Security of processing

Implement appropriate technical and organizational measures to ensure security of processing

Data protection by design

Implement data protection principles and safeguards into processing activities

Breach notification

Notify supervisory authority of personal data breaches within 72 hours

Data protection impact assessment

Conduct DPIA for processing operations likely to result in high risk

Records of processing activities

Maintain records of all processing activities under controller responsibility

Cross-border data transfers

Ensure appropriate safeguards for transfers of personal data to third countries

Risk management measures

Implement policies on risk analysis and information system security

Incident handling

Establish procedures to handle and respond to cybersecurity incidents

Supply chain security

Address security in supplier relationships and supply chain

Business continuity

Implement business continuity and disaster recovery capabilities

Security awareness training

Provide cybersecurity training and awareness programs for personnel

ICT risk management

Establish comprehensive ICT risk management framework covering identification and protection

Incident reporting

Implement classification and reporting mechanisms for major ICT-related incidents

Third-party risk management

Manage ICT third-party risk through due diligence and ongoing monitoring

Testing and resilience

Conduct regular testing of ICT systems, controls, and recovery capabilities

ICT service monitoring

Monitor performance and availability of critical ICT services

Information classification

Classify information in terms of legal requirements, value, and criticality

Operational procedures

Document and maintain operating procedures for information processing facilities

Compliance with legal requirements

Identify and comply with applicable legislation and contractual requirements

User access provisioning

Implement formal user access provisioning process for all system types

Technical vulnerability management

Obtain timely information about technical vulnerabilities and take action

Business continuity planning

Plan, implement, and maintain information security continuity

Information deletion

Delete information stored in systems, devices or media when no longer required

Data loss prevention

Apply data loss prevention measures to detect and prevent unauthorized disclosure

Information security in cloud services

Establish processes for acquisition, use, management and exit from cloud services

Configuration management

Establish and document configuration management for networks, systems and applications

Security by design

Design and develop products with cybersecurity as integral component

Vulnerability handling

Establish process to address and remediate vulnerabilities throughout product lifecycle

Secure development

Apply secure coding practices and vulnerability testing during development

Security documentation

Provide security documentation including instructions for secure use and configuration