Technical & Organisational Measures
Almost every data protection law requires appropriate security. This workshop walks through the catalogue of technical and organisational measures (TOMs), records what is already in place and plans what is missing.
Workshop 9 video
Walkthrough of the workshop and its tasks — coming soon
What ResGuard provides
- Catalogue of technical and organisational measures as a ready-made checklist
- Maturity score, and an improvement plan as tasks with owners and due dates
- Template for the TOM document for contracts and audits
Workshop tasks
-
1. Assess organisational measures
With HR, management and the DPO, review policies, confidentiality, training, access joiners and leavers, vendors and incidents.
In ResGuard: TOM -
2. Assess technical measures
With IT, review physical access, authentication and MFA, permissions, encryption, logging, backups and network and device security.
In ResGuard: TOM -
3. Improvement plan
Prioritise missing measures by risk (using the DPIAs), assign owners, deadlines and budget, and track them as tasks.
In ResGuard: Objective Manager -
4. Document the TOMs
Describe the measures in place without revealing sensitive details, so they can be used as a contract annex and in audits.
In ResGuard: Policy Framework -
5. Workshop review & close-out
Review the results, attach evidence and close the objective in ResGuard.
In ResGuard: Objective Manager
What to keep in mind in Chile
- The duty of security requires appropriate technical and organisational measures based on the state of the art, costs and the risks of the processing. All staff are also bound by a duty of confidentiality.
- If your organisation provides essential services, the Cybersecurity Framework Law No. 21.663 adds its own security obligations.
Expected result
- Organisational and technical measures assessed in the TOM module
- Initial maturity level recorded
- Improvement plan approved and tracked
- TOM documentation approved
ResGuard modules: TOM, Policy Framework, Objective Manager