Technical & Organisational Measures
Almost every data protection law requires appropriate security. This workshop walks through the catalogue of technical and organisational measures (TOMs), records what is already in place and plans what is missing.
Workshop 9 video
Walkthrough of the workshop and its tasks — coming soon
Workshop tasks
-
1. Assess organisational measures
With HR, management and the DPO, review policies, confidentiality, training, access joiners and leavers, vendors and incidents.
In ResGuard: TOM -
2. Assess technical measures
With IT, review physical access, authentication and MFA, permissions, encryption, logging, backups and network and device security.
In ResGuard: TOM -
3. Improvement plan
Prioritise missing measures by risk (using the DPIAs), assign owners, deadlines and budget, and track them as tasks.
In ResGuard: Objective Manager -
4. Document the TOMs
Describe the measures in place without revealing sensitive details, so they can be used as a contract annex and in audits.
In ResGuard: Policy Framework -
5. Workshop review & close-out
Review the results, attach evidence and close the objective in ResGuard.
In ResGuard: Objective Manager
What to keep in mind in Peru
- The ANPDP Information Security Directive sets measures according to the category of the database. Use it to check whether your measures are sufficient.
Expected result
- Organisational and technical measures assessed in the TOM module
- Initial maturity level recorded
- Improvement plan approved and tracked
- TOM documentation approved
ResGuard modules: TOM, Policy Framework, Objective Manager