{"title":"EU Compliance","description":"\u003cp\u003eEditable documentation for EU regulatory compliance in data protection and digital resilience. It covers the GDPR, from a core programme to single-topic kits for consent and data subject rights, records of processing, privacy notices, breach response, DPIAs and the DPO role, together with the NIS 2 Directive and the Digital Operational Resilience Act (DORA). Integrated options sit alongside ISO\/IEC 27001, and awareness training covers staff and management bodies. Regulations are referenced by citation, and no regulation text is included. AGS is independent and is not affiliated with the European Commission, the European Data Protection Board or any supervisory authority.\u003c\/p\u003e","products":[{"product_id":"dora-ict-third-party-risk-digital-operational-resilience-management-system","title":"DORA ICT Third-Party Risk \u0026 Digital Operational Resilience Management System","description":"\u003cp\u003e\u003cem\u003eA documented DORA management system under Regulation (EU) 2022\/2554 — from ICT risk governance and major-incident reporting to the Register of Information, threat-led penetration testing and a defensible exit strategy for every critical provider.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch2\u003eOverview\u003c\/h2\u003e\n\u003cp\u003eThe Digital Operational Resilience Act — Regulation (EU) 2022\/2554 — has applied to financial entities across the EU since 17 January 2025. It replaces fragmented ICT guidance with a single supervisory regime spanning ICT risk management, incident classification and reporting, digital operational resilience testing, ICT third-party risk and information sharing. Responsibility sits explicitly with the management body, and supervisors expect a documented, evidenced framework rather than a collection of ad hoc controls.\u003c\/p\u003e\n\u003cp\u003eThis toolkit documents that framework end to end. It is built against DORA and its Level-2 measures — Commission Delegated Regulations (EU) 2024\/1772 on incident classification, 2024\/1773 on the third-party policy and 2024\/1774 on the ICT risk management framework, and Implementing Regulation (EU) 2024\/2956 on the Register of Information — with a regulatory version-control register and change log that track the 2025 acts on incident reporting ((EU) 2025\/301 and 2025\/302), subcontracting ((EU) 2025\/532) and TLPT ((EU) 2025\/1190), so each is confirmed against the Official Journal before the dependent controls are relied upon.\u003c\/p\u003e\n\u003ch2\u003eWhat this system covers\u003c\/h2\u003e\n\u003cp\u003eA management manual anchors the system; policies and procedures then work through each obligation in operating detail, supported by forms, checklists and Excel registers, calculators and dashboards that become your live compliance records. A requirements traceability matrix maps the documentation back to the regulation, and a seventeen-phase implementation roadmap, guidance library and training modules take the team from the initial applicability assessment through to management review and internal audit. The modules cover:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eICT risk management — asset inventory, dependency mapping and critical or important function identification\u003c\/li\u003e\n\u003cli\u003eIncident management — classification, significant cyber threat assessment and major-incident reporting\u003c\/li\u003e\n\u003cli\u003eResilience testing and TLPT governance\u003c\/li\u003e\n\u003cli\u003eThe full third-party lifecycle — due diligence, contractual compliance, subcontracting and fourth-party risk, concentration risk, monitoring and exit\u003c\/li\u003e\n\u003cli\u003eThe Register of Information, with data-quality validation\u003c\/li\u003e\n\u003cli\u003eDigital operational resilience — business impact analysis, impact tolerances, continuity, disaster recovery, crisis management and a severe-but-plausible scenario library\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch2\u003eWho it's for\u003c\/h2\u003e\n\u003cp\u003eHeads of ICT risk and operational resilience, DORA compliance officers, CISOs and third-party risk managers at banks, insurers, investment firms, payment and e-money institutions and crypto-asset service providers within the scope of DORA — and the consultancies building DORA programmes for them. It suits entities documenting the regime for the first time as well as those consolidating scattered artefacts into one traceable system ahead of a supervisory review.\u003c\/p\u003e","brand":"Apex Global Solutions AGS","offers":[{"title":"Default Title","offer_id":57017075269972,"sku":"AGS-20-001","price":2450.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1052\/4996\/4372\/files\/AGS-20-001.png?v=1788398420"},{"product_id":"eu-gdpr-iso-iec-27001-2022-integrated-management-system","title":"EU GDPR \u0026 ISO\/IEC 27001:2022 Integrated Management System","description":"\u003cp\u003e\u003cem\u003eAn editable integrated system that runs GDPR compliance and an ISO\/IEC 27001:2022 information security management system as one set of documents, with two separate evidence trails.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch2\u003eOverview\u003c\/h2\u003e\n\u003cp\u003eAn ISO\/IEC 27001 management system does not on its own show that an organisation meets the GDPR. Running two programmes doubles the work. This system builds one management system that serves both, while keeping the GDPR legal records apart from the ISMS documents so each can be shown on its own.\u003c\/p\u003e\n\u003cp\u003eAn integrated risk method scores security risk and risk to individuals separately and feeds one Statement of Applicability. The Annex A controls are written up in control volumes, each with control record registers. Master traceability matrices trace GDPR articles, ISO clauses and every Annex A control to documents and evidence.\u003c\/p\u003e\n\u003cp\u003eThe privacy-specific parts use ISO\/IEC 27701:2025, and the risk method draws on ISO\/IEC 27005:2022. ISO\/IEC 27001:2022 is referenced with Amendment 1:2024, and ISO\/IEC 27002:2022 is referenced as guidance, so you will need your own copy of it. Standard contractual clauses under Commission Implementing Decision (EU) 2021\/914 are referenced, not reproduced. AGS is independent and is not affiliated with the European Commission or any supervisory authority. Standards are referenced by number and title only, and no standard text is included. Regulations are referenced by citation.\u003c\/p\u003e\n\u003ch2\u003eWhat this system covers\u003c\/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eSystem governance:\u003c\/strong\u003e an integrated ISMS and PIMS manual, an integrated information security and privacy policy, a privacy governance policy, a DPO appointment and independence assessment, steering committee terms, legal compliance, document control and escalation.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eScope and inventories:\u003c\/strong\u003e scope, asset and personal data inventories, controller and processor records of processing, retention, the integrated risk method and the Statement of Applicability.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eGDPR operations:\u003c\/strong\u003e data protection policy, privacy by design, consent, data subject rights, privacy notice templates, rights response templates and a DPIA template.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAnnex A controls:\u003c\/strong\u003e control volumes covering the ISO\/IEC 27001 Annex A control domains, with control record registers.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eSuppliers and transfers:\u003c\/strong\u003e an Article 28 data processing agreement template, a supplier security schedule and a transfer impact assessment.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eIncidents and continuity:\u003c\/strong\u003e one incident procedure with a parallel privacy track, a 72-hour decision path for Article 33 and Article 34, and continuity and disaster recovery.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAssurance:\u003c\/strong\u003e competence, internal audit with an audit interview preparation guide, management review, corrective action, and worked examples for a fictional SaaS processor, professional services firm and e-commerce business.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch2\u003eWho it's for\u003c\/h2\u003e\n\u003cp\u003eSmall and mid-sized organisations in the EU and EEA without a full-time compliance function that want one system for information security and data protection. It also suits organisations adding the GDPR to an existing ISO\/IEC 27001 ISMS, and processors selling to controllers.\u003c\/p\u003e\n\u003cp\u003eIf you need the GDPR alone, the EU GDPR Core Management System covers the whole programme without the ISMS. For one process in depth, see the EU GDPR Personal Data Breach Response Management System or the EU GDPR Data Protection Impact Assessment (DPIA) Management System.\u003c\/p\u003e","brand":"Apex Global Solutions AGS","offers":[{"title":"Default Title","offer_id":57395122307412,"sku":"AGS-19-005","price":950.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1052\/4996\/4372\/files\/AGS-19-005.png?v=1790973726"},{"product_id":"eu-gdpr-consent-data-subject-rights-management-system","title":"EU GDPR Consent \u0026 Data Subject Rights Management System","description":"\u003cp\u003e\u003cem\u003eAn editable system for GDPR consent and data subject requests: when consent is valid and how to prove it, and how each request is handled from intake to response.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch2\u003eOverview\u003c\/h2\u003e\n\u003cp\u003eConsent fails quietly, through bundled wording, a power imbalance or a withdrawal nobody acted on. Rights requests fail loudly, through a missed one-month deadline or a reply that discloses someone else's data. This system handles both as defined processes with evidence at every step.\u003c\/p\u003e\n\u003cp\u003eConsent is treated as one lawful basis among others. Lawful-basis selection comes first, then validity assessments, bundling and power-imbalance checks, records, withdrawal, and children's consent with parental authorisation. Data subject requests under Articles 12 to 22 run through one common process covering deadlines, extensions, manifestly unfounded or excessive requests, fees, exemptions and third-party balancing. A workflow for each right plugs into it, and plain-language response letters cover each decision the process can reach.\u003c\/p\u003e\n\u003cp\u003eThe system rests on Regulation (EU) 2016\/679 (GDPR), cited to article, paragraph and recital. EDPB guidelines on consent and on the right of access, and Article 29 Working Party guidance on portability and transparency, are cited as guidance. Points that depend on national law, including the ePrivacy Directive 2002\/58\/EC as implemented in each country, are marked for local legal verification. AGS is independent and is not affiliated with the European Data Protection Board or any supervisory authority. Regulations are referenced by citation.\u003c\/p\u003e\n\u003ch2\u003eWhat this system covers\u003c\/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eConsent management:\u003c\/strong\u003e lawful-basis selection, validity assessments, bundling and power-imbalance checks, consent forms and records, withdrawal and consent registers.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eChildren and special categories:\u003c\/strong\u003e children's consent with parental authorisation, and consent for special-category data.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRequest handling:\u003c\/strong\u003e one common procedure for deadlines, extensions, fees, exemptions, manifestly unfounded or excessive requests and third-party balancing, with a one-month deadline calculation guide.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eIntake and identity:\u003c\/strong\u003e verification on every channel, including employee requests, authorised representatives and requests concerning deceased persons.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRight-specific workflows:\u003c\/strong\u003e access, rectification, erasure, restriction, portability, objection, direct marketing and automated decisions, each with evidence records.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eResponse letters:\u003c\/strong\u003e plain-language letters for each outcome the process can reach.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eOversight:\u003c\/strong\u003e registers, dashboards, training, audit checklists, a gap analysis, an article-to-document-to-evidence matrix and a phased implementation plan.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eWorked examples:\u003c\/strong\u003e completed fictional sets for an e-commerce company, a professional services firm and a SaaS provider.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch2\u003eWho it's for\u003c\/h2\u003e\n\u003cp\u003eControllers, website and e-commerce operators, marketing organisations, employers, healthcare and education bodies and platform companies, each with named starting documents. Processors have an escalation route for requests that reach them. Practical guides address common failure points, such as calculating the one-month deadline and handling employee requests during disputes.\u003c\/p\u003e\n\u003cp\u003eNotices that tell people about their rights are covered by the EU GDPR Privacy Notice \u0026amp; Transparency Management System. For a whole GDPR programme, see the EU GDPR Core Management System.\u003c\/p\u003e","brand":"Apex Global Solutions AGS","offers":[{"title":"Default Title","offer_id":57395123454292,"sku":"AGS-19-006","price":850.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1052\/4996\/4372\/files\/AGS-19-006.png?v=1790973733"},{"product_id":"eu-gdpr-data-mapping-records-of-processing-ropa-management-system","title":"EU GDPR Data Mapping \u0026 Records of Processing (ROPA) Management System","description":"\u003cp\u003e\u003cem\u003eAn editable system that takes an organisation from data discovery to a signed-off Article 30 record of processing activities, for controllers and processors.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch2\u003eOverview\u003c\/h2\u003e\n\u003cp\u003eA record of processing is only as good as the discovery behind it. Records written from memory in one sitting soon drift from what the organisation actually does. This system starts with structured discovery across departments and systems, builds inventories and data-flow maps, and only then completes the record.\u003c\/p\u003e\n\u003cp\u003eSeparate workbooks hold the controller record and the processor record, each with a completion guide and validation checklist. Every field is mapped to Article 30, and what the Article requires is separated from good practice, field by field. The small-organisation exemption is treated as something to assess, not assume, and has its own assessment. Change control, audit and reconciliation tools keep the record aligned with real processing.\u003c\/p\u003e\n\u003cp\u003eThe system rests on Regulation (EU) 2016\/679 (GDPR), Article 30. EDPB and Article 29 Working Party guidance is cited at document and section level and marked for verification against the published versions. Standard contractual clauses under Commission Implementing Decision (EU) 2021\/914 are referred to, not reproduced. AGS is independent and is not affiliated with the European Commission, the European Data Protection Board or any supervisory authority. Regulations are referenced by citation.\u003c\/p\u003e\n\u003ch2\u003eWhat this system covers\u003c\/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eGovernance:\u003c\/strong\u003e policy, procedure, role appointment forms, controller and processor role determination, escalation and document control.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eDiscovery:\u003c\/strong\u003e questionnaires for departments, HR, marketing, CCTV, websites, mobile apps, cloud, AI, paper records and shadow IT, with interview guides.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eInventories and flows:\u003c\/strong\u003e data inventories, registers for special-category, criminal-offence and children's data, and data-flow templates.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRecords of processing:\u003c\/strong\u003e controller and processor ROPA workbooks with completion guides, validation checklists and an exemption assessment.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eLawful basis:\u003c\/strong\u003e assessments including legitimate interests and the Article 9 and Article 10 conditions.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRecipients, transfers and retention:\u003c\/strong\u003e recipient and transfer registers, retention and security records, and risk tools.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eChange and reconciliation:\u003c\/strong\u003e change control, matrices, reconciliation tools and audit checklists.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eWorked examples:\u003c\/strong\u003e completed fictional sets for a Dutch e-commerce controller, a SaaS processor and a professional services LLP.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch2\u003eWho it's for\u003c\/h2\u003e\n\u003cp\u003eControllers, joint controllers and processors in the EU and EEA, including employers, e-commerce, professional services, technology and SaaS, healthcare and education. DPOs, privacy leads, compliance managers, consultants and internal audit teams use it. The implementation plans set out a 90-day path from a standing start to an approved, evidenced record.\u003c\/p\u003e\n\u003cp\u003eIt is designed as the companion of the EU GDPR Privacy Notice \u0026amp; Transparency Management System, which builds notices from the record this system produces.\u003c\/p\u003e","brand":"Apex Global Solutions AGS","offers":[{"title":"Default Title","offer_id":57395124666708,"sku":"AGS-19-007","price":850.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1052\/4996\/4372\/files\/AGS-19-007.png?v=1790973739"},{"product_id":"eu-gdpr-privacy-notice-transparency-management-system","title":"EU GDPR Privacy Notice \u0026 Transparency Management System","description":"\u003cp\u003e\u003cem\u003eAn editable system for building, delivering and evidencing GDPR privacy notices, drafted from your own record of processing rather than from template text.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch2\u003eOverview\u003c\/h2\u003e\n\u003cp\u003eA privacy notice copied from another website describes someone else's processing. This system builds notices from the organisation's own record of processing activities. Content builders and checklists work through Articles 12 to 14 provision by provision, and a reconciliation matrix checks each notice against the record field by field.\u003c\/p\u003e\n\u003cp\u003eModel notices cover the common audiences: employees, candidates, customers, website visitors, people filmed by CCTV, suppliers, children, mobile app users, professional clients, patients, members and donors. A short-form first layer, a cookie notice and an Article 14 message complete the set. Delivery is treated as a process with evidence: layered and just-in-time delivery, records that the notice was given, decisions on when to re-notify, and informing people whose data was not collected from them.\u003c\/p\u003e\n\u003cp\u003eThe system rests on Regulation (EU) 2016\/679 (GDPR), Articles 12 to 14, with the Article 29 Working Party transparency guidelines (WP260 Rev.01), which the European Data Protection Board has endorsed, cited as guidance. National ePrivacy positions are left for you to add. AGS is independent and is not affiliated with the European Data Protection Board or any supervisory authority. Regulations are referenced by citation.\u003c\/p\u003e\n\u003ch2\u003eWhat this system covers\u003c\/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eGovernance:\u003c\/strong\u003e a transparency policy, a notice development and approval procedure, governance structure and escalation.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eContent:\u003c\/strong\u003e Article 13 and Article 14 content checklists and content builders.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAudiences and collection points:\u003c\/strong\u003e audience identification and collection-point registers.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eModel notices\u003c\/strong\u003e for each common audience, with drafting notes, for example on consent, health data and monitoring in the employee notice.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eDelivery and evidence:\u003c\/strong\u003e layered and just-in-time delivery, delivery evidence and re-notification decisions.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eCookies and Article 14:\u003c\/strong\u003e a cookie notice module and an Article 14 notification module.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAssurance:\u003c\/strong\u003e change control, notice audits, ROPA-to-notice reconciliation, matrices and completed fictional example sets.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch2\u003eWho it's for\u003c\/h2\u003e\n\u003cp\u003eAny controller that must inform data subjects, including employers, retail, professional services, SaaS, healthcare, education, membership bodies and charities. Processors use it for their own controller-side processing. DPOs, marketing and product teams, and consultants are the main users.\u003c\/p\u003e\n\u003cp\u003eIt is the companion of the EU GDPR Data Mapping \u0026amp; Records of Processing (ROPA) Management System, which produces the record the notices are built from. Rights handling is covered by the EU GDPR Consent \u0026amp; Data Subject Rights Management System.\u003c\/p\u003e","brand":"Apex Global Solutions AGS","offers":[{"title":"Default Title","offer_id":57395125289300,"sku":"AGS-19-008","price":850.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1052\/4996\/4372\/files\/AGS-19-008.png?v=1790973747"},{"product_id":"eu-gdpr-core-management-system","title":"EU GDPR Core Management System","description":"\u003cp\u003e\u003cem\u003eAn editable GDPR programme in compact form, with one Word volume and one Excel workbook for each topic, from scope and governance to breach response and audit.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch2\u003eOverview\u003c\/h2\u003e\n\u003cp\u003eAn organisation building a GDPR programme for the first time needs every part of it, not a deep set on one topic. This system covers the programme end to end in short documents bound into volumes. Each topic folder holds a Word volume of short documents, each with its own code and control block, and a workbook with the registers for that topic.\u003c\/p\u003e\n\u003cp\u003eA master document index lists every bound document with its requirement status (mandatory, conditional or good practice) and flags the points that need legal review. The system is clear about what it will not supply. Retention periods, your processors and conclusions on national law are left to you and recorded as open points, never assumed. A worked example pack follows one fictional processing activity through the set.\u003c\/p\u003e\n\u003cp\u003eThe system is built on Regulation (EU) 2016\/679 (GDPR). Material from the European Data Protection Board and the former Article 29 Working Party is cited as guidance only. AGS is independent and is not affiliated with the European Data Protection Board or any supervisory authority. Regulations are referenced by citation.\u003c\/p\u003e\n\u003ch2\u003eWhat this system covers\u003c\/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eProgramme control:\u003c\/strong\u003e a read-me-first, user guide, roadmap and definitions for the whole set.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eScope and governance:\u003c\/strong\u003e scope and applicability, governance and the decision on whether a DPO is needed.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRecords:\u003c\/strong\u003e data mapping and records of processing, lawful basis and consent.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eIndividuals:\u003c\/strong\u003e transparency and notices, and data subject rights with a policy, procedure, checklists and response letters.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRisk:\u003c\/strong\u003e privacy by design and data protection impact assessment.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eThird parties:\u003c\/strong\u003e processors and international transfers.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRetention and security:\u003c\/strong\u003e retention, security of processing and personal data breach.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eImprovement:\u003c\/strong\u003e training, audit and improvement, tied together by the master document index.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch2\u003eWho it's for\u003c\/h2\u003e\n\u003cp\u003eControllers, processors and joint controllers of any size, private and public, within the territorial scope of the GDPR. It suits a smaller organisation building a programme for the first time. Privacy officers, DPOs, compliance, legal and security teams, internal audit and consultants each work from it.\u003c\/p\u003e\n\u003cp\u003eFor depth on a single process, see topic systems such as the EU GDPR Data Mapping \u0026amp; Records of Processing (ROPA) Management System and the EU GDPR Consent \u0026amp; Data Subject Rights Management System. For the GDPR and ISO\/IEC 27001 in one system, see the EU GDPR \u0026amp; ISO\/IEC 27001:2022 Integrated Management System.\u003c\/p\u003e","brand":"Apex Global Solutions AGS","offers":[{"title":"Default Title","offer_id":57395125813588,"sku":"AGS-19-009","price":950.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1052\/4996\/4372\/files\/AGS-19-009.png?v=1790973754"},{"product_id":"eu-gdpr-personal-data-breach-response-management-system","title":"EU GDPR Personal Data Breach Response Management System","description":"\u003cp\u003e\u003cem\u003eAn editable system for responding to personal data breaches under the GDPR, from the first report through notification decisions to root cause and review.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch2\u003eOverview\u003c\/h2\u003e\n\u003cp\u003eWhen a breach is discovered, the clock starts. Someone has to decide quickly whether the supervisory authority must be told, whether individuals must be told, and what evidence supports each decision. This system sets out that path in advance, with a first-24-hour and first-72-hour route through it.\u003c\/p\u003e\n\u003cp\u003eIt follows a breach lifecycle from detection to review. Intake forms are organised by incident type. A risk assessment method keeps the Article 33 threshold for notifying the authority separate from the Article 34 threshold for telling individuals, with likelihood and severity criteria and harm-specific assessments. A generic notification template covers the content the authority must receive, with phased notification where facts are still emerging. No supervisory authority's form or portal is reproduced, and you verify the national procedure that applies to you.\u003c\/p\u003e\n\u003cp\u003eThe system rests on Regulation (EU) 2016\/679 (GDPR), Article 4, Article 33 and Article 34, with European Data Protection Board guidelines on breach notification and on examples of breach notification cited as guidance. AGS is independent and is not affiliated with the European Data Protection Board or any supervisory authority. Regulations are referenced by citation.\u003c\/p\u003e\n\u003ch2\u003eWhat this system covers\u003c\/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eGovernance and preparedness:\u003c\/strong\u003e a breach response policy, an integrated security incident and breach procedure, team terms of reference, escalation and notification authority matrices, and interfaces with legal counsel and forensic providers.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eDetection and triage:\u003c\/strong\u003e intake by incident type, triage and containment.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRisk assessment:\u003c\/strong\u003e the Article 33 and Article 34 method with harm-specific assessment forms.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eNotification:\u003c\/strong\u003e a 72-hour record, phased notification and a generic supervisory authority template.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eCommunication:\u003c\/strong\u003e letters, alerts, an FAQ and a call-centre script for affected individuals, processor communication and crisis communication.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRecords and recovery:\u003c\/strong\u003e the breach register required by the GDPR, evidence registers, root cause, corrective action and recovery.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eReadiness:\u003c\/strong\u003e exercise scenarios, a staff awareness guide, training, audit tools, matrices and worked cases with mixed outcomes, including breaches that were not notified.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch2\u003eWho it's for\u003c\/h2\u003e\n\u003cp\u003eControllers, joint controllers and processors handling personal data in any format and location. The DPO, a Breach Response Lead and the senior managers who take notification decisions each have defined roles.\u003c\/p\u003e\n\u003cp\u003eOrganisations running an ISO\/IEC 27001 ISMS can use it alongside the ISMS - ISO\/IEC 27001:2022 toolkit, which covers incident management, as this system adds the GDPR breach decisions. Standards are referenced by number and title only, and no standard text is included.\u003c\/p\u003e","brand":"Apex Global Solutions AGS","offers":[{"title":"Default Title","offer_id":57395126239572,"sku":"AGS-19-010","price":850.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1052\/4996\/4372\/files\/AGS-19-010.png?v=1790973761"},{"product_id":"eu-gdpr-data-protection-impact-assessment-dpia-management-system","title":"EU GDPR Data Protection Impact Assessment (DPIA) Management System","description":"\u003cp\u003e\u003cem\u003eAn editable system for running data protection impact assessments under the GDPR, from screening to approval, prior consultation and review.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch2\u003eOverview\u003c\/h2\u003e\n\u003cp\u003eA DPIA is meant to shape a project before it launches, not to justify it afterwards. This system runs the assessment as an eleven-step lifecycle, from screening to approval, prior consultation with the supervisory authority under Article 36 where it is needed, then monitoring and review. Each step has defined inputs, outputs and evidence.\u003c\/p\u003e\n\u003cp\u003eScreening works against Article 35, the WP248 criteria and the national lists. A privacy risk method with harm catalogues and rating criteria assesses risk to individuals without inventing numeric thresholds. DPO advice is recorded separately from management decisions, so the record shows who advised and who decided. Scenario annexes cover high-risk processing such as employee monitoring, CCTV, biometrics, AI and machine learning, health data, children, cookies, cloud services and international transfers.\u003c\/p\u003e\n\u003cp\u003eThe system rests on Regulation (EU) 2016\/679 (GDPR), Article 35 and Article 36, with the WP248 Rev.01 guidelines, which the European Data Protection Board has endorsed, used throughout. Further EDPB guidance, including its guidelines on Article 25, is cited at section level. The national lists of processing that requires a DPIA, published by each supervisory authority, are not supplied, so you check the list that applies to you. AGS is independent and is not affiliated with the European Data Protection Board or any supervisory authority. Regulations are referenced by citation.\u003c\/p\u003e\n\u003ch2\u003eWhat this system covers\u003c\/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eGovernance:\u003c\/strong\u003e DPIA policy, procedure, governance framework, review panel terms, a DPO role statement, escalation and record control.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eScreening:\u003c\/strong\u003e a screening questionnaire and criterion-specific assessments.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eDescribing the processing:\u003c\/strong\u003e processing description and data-flow templates, and a technology architecture questionnaire.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eNecessity and risk:\u003c\/strong\u003e necessity and proportionality, a privacy risk methodology with harm catalogues and rating criteria, and risk treatment.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eSafeguards and consultation:\u003c\/strong\u003e safeguards, processor safeguards, and consultation and prior consultation records.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eScenario annexes\u003c\/strong\u003e for high-risk processing, from employee monitoring and biometrics to AI, children's data and transfers.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAssurance:\u003c\/strong\u003e audit tools, matrices, a metrics dashboard, gap analysis, readiness tools and completed fictional DPIAs with mixed outcomes.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch2\u003eWho it's for\u003c\/h2\u003e\n\u003cp\u003eControllers and joint controllers, and processors assisting with DPIAs under Article 28. It is written for small and medium organisations and scales to large and regulated ones. Worked examples include AI-assisted recruitment, a mobile health app, CCTV, e-commerce behavioural advertising and SaaS analytics.\u003c\/p\u003e\n\u003cp\u003eA DPO who advises on DPIAs can pair it with the EU GDPR Data Protection Officer (DPO) Management System.\u003c\/p\u003e","brand":"Apex Global Solutions AGS","offers":[{"title":"Default Title","offer_id":57395127222612,"sku":"AGS-19-011","price":850.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1052\/4996\/4372\/files\/AGS-19-011.png?v=1790973766"},{"product_id":"eu-gdpr-data-protection-officer-dpo-management-system","title":"EU GDPR Data Protection Officer (DPO) Management System","description":"\u003cp\u003e\u003cem\u003eAn editable system for the data protection officer role under the GDPR: whether you need one, how to appoint and resource the DPO, and how the role runs day to day.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch2\u003eOverview\u003c\/h2\u003e\n\u003cp\u003eThe DPO question is easy to get wrong in both directions. Some organisations appoint a DPO without checking whether one is required, and others appoint one whose independence and resources are never written down. This system starts with the Article 37 assessment and ends that stage with a signed record of whether a DPO is required.\u003c\/p\u003e\n\u003cp\u003eAppointment covers internal, group and external DPOs, with selection, terms of reference, an appointment letter and external DPO terms. Independence and conflict policies, direct access to the highest management level and access matrices protect the role. An operating manual, work plans, advice records, review checklists by topic, a monitoring programme and reports carry it into daily practice. The system is consistent on one point: the DPO advises and monitors, but never owns or approves processing.\u003c\/p\u003e\n\u003cp\u003eThe system rests on Regulation (EU) 2016\/679 (GDPR), Articles 37 to 39, with an alignment checklist and matrix for the Article 29 Working Party guidelines on DPOs (WP243 Rev.01), which the European Data Protection Board has endorsed. AGS is independent and is not affiliated with the European Data Protection Board or any supervisory authority. Regulations are referenced by citation.\u003c\/p\u003e\n\u003ch2\u003eWhat this system covers\u003c\/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eApplicability and designation:\u003c\/strong\u003e Article 37 assessments, the required or not required decision record, selection, terms of reference, an appointment letter and external DPO terms.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eGovernance and independence:\u003c\/strong\u003e a governance policy, independence and conflict of interest policies, direct access to the highest management level, committee participation and access matrices.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eOperations:\u003c\/strong\u003e an operating manual, work plans, advice records, review checklists by topic, a monitoring programme and DPO reports.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eDPIA support and liaison:\u003c\/strong\u003e DPIA support, liaison with data subjects and the supervisory authority, and the public DPO contact notice.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eTraining:\u003c\/strong\u003e training modules on the DPO role and on data protection duties.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAudit and readiness:\u003c\/strong\u003e audit checklists for Articles 37 to 39 and for WP243 alignment, a phased implementation plan and a compliance calendar.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eWorked examples:\u003c\/strong\u003e fictional files for an e-commerce controller, a SaaS processor, a public-sector body, a group DPO and an external DPO.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch2\u003eWho it's for\u003c\/h2\u003e\n\u003cp\u003ePrivate controllers and processors, public authorities, corporate groups with a group DPO, and organisations using an internal, shared or outsourced DPO or appointing one voluntarily. It is used by the DPO and by the management that appoints and resources the role.\u003c\/p\u003e\n\u003cp\u003eA DPO who advises on impact assessments can pair it with the EU GDPR Data Protection Impact Assessment (DPIA) Management System.\u003c\/p\u003e","brand":"Apex Global Solutions AGS","offers":[{"title":"Default Title","offer_id":57395128009044,"sku":"AGS-19-012","price":850.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1052\/4996\/4372\/files\/AGS-19-012.png?v=1790973773"},{"product_id":"eu-gdpr-privacy-data-protection-awareness-training-package","title":"EU GDPR Privacy \u0026 Data Protection Awareness Training Package","description":"\u003cp\u003e\u003cem\u003eAn editable GDPR training package with learning paths for senior management, privacy staff, all employees, specific roles, new starters and an annual refresher.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch2\u003eOverview\u003c\/h2\u003e\n\u003cp\u003eGeneric privacy e-learning tells staff what the GDPR is. It rarely tells people in a particular role what to do differently. This package builds training around the people who handle personal data, from the board to new starters.\u003c\/p\u003e\n\u003cp\u003eEach course specification sets learning objectives, slides, speaker notes, activities and knowledge checks. The slide decks are editable PowerPoint with speaker notes. Trainer lesson plans, delivery guides and model answers to difficult questions sit beside participant handbooks, microlearning scripts and awareness campaigns. A question bank with an answer key explains each answer. The certificate of completion template records training given by your organisation. It is not an accredited qualification.\u003c\/p\u003e\n\u003cp\u003eRegulation (EU) 2016\/679 (GDPR) articles and recitals are cited throughout, and European Data Protection Board guidelines are cited to paragraph level. National law is marked for your organisation to verify. AGS is independent and is not affiliated with the European Data Protection Board or any supervisory authority. Regulations are referenced by citation.\u003c\/p\u003e\n\u003ch2\u003eWhat this course covers\u003c\/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eTraining governance:\u003c\/strong\u003e a training policy, procedure, plans, calendar, triggers and matrices linking articles, principles, rights, policies and roles to modules.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eSenior management:\u003c\/strong\u003e accountability and privacy governance for leaders.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eKey personnel and roles:\u003c\/strong\u003e a course for privacy key personnel and role-based packs.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAll employees:\u003c\/strong\u003e employee awareness in three parts, plus new starter and annual refresher specifications.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eGenerative AI:\u003c\/strong\u003e generative AI use, covered as an awareness topic.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAssessment and records:\u003c\/strong\u003e the question bank and answer key, records registers, the certificate template, feedback, KPIs and effectiveness evaluation.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch2\u003eWho it's for\u003c\/h2\u003e\n\u003cp\u003eControllers and processors subject to the GDPR. Privacy programme owners, DPOs, compliance and learning teams, HR, internal trainers and managers deliver it, and consultants can use it with clients.\u003c\/p\u003e\n\u003cp\u003eFor the DPO role itself, see the EU GDPR Data Protection Officer (DPO) Management System.\u003c\/p\u003e","brand":"Apex Global Solutions AGS","offers":[{"title":"Default Title","offer_id":57395128828244,"sku":"AGS-19-013","price":850.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1052\/4996\/4372\/files\/AGS-19-013.png?v=1790973779"},{"product_id":"eu-gdpr-website-e-commerce-compliance-toolkit","title":"EU GDPR Website \u0026 E-Commerce Compliance Toolkit","description":"\u003cp\u003e\u003cem\u003eAn editable GDPR toolkit for websites and online stores: the public notices, cookie and consent wording, and internal records a small online business needs.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch2\u003eOverview\u003c\/h2\u003e\n\u003cp\u003eA small online business meets the GDPR mostly through its website: the privacy notice, the cookie banner, the checkout and the marketing sign-up. This toolkit covers those points without the weight of a whole-organisation programme. Public-facing wording is kept apart from internal records, so you can see what is published and what is kept as evidence.\u003c\/p\u003e\n\u003cp\u003eIt runs from website scope, data mapping, a simplified website record of processing and lawful-basis assessments to cookies, digital marketing, e-commerce processing, providers, transfers, rights, retention, security and breach. Cookie compliance is a repeatable method for a small team, including verification that cookie blocking works on the live site.\u003c\/p\u003e\n\u003cp\u003eScope is deliberately narrow. Employee data, large-scale profiling, full DPIAs and binding corporate rules are outside it. The toolkit rests on Regulation (EU) 2016\/679 (GDPR) and the ePrivacy Directive 2002\/58\/EC as amended by Directive 2009\/136\/EC, with European Data Protection Board guidance cited. National ePrivacy law is left to you. AGS is independent and is not affiliated with the European Data Protection Board or any supervisory authority. Regulations are referenced by citation.\u003c\/p\u003e\n\u003ch2\u003eWhat this system covers\u003c\/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eWebsite records:\u003c\/strong\u003e scope, data mapping, a simplified website ROPA and lawful-basis assessments.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eWebsite notices:\u003c\/strong\u003e model notices for websites, including an e-commerce customer privacy notice.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eCookies and consent:\u003c\/strong\u003e a cookie policy, banner and preference-centre wording, consent wording, and a cookie compliance policy and procedure with verification records.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eMarketing and e-commerce:\u003c\/strong\u003e digital marketing, and processing for orders, payments, fraud checks, returns, wish lists and loyalty schemes.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eProviders and transfers:\u003c\/strong\u003e records for service providers and international transfers.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRights:\u003c\/strong\u003e data subject rights with response letters and assessments.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eProtection:\u003c\/strong\u003e retention, security and breach, privacy by design and children's data.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eReadiness:\u003c\/strong\u003e change control, self-assessment and a readiness scorecard.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch2\u003eWho it's for\u003c\/h2\u003e\n\u003cp\u003eSmall businesses, micro-enterprises and start-ups with a website, online retailers including stores on hosted platforms, subscription, booking and enquiry sites, service providers, clinics and hotels. The developers and privacy consultants who support them can use it too.\u003c\/p\u003e\n\u003cp\u003eFor an organisation-wide programme, see the EU GDPR Core Management System. Requests from individuals are covered in depth by the EU GDPR Consent \u0026amp; Data Subject Rights Management System.\u003c\/p\u003e","brand":"Apex Global Solutions AGS","offers":[{"title":"Default Title","offer_id":57395129483604,"sku":"AGS-19-014","price":850.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1052\/4996\/4372\/files\/AGS-19-014.png?v=1790973787"},{"product_id":"dora-ict-risk-digital-resilience-awareness-training-package","title":"DORA ICT Risk \u0026 Digital Resilience Awareness Training Package","description":"\u003cp\u003e\u003cem\u003eAn editable DORA training programme: courses, slide decks, campaigns, assessments and records for ICT risk and digital operational resilience.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch2\u003eOverview\u003c\/h2\u003e\n\u003cp\u003eDORA places ICT risk duties on the management body and on the people who run ICT, incident, continuity and third-party processes. This package gives a financial entity the materials to plan, deliver, record, assess and improve that training under Regulation (EU) 2022\/2554, which applies from January 2025.\u003c\/p\u003e\n\u003cp\u003eEach statement carries a source label that separates DORA legal requirements, technical standards, supervisory guidance and recommended practice. Content draws on Commission Delegated Regulations (EU) 2024\/1774 and (EU) 2024\/1772 and the adopted technical standards on incident reporting, third-party policy, TLPT and subcontracting. National options stay marked for your own verification. ISO\/IEC 27001:2022 is referenced for optional alignment only. AGS is independent and is not affiliated with the European Commission or any competent authority. Regulations are referenced by citation. Standards are referenced by number and title only, and no standard text is included.\u003c\/p\u003e\n\u003ch2\u003eWhat this course covers\u003c\/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eTraining governance:\u003c\/strong\u003e a policy, procedure, annual and specialist plans, and matrices linking DORA articles to roles, modules, assessments and evidence.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eManagement body course:\u003c\/strong\u003e an executive deck, trainer guide, workbook and knowledge checks on Article 5 duties, ICT risk, incidents and testing.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eKey personnel course:\u003c\/strong\u003e decks, a trainer guide, handbook and practical exercise book.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eEmployees and specialists:\u003c\/strong\u003e an employee awareness course, kits for roles such as ICT administrators, incident response, procurement and internal audit, and new-starter and refresher material.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAwareness campaign:\u003c\/strong\u003e microlearning scripts and a twelve-month campaign with editable posters, emails, newsletter articles and toolbox talks.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAssessment and records:\u003c\/strong\u003e a question bank, tabletop exercises, training registers, effectiveness tools and a certificate of completion template. The certificate records training given by your organisation and is not an accredited qualification.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eWorked examples\u003c\/strong\u003e for a fictional EU credit institution.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch2\u003eWho it's for\u003c\/h2\u003e\n\u003cp\u003eFinancial entities within the scope of DORA Article 2, and the group entities and ICT intra-group service providers around them. It is used by DORA programme leads, compliance and risk teams, HR learning and development, trainers and company secretaries.\u003c\/p\u003e\n\u003cp\u003eIt pairs with the DORA ICT Third-Party Risk \u0026amp; Digital Operational Resilience Management System, which covers the DORA framework itself. Organisations under NIS 2 rather than DORA should see the NIS 2 Management Body \u0026amp; Cybersecurity Awareness Training Package.\u003c\/p\u003e","brand":"Apex Global Solutions AGS","offers":[{"title":"Default Title","offer_id":57395130073428,"sku":"AGS-20-005","price":550.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1052\/4996\/4372\/files\/AGS-20-005.png?v=1790973794"},{"product_id":"nis-2-directive-cybersecurity-management-system","title":"NIS 2 Directive Cybersecurity Management System","description":"\u003cp\u003e\u003cem\u003eAn editable documentation system for NIS 2: deciding whether it applies, holding the management body accountable, running cybersecurity risk management and reporting significant incidents on time.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch2\u003eOverview\u003c\/h2\u003e\n\u003cp\u003eNIS 2 makes management bodies answerable for cybersecurity. The first question is often the hardest: does it apply to you, and as an essential or an important entity? This system starts there, with Annex I and II screening and a classification tool.\u003c\/p\u003e\n\u003cp\u003eFrom there it sets up governance and management-body oversight, a cybersecurity risk management process, and policies and procedures for the Article 21 measures. Incident management follows the Article 23 sequence, with report templates from the 24-hour stage to the final report. Excel tools calculate classification, Article 23 deadlines and a weighted readiness score.\u003c\/p\u003e\n\u003cp\u003eThe system is built on Directive (EU) 2022\/2555, with obligations applied through national transposition law. A national overlay register records, for each Member State you operate in, the law, authorities, deadlines, reporting channels and penalties. Commission Implementing Regulation (EU) 2024\/2690 is applied only to the entity types it names. ENISA Technical Implementation Guidance of June 2025 is used as non-binding guidance, and ISO\/IEC 27001:2022, ISO\/IEC 27005:2022 and ISO 22301:2019 appear as cross-references only. AGS is independent and is not affiliated with the European Commission, ENISA or any national authority. Regulations are referenced by citation. Standards are referenced by number and title only, and no standard text is included.\u003c\/p\u003e\n\u003ch2\u003eWhat this system covers\u003c\/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eScope and classification:\u003c\/strong\u003e Annex I and II screening, an essential-versus-important classification tool, jurisdiction and main establishment, DORA and critical-entity interplay, and the national transposition overlay.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eGovernance and accountability:\u003c\/strong\u003e a governance policy, board oversight charter, CISO and compliance officer role profiles, a roles matrix, a management-body training plan and approval records.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRisk management and Article 21 measures:\u003c\/strong\u003e policies, standards and procedures for access, cryptography, assets, networks, logging, backup, supply chain, vulnerability handling, testing, secure acquisition and development, and cyber hygiene.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eIncidents and Article 23 reporting:\u003c\/strong\u003e an incident response plan, a notification workflow and templates for the 24-hour, 72-hour, intermediate, progress and final reports.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eImplementing regulation:\u003c\/strong\u003e an applicability control matrix that decides whether Regulation (EU) 2024\/2690 binds you and maps its Annex to controls and evidence.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eEvidence and review:\u003c\/strong\u003e a clause-by-clause compliance matrix, a policy-to-control matrix, KPIs, a gap assessment with 30-day, 60-day and 90-day plans, internal audit and management review.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch2\u003eWho it's for\u003c\/h2\u003e\n\u003cp\u003eEssential and important entities in Annex I and II sectors, the digital provider types covered by Regulation (EU) 2024\/2690, and ICT suppliers drawn into their customers' NIS 2 due diligence. A NIS 2 compliance officer or CISO leads the work, with senior managers, legal teams, internal audit and consultants using it alongside.\u003c\/p\u003e\n\u003cp\u003eIf you want an ISO\/IEC 27001 ISMS in the same document set, see the NIS 2 \u0026amp; ISO\/IEC 27001:2022 Integrated Management System. Financial entities can pair this system with the DORA ICT Third-Party Risk \u0026amp; Digital Operational Resilience Management System.\u003c\/p\u003e","brand":"Apex Global Solutions AGS","offers":[{"title":"Default Title","offer_id":57395130564948,"sku":"AGS-20-006","price":850.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1052\/4996\/4372\/files\/AGS-20-006.png?v=1790973798"},{"product_id":"nis-2-iso-iec-27001-2022-integrated-management-system","title":"NIS 2 \u0026 ISO\/IEC 27001:2022 Integrated Management System","description":"\u003cp\u003e\u003cem\u003eOne editable document set that runs an ISO\/IEC 27001:2022 information security management system and meets NIS 2 cybersecurity obligations at the same time.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch2\u003eOverview\u003c\/h2\u003e\n\u003cp\u003eMany organisations caught by NIS 2 already run, or plan, an ISO\/IEC 27001 ISMS. This system joins the two: one governance structure, one risk process, one Statement of Applicability, and evidence that serves both the supervisory authority and an ISO\/IEC 27001 audit.\u003c\/p\u003e\n\u003cp\u003eIt opens with NIS 2 applicability and a regulatory profile. Every Annex point of Commission Implementing Regulation (EU) 2024\/2690 is mapped to an owner, documents and evidence, with an applicability check before any of it is treated as binding. A NIS 2-to-ISO\/IEC 27001 Annex A matrix shows where ISMS controls support NIS 2 measures, as an aid and not an equivalence. Organisations that already hold ISO\/IEC 27001 certification can take a fast track: map existing documents and add the NIS 2 legal evidence.\u003c\/p\u003e\n\u003cp\u003eDirective (EU) 2022\/2555 is applied through national transposition law, with a national transposition matrix. ISO\/IEC 27001:2022 clauses and Annex A controls are cited by number and identifier, with ISO\/IEC 27002:2022 for control titles, and the control text is left to your own licensed copy. ENISA Technical Implementation Guidance of June 2025 supplies non-binding evidence examples. AGS is independent and is not affiliated with the European Commission, ENISA or any national authority. Regulations are referenced by citation. Standards are referenced by number and title only, and no standard text is included.\u003c\/p\u003e\n\u003ch2\u003eWhat this system covers\u003c\/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eStart here:\u003c\/strong\u003e a user guide, scope statement and mapping matrices from NIS 2 articles to documents and evidence.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eNIS 2 applicability:\u003c\/strong\u003e an applicability procedure, classification, jurisdiction, registration and a regulatory contact register.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eIntegrated governance:\u003c\/strong\u003e a governance manual, top-level policy, steering committee terms of reference, a management-body training programme and a legal and regulatory compliance procedure.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eISMS context and risk:\u003c\/strong\u003e scope, interested parties, a climate change context assessment, risk methodology, a risk register and a Statement of Applicability covering every Annex A control.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eControls and operations:\u003c\/strong\u003e control policies, suppliers, incident reporting, continuity, vulnerabilities, HR and training.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAudit and findings:\u003c\/strong\u003e NIS 2, Regulation (EU) 2024\/2690 and ISO\/IEC 27001 audit checklists, corrective action, a regulatory finding response plan for supervisory requests and inspections, and an ISO\/IEC 27001 certification roadmap. The certification decision rests with your chosen certification body.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eWorked examples\u003c\/strong\u003e using fictional organisations: a cloud provider, a managed service provider, a medium essential entity, a medium important entity and an organisation outside Regulation (EU) 2024\/2690.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch2\u003eWho it's for\u003c\/h2\u003e\n\u003cp\u003eEssential and important entities under NIS 2, the relevant entities under Regulation (EU) 2024\/2690, and organisations preparing for ISO\/IEC 27001 certification. It suits the information security and compliance leads who run it and the consultants who support them.\u003c\/p\u003e\n\u003cp\u003eIf you need NIS 2 without a full ISMS, the NIS 2 Directive Cybersecurity Management System covers it. If you need an ISMS without NIS 2, see the ISMS ISO\/IEC 27001:2022 toolkit.\u003c\/p\u003e","brand":"Apex Global Solutions AGS","offers":[{"title":"Default Title","offer_id":57395131122004,"sku":"AGS-20-007","price":950.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1052\/4996\/4372\/files\/AGS-20-007.png?v=1790973809"},{"product_id":"nis-2-management-body-cybersecurity-awareness-training-package","title":"NIS 2 Management Body \u0026 Cybersecurity Awareness Training Package","description":"\u003cp\u003e\u003cem\u003eAn editable training programme for NIS 2: a management body course, staff cyber hygiene and awareness training, campaigns, assessments and records.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch2\u003eOverview\u003c\/h2\u003e\n\u003cp\u003eNIS 2 asks two things of training. Article 20 requires members of management bodies to follow training, and Article 21 includes cyber hygiene practices and cybersecurity training among the risk management measures. This package covers both, under the national law that transposes NIS 2.\u003c\/p\u003e\n\u003cp\u003eTraining runs as separate paths for the management body, key personnel, all employees and specific roles, with editable PowerPoint decks and trainer and participant materials. Matrices link the relevant NIS 2 articles and Commission Implementing Regulation (EU) 2024\/2690 to training content. Statements are labelled by source: Directive (EU) 2022\/2555, the implementing regulation (only for the entity types in its scope) or ENISA Technical Implementation Guidance of June 2025, which is non-binding. ISO\/IEC 27001:2022 is a supporting reference only. AGS is independent and is not affiliated with the European Commission, ENISA or any national authority. Regulations are referenced by citation. Standards are referenced by number and title only, and no standard text is included.\u003c\/p\u003e\n\u003ch2\u003eWhat this course covers\u003c\/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eTraining governance:\u003c\/strong\u003e a policy, procedures, plans and a national transposition customisation matrix.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eManagement body course:\u003c\/strong\u003e an executive deck, module specifications, trainer guide, speaker notes, workbook and assessment forms.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eKey personnel and employees:\u003c\/strong\u003e a key personnel course with handbook, and an employee awareness course with a master deck and single-module decks on everyday security topics.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRole-based training:\u003c\/strong\u003e role kits, new-starter and refresher material, and a template for refreshing training when law or guidance changes.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAwareness campaign:\u003c\/strong\u003e microlearning scripts and a twelve-month campaign with posters, cards and emails.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAssessment and records:\u003c\/strong\u003e a question bank, exercises, training records, effectiveness tools and a certificate template. The certificate records training given by your organisation and is not an accredited qualification.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eWorked examples\u003c\/strong\u003e for a fictional water and waste water utility classed as an important entity.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch2\u003eWho it's for\u003c\/h2\u003e\n\u003cp\u003eOrganisations with obligations under national law transposing NIS 2. Training owners, CISOs, compliance and HR teams and company secretaries use it, as do consultants supporting them.\u003c\/p\u003e\n\u003cp\u003eIt pairs with the NIS 2 Directive Cybersecurity Management System for the wider NIS 2 programme. Financial entities under DORA should see the DORA ICT Risk \u0026amp; Digital Resilience Awareness Training Package.\u003c\/p\u003e","brand":"Apex Global Solutions AGS","offers":[{"title":"Default Title","offer_id":57395131384148,"sku":"AGS-20-008","price":550.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1052\/4996\/4372\/files\/AGS-20-008.png?v=1790973815"}],"url":"https:\/\/agskits.com\/collections\/eu-compliance.oembed","provider":"Apex Global Solutions","version":"1.0","type":"link"}