The ISO Show

ISO 22716 sets out the framework for a quality management system for anyone involved in the manufacture of cosmetics and other healthcare related products. While this Standard's focus is on the manufacture of cosmetics specifically, many of the requirements can apply to any manufacturing process, especially those that involve a risk of contamination. On the surface, ISO 22716 may be considered a niche Standard, so why it is still so widely adopted? Today, Mel is joined by Derek Hall, a Senior Consultant here at Blackmores, to discuss the key drivers behind ISO 22716, including legal EU requirements and other related regulations. You'll learn Why is ISO 22716 used as an industry Standard? What is ISO 22716's relation to the Cosmetic Regulation (EC) No. 1223/2009? Who are these regulations applicable to? Other regulations and Standards applicable to cosmetics manaufacturing Resources isologyhub Blackmores ISO 22716 Implementation In this episode, we talk about: [00:42] A brief summary of ISO 22716 – watch the last episode for a full summary [01:25] Do you still need to comply with EU directives? Short answer – Yes, especially if you sub-contract parts of your manufacturing process / packaging or export product within the EU. [02:00] Why was the Cosmetic Regulation (EC) No 1223 created? To streamline and modernize current legislation across Europe for Cosmetics (though this can also include hygiene products i.e. soaps, toothpaste, deodorants ect) [03:30] What is the Cosmetic Regulation (EC) No 1223? This regulation establishes rules to be complied with by any cosmetic product made available on the market – to ensure a high-level of protection of human health [04:21] ISO 22716 is the central pillar of the Cosmetic Regulation (EC) No 1223 [05:02] A bit of background to the EU adoption of ISO 22716 – On April 21st 2011 – ISO 22716 officially became the Good Manufacturing Practices Standard for cosmetic product across Europe. This created a harmonised approach that ensured cosmetic products are safely manufactured, stored and shipped. [05:58] The whole regulation came into effect in July 2013. The laws for each nation had to follow this regulation – which included any relevant Standards or guidance affecting the cosmetic industry. This requirement also applies to any cosmetic manufacturers outside the EU that want to import into the EU. [07:36] Who are the regulations applicable to? Anyone involved in the cosmetic products chain (European and non-European). This includes raw materials producers, product assembly, distributors, exporters ect [08:05] ISO 22716 provides guidance for most parts involved in cosmetic production i.e. production, control, storage and shipment. However, it does not cover: safety for personnel (this may fall more under ISO 45001), protection for the environment, is not appliable to research & development and not appliable to the distribution of finished product [09:55] ISO 22716 is almost 20 years old – so environmental considerations weren't as much at the forefront of product manufacturing as they are today. Any manufacturers should be doing what they can about their impact regardless of current regulations (new versions may add guidance around this, so keep up-to-date with regulatory changes) [11:45] Other applicable standards include: The two part ISO 16128 Standard: ISO 16128-1: Guidelines on technical definitions and criteria for natural and organic cosmetic ingredients and products ISO 16128-2: Describes approaches to calculate natural, natural origin, organic and organic origin indexes that apply to the ingredient categories [13:58] COSMOS (standard Cosmetics Organic and Natural Standard) was created by many different International parties including BDIH (Germany), COSMEBIO & ECOCERT (France), ICEA (Italy), AISBL (Belgium) and Soil Association (UK). Its purpose is to define common requirements and definitions for organic and / or natural cosmetics. [15:25] Standards are created collaboratively by technical committees made up of global experts of their respective fields – they take years to develop to establish best practice [16:09] ISO 22716 has been approved by many regulatory bodies around the world, including the ICCR (The International Cooperation on Cosmetic Regulation), FDA (Food and Drug Administration), JCIA (The Japan Chemical Industry Association) and ASEAN Consultative Committee for Standards [17:10] Through current regulations, there is increased responsibility in regards to: Ingredients toxicity, product labelling, more comprehensive product file and compulsory notification of new products introduced to the EU [21:00] The current regulations have specific requirements for ingredient toxicity and product labelling We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

ISO 22716 sets out the framework for a quality management system for anyone involved in the manufacture of cosmetics and other healthcare related products. This is not only limited to production but also the control, storage, and transportation of products, including the purchase of raw materials, components and packaging material. While this Standard's focus is on the manufacture of cosmetics, many of the requirements can apply to any manufacturing process, especially those that involve a risk of contamination. Today, Mel is joined by Derek Hall, a Senior Consultant here at Blackmores, to talk through the main structure of the Standard and how it can be applied. You'll learn What is ISO 22716? Who does ISO 22716 apply to? How is ISO 22716 structured? How ISO 22716 can be applied Resources isologyhub Blackmores ISO 22716 Implementation The Checklist Manifesto In this episode, we talk about: [00:35] A description of ISO 22716 Good Manufacturing Practices – A supporting Standard for the manufacture of cosmetics [01:20] Why are we talking about such a niche standard? It's one of our most popular standards via website enquiry, so we'd like to share our knowledge 😊 [02:20] There is an EU directive pushing for the adoption of this Standard where applicable [03:00] A more in-depth summary of ISO 22716 – Why it's so important and why it was made [04:01] What does ISO 22716 cover? Guidelines and practical advice on the management of the human, technical and administrative factors affecting product quality. [04:58] A summary of the 17 clauses within ISO 22716 [07:55] What are the core elements of ISO 22716? Personnel, Premises and Equipment, Operations and Material Management, Quality Control and Cosmetics Quality Management System [08:50] Personnel – Key considerations include: Restricted areas free from food and drink, visitor supervision, personnel authorisation, personnel uniforms (removal of rings, hair restraints, safety glasses, gloves ect) [11:25] Premises and Equipment: The layout of buildings and equipment placement need to be controlled, controls for sanitisation and cleaning, guidance for storage, proper access to materials and equipment. [13:27] Premises: Pest control – should be very controlled to prevent contamination. This can be controlled via the building layout and cleaning controls. A pest control program should be created and followed. This extends to the exterior of your building too! [15:45] Equipment: Automated systems should be controlled in-line with ISO 22716. Equipment should be suitable for purpose and capable of regular cleaning and maintenance to avoid contamination. [17:02] Materials Management and Operation: How well do you control your materials? What controls do you have in place for manufacturing and packaging? How good is your storage? What is your delivery process? Do you keep documentation of all your purchasing and quality checks? [18:15] Materials Management and Operation: Stock – Consider how you manage and store stock, include regular checks to ensure it's all well within date. The Operations area in particular aligns with ISO 9001 – Quality Management. [19:40] Materials Management: You need to set the criteria for quality during different stages of manufacturing i.e. specifications for raw materials, components and packaging material. This should also include release parameters. [21:00] Materials Management criteria can be set out in a checklist. Mel mentions 'The Checklist Manifesto' as a recommended read [24:15] Materials Management: Make sure you store in a way that avoids any contamination or mix-ups. Ensure all containers are stored off the floor. Use clear labelling to show if they are accepted, rejected or quarantined [25:37] Operations: Should be carried out according to manufacturing documentation i.e. suitable equipment, product formula, details of the product process ect. [27:15] Quality Control: Consists of sampling, specification testing, out of spec investigations and release. You may subcontract out quality control – in which case, you must ensure you get proof that they are conducting adequate tests. [29:13] For subcontractors – Ensure you have a written contract OR agreement in place. If your subcontractor is subcontracting along the work, you need to ensure that process is controlled [31:32] Deviations: These can happen at any point in operation and can be both internal and external in origin [32:09] Complaints and Recall: You need to have processes in place to log and deal with complaints and recall. You should also regularly test your product recall process [33:20] Change Control: Making sure you have effective processes and documentation to control any changes to existing operation. I.e. if you get different machinery that changes mixing times [34:50] Internal Audits: You need to have an internal audit program in place and have competent independent personnel that can carry those audits out. This could be sub-contracted out [36:10] Documentation: You will be documenting all throughout the manufacturing process, it's integral. Ensure all staff know the importance of it and how to complete it correctly. We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

Today we're joined by Phil Bailey, Managed Services Director at PMC Retail, to talk about PMC's experience with ISO 27001, from implementation to on-going maintenance. PMC is a leading retail IT services and solutions provider, who recognised the growing need for formal Information Security certification. They succeeded in achieving certification to ISO 27001 in 2021, now over a year down the line, we catch up with Phil to find out what they've learned, benefits of certification and some tips for those looking to implement ISO 27001. You'll learn Who are PMC retail? How do PMC currently manage their ISO 27001 certification? How has the ISO Support Plan helped? What have they learned from implementing the standard? What are the benefits of implementing ISO 27001? ISO 27001 Top tips from Phil Resources PMC Retail The magic of thinking big by David J. Schwartz Blackmores ISO Support In this episode, we talk about: [01:03] An interesting fact about Phil – He started in electronic engineering and was involved the build of a system designed to measure the mirrors used in a telescope that was carried on the Discovery shuttle! [01:44] Who are PMC Retail? Started out consultancy to retailers, which has since branched out. [03:49] An example of one of PMC's projects – Pulling together legacy systems, updating them to newer technologies while maintaining the legacy data. [04:40] Learn about Phil's role at PMC [05:45] PMC now certified to ISO 27001 – One of the most popular ISO's globally in recent years. It's becoming something of a mandatory requirement in the tech space when bidding for contracts [06:31] How do PMC manage their ISO 27001 certification – Created a small team dedicated to the task of achieving certification – along with some help from us 😊 Following certification they onboarded a Compliance Governance Manager to keep up with Internal Audits and other ISO maintenance. [08:25] How has the ISO Support plan helped? – Blackmores helped to implement the standard, and were very familiar with their system and way of working. Great to have a wealth of knowledge to tap into. [09:00] PMC managed to implement the standard in just 6 months! [10:25] What did PMC learn from their experience? It wasn't an easy task! Getting leadership commitment from the start made a huge difference. [11:50] The benefits PMC have experienced by implementing and maintaining ISO 27001: Being able to identify risks and put actions in place to mitigate them. Certification demonstrates a robust security infrastructure to third parties. Establishes more credibility to customers and partners. They are able to see a pathway for business growth, utilising the certification. [14:30] ISO 27001 has helped to collate and bolster their existing Information Security structure – Having a library of resources, unified policies and procedures, company wide Objectives, and better understanding of measuring & managing risks. [16:15] PMC ensure that staff complete annual training – as required by the Standard. [17:10] Phil stresses that you can't just stay still with Information Security is concerned, you need to be aware of new risks and make sure those in your business are also aware and know how to react. [18:00] Top tips from Phil: Get Leadership commitment early on. Build yourself a Management Team. Get help from an experienced external party. It's not a walk in the park, and needs focus to achieve in a reasonable amount of time. [19:42] Phil's book recommendation: The magic of thinking big by David J. Schwartz. [21:42] Phil's favorite quote: "You're never too old to set a new goal, or too old dream another dream" We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

The work doesn't stop once you get ISO certified, there is a requirement to complete an annual surveillance audit to ensure your Management System continues to meet the requirements of the standard(s). Last week Mel covered some basic preparation you can do ahead of a Surveillance Audit, but what should you expect on the actual audit day? Today, Mel shares 10 top tips to help you prepare and ensure your next surveillance audit runs as smoothly as possible. You'll learn What is a Surveillance Audit? What to expect during the Surveillance Audit Considerations for remote vs on-site audits What evidence do you need to have prepared? Resources isology Hub Blackmores ISO Support In this episode, we talk about: [00:36] A description of a Surveillance Audit [02:00] A summary of the 10 top tips [02:40] There is no right or wrong way to prepare for a Surveillance Audit – but the following tips will be applicable regardless of the standard your certified to [03:30] Tip 1: Be Prepared – A summary of what Mel covered in the previous episode [05:40] Tip 2 – The opening Meeting – Be sure to have all people involved in the audit present at the meeting. It's advised to have a member of the leadership team present. Here the Auditor will explain the different types of audit findings. [08:00] Tip 3 – Audit questions – Similar to your Stage 1 and 2 Assessment, you will be asked a lot of questions. Try to be specific with your answers, and don't be afraid to ask for clarification. Don't worry if you don't know the answers to certain questions outside of your area of expertise, simply direct them to the correct individual who can answer. You are within your rights to seek clarification on findings – Do not argue with the auditor, simply ask for justification on findings if you're confused as to why they're being raised. [13:05] Tip 4: Keep on track – It's everyone's best interest to stick to the Agenda. [13:35] Tip 5: On-site Surveillance audits – Do a floor walk before the auditor arrives to check that you're following your procedures. Make sure reception knows that the Auditor is arriving, and follows any of your standard visitor procedures. Try to book a room to base the audit in to avoid them overhearing any unnecessary chatter and to allow the auditor and auditees some privacy. [16:05] Tip 6: Remote Surveillance Audits – Ensure that you follow any company remote working procedures. Ensure you have a good wi-fi connection, all attendees should be visible on camera but be muted when not speaking. Make sure everyone has access to the necessary documents while off-site. [17:15] Tip 7: The Auditor – They are human, and they are here to support you to ensure you are doing what you say you're doing. They are experts on their Standards and it's advised to foster a friendly relationship with them. But please be aware that they shouldn't be sending you reports from personal email addresses, be left unattended on-site and shouldn't be talking any information off-site – show evidence on screen / in-person during the audit. [20:20] Tip 8: The closing Meeting – Held at the end of the day. Listen to the feedback and findings from the auditor – they are there to help you improve. Feel free to ask for further clarification if needed. It's advised to have everyone at the opening meeting present at the closing meeting. [22:38] Tip 9: Evidence needed – You will typically need, audit schedule, audit reports and Management Review Minutes. You may also need various policies and procedures. Ensure that all documents are version controlled and any applicable branding is consistent. [24:10] Tip 10: Enjoy it! – If you're doing everything you say you're doing, then you should enjoy showing off your Management System. The resulting report should be seen as an opportunity to continually improve – the auditor only wants the best for your business. We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

The work doesn't stop once you get ISO certified, there is a requirement to complete an annual surveillance audit to ensure your Management System continues to meet the requirements of the standard(s). Surveillance audits must be carried out by a Certification Body, during which they will typically look at your Management Review, your preventative and corrective actions process, Internal auditing process and the implementation of any recommendations that have come out of an Internal audit. Today, Mel explains how you can prepare for a Surveillance audit and gives examples of some key considerations ahead of the Auditor arriving on site. You'll learn What is a Surveillance Audit? Why there is a requirement for an annual surveillance audit What you need to prepare ahead of a surveillance audit Resources isology Hub Blackmores ISO Support What to expect during your first ISO Assessment In this episode, we talk about: [00:59] A description of a Surveillance Audit [01:30] The purpose of a Surveillance Audit – Ensuring your Management System meets ISO Standard requirements and as an opportunity to demonstrate continual improvement [02:40] There is no right or wrong way to prepare for a Surveillance Audit – but the following tips will be applicable regardless of the standard your certified to [03:30] Tip 1: Check that you have an Agenda for the visit – This should be provided at the end of your last report from the Certification Body [04:25] A brief overview of how the certification cycle works – A 3 year plan is usually provided to you by your Certification Body [05:50] Ensure that you go ahead with a UKAS accredited Certification Body [06:18] Tip 2: Confirm locations – make sure you know where the auditor is being sent and to prepare staff on site about the impending visit. This can also allow you to book out time for specific people that may be required during the audit [07:10] Tip 3: Ensure you book out time for any required key members of staff – it is also advised that you book out a meeting room for the day [08:45] Be prepared for the Auditor to walk around your site – Especially if they're assessing ISO 45001 (Health and Safety) and ISO 27001 (Information Security) [09:40] Double check if the auditor visit is on-site or remote [10:30] Tip 4 – Check that you have all the relevant Management System records in place – and that they're up-to-date [10:50] Examples of what documentation the Auditor will typically look at [13:00] Tip 5 – Make sure you've closed out any opportunities for improvement and non-conformities from your last internal audit [14:30] Tip 6 – Check if there have been any changes to your business that may effect the scope of certification i.e. New products or services with no controls in place yet or a new site [16:00] Tip 6: Confirm the auditor's visit and check if they have any accessibility or dietary needs. [16:30] Tip 7: Warn any relevant reception / security staff about the visit so they know to expect the auditor. Ensure they go through any of your typical security procedures i.e. getting an access card, signing visitor book ect [17:42] Tip 8: Send an email to all staff to remind them about the surveillance visit – good to do this a day or two ahead of the visit [19:45] Tip 9: Do a floor walk – Ensure that any of the physical controls you have in place are working as intended We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

ISO 27002 was recently updated this year – along with a reduction of overall controls, 11 completely news ones were added to keep up with new and emerging technology. One of the new controls added under the Physical category, is something called physical security monitoring. But what does this mean exactly? Steve Mason joins us again today to delve deeper into physical security monitoring to explain what it is and give examples of different types of security and monitoring you can put in place. You'll learn What physical security monitoring is The purpose of physical security monitoring What should be monitored? Different types of security and monitoring you can consider Resources isology Hub Blackmores ICO CCTV Guidance In this episode, we talk about: [00:36] A quick recap of our ISO 27002 series and it's purpose to date – Start from Episode 109 [01:58] ISO 27002 controls reduced from 114 controls to 93 – reduction due to some of them being combined or made redundant in the latest version [04:02] The purpose of Physical Security Monitoring [06:22] Example of where security monitoring solved an issue at a bank [07:29] Another example of a London business who lacked physical security monitoring [08:45] The importance of reviewing your need for physical security monitoring – what level do you need? Will it include CCTV, Access cards ect [10:10] An overview of the various access points to consider, including: Main building, secure offices, server rooms, visitor access rights, CCTV, security alarms and personnel [10:53] Example of where failure to verify a visitor highlighted a companies lack of security. [11:30] The importance of communication and inductions for key reception and security staff, to ensure they can do the proper checks on visitors / know who should and should not be allowed into certain areas of your workplace. [13:50] Suggestion of a checklist for checks on visitors for temp reception staff [14:32] How do you define what needs 24 hour monitoring and what can be monitored for selected hours? [15:46] The installation of security measures should be appropriate for your needs – don't go overboard if it's not needed. i.e. a Data Centre would need a high level of security but a small office may only need access control [17:48] Take note of any security requirements in customer contracts [18:10] How do you ensure the integrity of your security measures? i.e. CCTV – guidelines are available for installation, including placement, connection to your systems, keeping the timestamps accurate, logging any camera failures. [20:00] Example of where a German company mapped out their CCTV so they could highlight blind spots, which were then pointed out to guards who did more checks in those areas [21:15] Make sure you maintain any security equipment [22:10] What crossover is there with other ISO 27002 controls? i.e. data masking being used in visitor books [24:45] How can you apply this control to home workers? This can include training on being aware of potential security risks at home and locking the computer when not nearby ect We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

ISO 27002 was recently updated this year – along with a reduction of overall controls, 11 completely news ones were added to keep up with new and emerging technology. One of the new controls added under the technological category, is something called web filtering. But what does this mean exactly? Steve Mason joins us again today to delve deeper into web filtering to explain what it is, breaks down the different types and gives examples of uses that you could implement to reduce risk. You'll learn What is web filtering? The purpose of web filtering The different types of web filtering Different measures of web filtering that can be implemented Resources isology Hub Blackmores In this episode, we talk about: [01:05] How you can adopt the new controls of ISO 27002 ahead of the latest version of ISO 27001:2022 being published [02:00] The purpose of web filtering [02:26] An overview of what web filtering is: It's a security technology that monitors web activity and prevents users from accessing websites with malicious content or sites that are deemed to be inappropriate for business use [03:45] Outlook already has web filtering built in [04:17] The Internet is still the dominant facilitator for cyber crime [04:40] Types of web filtering, including: Browser based filters, search engine filters, client side filters and network based filters [06:58] Examples of where web filtering comes into practice – to protect against threats from malicious sites with malware or fishing content, false anti-virus updates, sites with illegal content and sites with out of date SLL certificates. [08:15] Are you safe relying on Microsoft Windows? [08:50] What to look out for on websites to ensure it's secure: A padlock in the bottom right corner, use of reputable third party payment gateways. [09:27] Examples of what to be wary of when using the web i.e. deals that are too good to be true [11:40] Consider setting up a small internet café that is separate from the company network – to allow employees access for personal use and to help keep your systems safe. We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

ISO 27002 was recently updated this year – along with a reduction of overall controls, 11 completely news ones were added to keep up with new and emerging technology. One of the new controls added under the organisational category, is something called threat intelligence. But what does this mean exactly? Steve Mason joins us again today to delve deeper into threat intelligence to explain what it is, gives examples of the different types and shares some tools and activities that will help you implement threat intelligence You'll learn What is threat intelligence? What does threat intelligence actually do? The different types of threat intelligence What tools can you implement to help with threat intelligence? What activities can you do to help implement threat intelligence? Resources isology Hub Blackmores In this episode, we talk about: [01:19] The definition and purpose of threat intelligence [03:01] Threat intelligence doesn't have to factor into your scope and context – you can integrate findings in later [03:50] Threat intelligence is about being aware of not only internal threats, but global threats that could impact your business [04:50] Threat intelligence is not only about IT (i.e. viruses) [05:19] That being said – cyber threats are still a big factor. So ensure you have tools, training and measures in place to reduce cyber attacks and breaches. [06:30] Types of Threat intelligence, including: Cyber, Strategic and Tactical [07:58] What threat intelligence actually does – Firstly ensure that you are collecting relevant data. That data can be analysed and used to reduce risk, to help you be proactive instead of reactive to threats. [09:51] Threat intelligence is very appliable to Business Continuity (ISO 22301) [10:35] The different types of tools you could consider, including: Security information and event management (SIEM) and CSOC – Cyber Security Operation Centres [12:30] Types of threat intelligence activities you can do. This includes: Establishing objectives, collection of information from selected sources, analysing information to understand how it relates and is meaningful to the business and communicating information to relevant individuals. [15:10] Ensure your threat intelligence is dynamic – and use it to inform and update your Risk Assessments at regular intervals [16:30] Threat intelligence works with the Plan-Do-Act-Check cycle that is commonly seen in most ISO's [17:10] Threat intelligence can be used by any business regardless of any ISO certification you may or may not have. [18:05] Keep an eye out for our ISO 27001:2022 migration support offering! Just a reminder, we're offering 6 months free access to the isologyhub for anyone who signs up to an ISO Support Plan! We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

ISO 27002 was recently updated this year – along with a reduction of overall controls, 11 completely news ones were added to keep up with new and emerging technology. One of the new controls added under the technological category, is something called Data Masking. But what does this mean exactly? Steve Mason joins us again today to delve deeper into data masking to explain what it is, why it's so important and details a few of the different types of data masking You'll learn What is data masking? Why is data masking important? How does data masking work? What are the different types of data masking? Resources ISOlogy Hub Blackmores In this episode, we talk about: [01:33] The purpose of data masking according to ISO 27002 – Now more clearly defined when compared to earlier versions [02:55] A brief overview of PII (Personally Identifiable Information) [03:52] A summary of the defined attributes of data masking [05:25] What is data masking? Including definitions for obfuscation, data anonymization and pseudonymisation [08:50] The benefits of having a more clearly defined control for protecting PII [09:35] Other standards where data masking is applicable - ISO 27017, ISO 27018 and ISO 27701 [11:27] Why data masking is so important currently [12:40] How data masking works in practice [13:10] Static data masking - data is masked in an original database then duplicated into a test environment [13:34] Dynamic data masking - The original sensitive data remains in the repository. Data is never exposed to unauthorised users, contents are shuffled in real-time on-demand to make the contents masked [14:50] On the fly data masking - Masking data while it is transferred from production systems to test or development systems before the data is saved to disk. [15:55] Techniques for data masking include – Substitution - Businesses substitute the original data with random data from supplied or customised lookup file. [16:15] Shuffling - Businesses substitute original data with another authentic-looking data but they shuffle the entities in the same column randomly. [17:09] Number and date variances - For financial and date-driven data sets, applying the same variance to create a new dataset doesn't change the accuracy of the dataset while masking data. [17:56] Encryption is still the number one method for data masking [18:40] Character scrambling - This method involves randomly rearranging the order of characters. This process is irreversible so that the original data cannot be obtained from the scrambled data. [19:50] Other forms of data to take into consideration - Protected health information, Payment card information, Intellectual property and Company specific Information [23:02] How GDPR promotes data masking Just a reminder, we're offering 6 months free access to the isologyhub for anyone who signs up to an ISO Support Plan! We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

ISO 27002 was recently updated this year – along with a reduction of overall controls, 11 completely news ones were added to keep up with new and emerging technology. As a reminder, ISO 27002 (Information security, cybersecurity and privacy protection — Information security controls) is a guidance document which provides further best practice advice to strengthen your IT Security. Today, Steve Mason explains the changes made to the 2022 version of ISO 27002, gives a summary of the 11 new controls and gives some examples of some key considerations and actions you can take to implement them. You'll learn What changes have been made to ISO 27002:2022 Why ISO 27002 has been updated in 2022 An overview of the 11 new controls added to ISO 27002 Examples of actions you can take to implement the new controls Resources ISOlogy Hub Blackmores In this episode, we talk about: [01:28] A brief summary of the changes to ISO 27002:2022, including new controls, new structure and attribute types [05:30] Controls in ISO 27002 now have a defined purpose to avoid misinterpretation [06:29] A summary of the 11 new controls by name and category [08:10] Threat intelligence – What tools do you have in place to identify threats? How do you monitor your threat intelligence effectiveness? [11:20] Information Security use of Cloud Services – A reminder that ISO 27017 covers this in more detail! Do you have a cloud policy in place? Does it align with your clients security requirements? [13:10] ICT readiness for Business Continuity – Focus on recovery of IT services following a disaster. Do you have Business Impact Assessments in place? If you're certified to ISO 22301 – this area is most likely covered [14:36] Physical Security monitoring – Are you monitoring physical security? i.e. keycard access, CCTV ect [16:23] Configuration Management – Are you IT systems working well together? Do you have an established configuration for passwords? (i.e. how many characters, alpha numerical, symbols ect) [18:13] Information Deletion – If data needs to be deleted, that it's deleted in a secure manor and can't be recovered. [21:48] Data Masking – Make sure that any data that shouldn't be shared is masked in some way i.e. obfuscated or anonymized. [23:31] Data Leakage – Put measures in place to stop data being leaked through i.e. USB's, people sending business information to personal email addresses ect [26:55] Monitoring Activities – You could monitor network traffic, software access ect. Be selective in your monitoring, only do so if it will be of benefit to the business. [28:04] Web Filtering – Ensure that employees can't access any nefarious / high risk websites that could cause a security breach [30:15] Secure Coding – Make sure that coding is done securely – making sure that any software developed is secure and free of as many vulnerabilities as possible. Just a reminder, we're offering 6 months free access to the isologyhub for anyone who signs up to an ISO Support Plan! We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List