Guide contents
On this page
Guidance · Policies & Standards
Policies and standards
Written principles and requirements within which the work is performed.
Internal and external requirements
Internal policies may cover information security, data classification and approval authority. External constraints may include applicable legislation, regulatory requirements, contracts and adopted standards. Distinguish mandatory requirements from recommendations and the organisation's own choices.
Turn requirements into working practices
Record each applicable requirement, its source and where the process fulfils it. Assign monitoring and maintenance responsibilities. ISO 27001 is an information security management standard; ITIL is a service management framework. Neither replaces an assessment of applicable legislation.
A generic process model supports the implementation of requirements. Using the model alone does not demonstrate compliance.
Practical example
Handling data in a cloud service
The data classification policy guides permitted storage locations. A privacy assessment examines the conditions for processing personal data. Applicable supplier and contractual requirements are considered before deployment and throughout the use of the service.
GDPR Article 25 concerns data protection by design and by default. Article 35 covers DPIAs. DORA applies according to its scope; Article 13 addresses learning and evolving, and Article 28 addresses ICT third-party risk.
References to security of supply in the sources concern continuity. The organisation's exact obligations and current regulatory guidance must be identified separately.
Include in your process description
- Which requirements apply to this particular process?
- What is the source and current version of each requirement?
- At which step is the requirement implemented and checked?
- Who monitors changes to requirements?
Connections to other components
Based on the Generic Process Model materials. Questions and practical guidance have been structured for reading on the web. Sources and clarifications.