From ISO/IEC27001:2013 and ISO/IEC27002:2013 to GDPR compliance controls. (8th June 2020)

• Record Type: Journal Article
• Authors: Diamantopoulou, Vasiliki; Tsohou, Aggeliki; Karyda, Maria
• Is Part Of: Information and computer security. Volume 28:Number 4(2020)
• Page Start: 645
• Page End: 662
• Publication Date: 2020-06-08
• Subjects: Compliance -- General data protection regulation -- Data protection controls -- Security controls -- ISO/IEC 270013A2013 -- ISO/IEC 270023A2013; Computer security -- Management -- Periodicals; Computer networks -- Security measures -- Periodicals; Data protection -- Management -- Periodicals; 658.47
• DOI: 10.1108/ICS-01-2020-0004
• Languages: English
• ISSNs: 2056-4961

Abstract

Abstract : Purpose: This paper aims to identify the controls provisioned in ISO/IEC 27001:2013 and ISO/IEC 27002:2013 that need to be extended to adequately meet, data protection requirements set by the General Data Protection Regulation (GDPR); it also indicates security management actions an organisation needs to perform to fulfil GDPR requirements. Thus, ISO/IEC 27001:2013 compliant organisations, can use this paper as a basis for extending the already existing security control modules towards data protection; and as guidance for reaching compliance with the regulation. Design/methodology/approach: This study has followed a two-step approach; first, synergies between ISO/IEC 27001:2013 modules and GDPR requirements were identified, by analysing all 14 control modules of the ISO/IEC 27001:2013 and proposing the appropriate actions towards the satisfaction of data protection requirements. Second, this paper identified GDPR requirements not addressed by ISO/IEC 27001:2013. Findings: The findings of this work include the identification of the common ground between the security controls that ISO/IEC 27001:2013 includes and the requirements that the GDPR imposes; the actions that need to be performed based on these security controls to adequately meet the data protection requirements that the GDPR imposes; and the identification of the remaining actions an ISO/IEC 27001 compliant organisation needs to perform to be able to adhere with the GDPR. Originality/value: This paper provides a gap analysis and a further steps identification regarding the additional actions that need to be performed to allow an ISO/IEC 27001:2013 certified organisation to be compliant with the GDPR.