Protection Measures
The Protection Obligation requires reasonable security arrangements for personal data. This workshop walks through the catalogue of technical and organisational measures (TOMs), records what is already in place and plans what is missing.
Workshop 9 video
Quick intro with a screen recording of the tasks — coming soon
What ResGuard provides
- Catalogue of technical and organisational measures as a ready-made checklist
- Maturity score, and an improvement plan as tasks with owners and due dates
- Template for the TOM document for contracts and audits
Workshop tasks
-
1. Assess organisational measures
With HR, management and the DPO, review policies, confidentiality, training, access for joiners and leavers, vendors and incidents.
In ResGuard: TOM -
2. Assess technical measures
With IT, review physical access, authentication and MFA, permissions, encryption, logging, backups and network and device security.
In ResGuard: TOM -
3. Improvement plan
Prioritise missing measures by risk (using the DPIAs), assign owners, deadlines and budget, and track them as tasks.
In ResGuard: Objective Manager -
4. Document the TOMs
Describe the measures in place without revealing sensitive details, so they can be used as a contract annex and in audits.
In ResGuard: Policy Framework -
5. Workshop review & close-out
Review the results, attach evidence and close the objective in ResGuard.
In ResGuard: Objective Manager
What to keep in mind under the PDPA
- The PDPC's Guide to Data Protection Practices for ICT Systems lists basic and enhanced practices; use it to check whether your measures are reasonable.
- Many PDPC enforcement decisions concern basic gaps such as weak passwords, missing MFA, misconfigured cloud storage and unpatched systems.
- CSA's Cyber Essentials and Cyber Trust marks are a good reference for the technical measures.
Expected result
- Organisational and technical measures assessed in the TOM module
- Initial maturity level recorded
- Improvement plan approved and tracked
- TOM documentation approved
ResGuard modules: TOM, Policy Framework, Objective Manager