of InfoSec Insider here:
https://urmconsulting.com/podcasts 
Brought to you by URM, the UK’s leading information and cyber security specialists.   

Sharing Personal Data With the Police

In this episode of InfoSec Insider – Talk DP, Martin Brazier, Senior Data Protection Consultant at URM, breaks down the General Data Protection Regulation’s (GDPR’s) requirements for organisations that need to share personal data with the police in order to report a crime, or following a request for data to assist with an investigation.  Martin leverages his 20+ years of experience in information management and data protection compliance to discuss:  
The legislative framework governing police access to personal data, including Part 3 of the Data Protection Act 2018
The lawful bases under the UK GDPR for sharing personal data with the police, and when each may apply
Considerations for compliance with the purpose limitation and data minimisation principles when providing the police with personal data
What to consider when sharing special category and criminal offence data with the police, including applicable conditions under the DPA 2018
Whether individuals need to be informed of any data sharing
Practical guidance on how to ensure any data shared is lawful, proportionate, and compliant with the data protection principles.
Learn more about this topic: https://www.urmconsulting.com/blog/sharing-personal-data-with-the-police 
If you enjoyed this episode of InfoSec Insider, you can leave us a rating and review here:    https://ratethispodcast.com/infosecinsider  
You can find more episodes of InfoSec Insider here:   
https://urmconsulting.com/podcasts  
Brought to you by URM, the UK’s leading information and cyber security specialists.  

ISO 27001 Audits

In this episode of InfoSec Insider, Wayne Armstrong, Senior Consultant at URM, explains the steps organisations can take to effectively plan, conduct, and action an ISO 27001 internal audit.  Wayne draws upon 30+ years of experience in the information security and risk management field to discuss:
The key things to remember when planning your audit programme and to plan specific audits
His tips for auditors when they are conducting audits
The key considerations when reporting on audit results
When you may need to follow-up on audit findings and when you can consider an audit closed.
Learn more about this topic: https://youtu.be/5nFz8nhIZdE
If you enjoyed this episode of InfoSec Insider, you can leave us a rating and review here: https://ratethispodcast.com/infosecinsider   
You can find more episodes of InfoSec Insider here:
https://urmconsulting.com/podcasts 
Brought to you by URM, the UK’s leading information and cyber security specialists.    
 

People Controls in ISO 27001

In this episode of InfoSec Insider, Frazer Grudgings, Senior Consultant at URM, provides key insights on the ‘People’ control theme of ISO 27001’s Annex A, which are measures organisations can implement to protect employees and influence their behaviour in relation to information security.  Frazer leverages his over 15 years of experience in the information security field to discuss:  
Why ‘people controls’ warrants its own control theme 
How screening and pre-employment policies can help 
His hints and tips for effectively implementing the people controls and for a successful people controls audit.  
Learn more about this topic:  https://www.urmconsulting.com/blog/implementing-and-auditing-people-controls-from-iso-27001-2022 
If you enjoyed this episode of InfoSec Insider, you can leave us a rating and review here:  https://ratethispodcast.com/infosecinsider     
You can find more episodes of InfoSec Insider here:   https://urmconsulting.com/podcasts     
Brought to you by URM, the UK’s leading information and cyber security specialists.   

ISO 13485 Explained

In this episode of InfoSec Insider, Stuart Moran, Senior Consultant at URM, offers essential advice on ISO 13485, the International Standard for Medical Devices Quality Management Systems (MDQMS).  Stuart draws upon over 20 years of experience in managing organisation-wide management systems to discuss:
What ISO 13485 is and why it’s important for regulatory compliance
Which organisations ISO 13485 is applicable to, including medical device manufacturers and their suppliers
When you should consider implementing ISO 13485
How and why ISO 13485 differs from other management system standards you may have implemented
Aligning and integrating other ISO standards activities and documentation with ISO 13485 requirements
Whether the current, very significant changes to US federal agencies will impact the Food and Drug Administration’s (FDA’s) move to align their regulation with ISO 13485.
Learn more about this topic: https://www.urmconsulting.com/blog/iso-13485-medical-devices-quality-management-system-explained
If you enjoyed this episode of InfoSec Insider, you can leave us a rating and review here:  https://ratethispodcast.com/infosecinsider  
You can find more episodes of InfoSec Insider here:   
https://urmconsulting.com/podcasts  
Brought to you by URM, the UK’s leading information and cyber security specialists.  

Are you processing special category data without knowing it?

In this episode of InfoSec Insider – Talk DP, Martin Brazier, Senior Consultant at URM, explains the General Data Protection Regulation’s (GDPR’s) requirements around special category personal data, and how organisations can ensure they are not processing it unknowingly or unnecessarily.  Martin leverages his 20+ years of experience in information management and data protection compliance to discuss:  
What the GDPR defines as ‘special category data’ and the extra protections it affords to this type of personal data
The Information Commissioner’s Office’s (ICO’s) guidance on inferring special category data
Real-world Court of Justice of the European Union (CJEU) judgements that relate to the inferring or inadvertent collection of special category data, and what can be learned from these judgements
How you may be processing special category data unknowingly, and the steps you can take to avoid noncompliance.
Learn more about this topic:  https://www.urmconsulting.com/blog/are-you-processing-special-category-personal-data-without-knowing-it
If you enjoyed this episode of InfoSec Insider, you can leave us a rating and review here:  https://ratethispodcast.com/infosecinsider  
You can find more episodes of InfoSec Insider here:   
https://urmconsulting.com/podcasts  
 
Brought to you by URM, the UK’s leading information and cyber security specialists.  

The Impact of AI on PCI DSS Compliance

In this episode of InfoSec Insider, Alastair Stewart, Senior Consultant and Qualified Security Assessor (QSA) at URM, explores the ways in which artificial intelligence (AI) tools and systems can be leveraged for compliance with the Payment Card Industry Data Security Standard (PCI DSS).  Alastair draws upon over a decade of experience with the PCI DSS to discuss:
PCI DSS basics – what the PCI DSS is, which organisations need to comply, and how compliance the Standard is assessed
How AI can help secure cardholder data – the use cases for AI within the PCI DSS and the areas of PCI DSS compliance that AI can enhance
How AI can assist with your PCI DSS assessment – the ways in which AI can and cannot be used to enhance and streamline evidence collection and assessments
The future of the PCI DSS in relation to AI.
Learn more about this topic: https://www.urmconsulting.com/blog/the-impact-of-ai-on-pci-dss-compliance
If you enjoyed this episode of InfoSec Insider, you can leave us a rating and review here: https://ratethispodcast.com/infosecinsider     
You can find more episodes of InfoSec Insider here: https://urmconsulting.com/podcasts     
 
Brought to you by URM, the UK’s leading information and cyber security specialists.    

10 Top Tips for Maintaining Information and Cyber Security While Homeworking

In this episode of InfoSec Insider, Frazer Grudgings, Senior Consultant at URM, shares his top 10 tips on how to embed key cyber security practices and maintain the security of your organisation’s information assets whilst working remotely, whether that be from home or another location.  Frazer draws upon 15+ years in the information security field to explain the importance of and how to implement the following best practices:
Keeping assets out of sight
Using strong passwords on company devices and accounts
Ensuring your device is full patched
Maintaining the security of your home Wi-Fi connection and router
Setting up a separate virtual network (where necessary)
And many more!
Learn more about this topic:
https://www.urmconsulting.com/blog/10-top-tips-for-maintaining-information-and-cyber-security-when-homeworking
 
If you enjoyed this episode of InfoSec Insider, you can leave us a rating and review here:  https://ratethispodcast.com/infosecinsider  
 
You can find more episodes of InfoSec Insider here:   
https://urmconsulting.com/podcasts  
 
Brought to you by URM, the UK’s leading information and cyber security specialists.  
 

SOC 2 Explained

In this episode of InfoSec Insider, Chris Heighes, Senior Consultant at URM, breaks down the System and Organization Controls 2 (SOC 2), an information security framework aimed at providing assurance to a service provider’s clients that their data is stored and processed in a secure manner.  Chris leverages his 15+ years of experience in the information security space to discuss:
Which organisations should be considering a SOC 2 audit
What a SOC 2 audit involves
The benefits of having a SOC 2 report
The challenges an organisation may face when preparing for their first SOC 2 audit.
Learn more about this topic: https://www.urmconsulting.com/blog/soc-2-explained
If you enjoyed this episode of InfoSec Insider, you can leave us a rating and review here: https://ratethispodcast.com/infosecinsider     
You can find more episodes of InfoSec Insider here: https://urmconsulting.com/podcasts     
Brought to you by URM, the UK’s leading information and cyber security specialists.