{"product_id":"eu-gdpr-iso-iec-27001-2022-integrated-management-system","title":"EU GDPR \u0026 ISO\/IEC 27001:2022 Integrated Management System","description":"\u003cp\u003e\u003cem\u003eAn editable integrated system that runs GDPR compliance and an ISO\/IEC 27001:2022 information security management system as one set of documents, with two separate evidence trails.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch2\u003eOverview\u003c\/h2\u003e\n\u003cp\u003eAn ISO\/IEC 27001 management system does not on its own show that an organisation meets the GDPR. Running two programmes doubles the work. This system builds one management system that serves both, while keeping the GDPR legal records apart from the ISMS documents so each can be shown on its own.\u003c\/p\u003e\n\u003cp\u003eAn integrated risk method scores security risk and risk to individuals separately and feeds one Statement of Applicability. The Annex A controls are written up in control volumes, each with control record registers. Master traceability matrices trace GDPR articles, ISO clauses and every Annex A control to documents and evidence.\u003c\/p\u003e\n\u003cp\u003eThe privacy-specific parts use ISO\/IEC 27701:2025, and the risk method draws on ISO\/IEC 27005:2022. ISO\/IEC 27001:2022 is referenced with Amendment 1:2024, and ISO\/IEC 27002:2022 is referenced as guidance, so you will need your own copy of it. Standard contractual clauses under Commission Implementing Decision (EU) 2021\/914 are referenced, not reproduced. AGS is independent and is not affiliated with the European Commission or any supervisory authority. Standards are referenced by number and title only, and no standard text is included. Regulations are referenced by citation.\u003c\/p\u003e\n\u003ch2\u003eWhat this system covers\u003c\/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eSystem governance:\u003c\/strong\u003e an integrated ISMS and PIMS manual, an integrated information security and privacy policy, a privacy governance policy, a DPO appointment and independence assessment, steering committee terms, legal compliance, document control and escalation.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eScope and inventories:\u003c\/strong\u003e scope, asset and personal data inventories, controller and processor records of processing, retention, the integrated risk method and the Statement of Applicability.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eGDPR operations:\u003c\/strong\u003e data protection policy, privacy by design, consent, data subject rights, privacy notice templates, rights response templates and a DPIA template.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAnnex A controls:\u003c\/strong\u003e control volumes covering the ISO\/IEC 27001 Annex A control domains, with control record registers.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eSuppliers and transfers:\u003c\/strong\u003e an Article 28 data processing agreement template, a supplier security schedule and a transfer impact assessment.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eIncidents and continuity:\u003c\/strong\u003e one incident procedure with a parallel privacy track, a 72-hour decision path for Article 33 and Article 34, and continuity and disaster recovery.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAssurance:\u003c\/strong\u003e competence, internal audit with an audit interview preparation guide, management review, corrective action, and worked examples for a fictional SaaS processor, professional services firm and e-commerce business.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch2\u003eWho it's for\u003c\/h2\u003e\n\u003cp\u003eSmall and mid-sized organisations in the EU and EEA without a full-time compliance function that want one system for information security and data protection. It also suits organisations adding the GDPR to an existing ISO\/IEC 27001 ISMS, and processors selling to controllers.\u003c\/p\u003e\n\u003cp\u003eIf you need the GDPR alone, the EU GDPR Core Management System covers the whole programme without the ISMS. For one process in depth, see the EU GDPR Personal Data Breach Response Management System or the EU GDPR Data Protection Impact Assessment (DPIA) Management System.\u003c\/p\u003e","brand":"Apex Global Solutions AGS","offers":[{"title":"Default Title","offer_id":57395122307412,"sku":"AGS-19-005","price":950.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1052\/4996\/4372\/files\/AGS-19-005.png?v=1790973726","url":"https:\/\/agskits.com\/products\/eu-gdpr-iso-iec-27001-2022-integrated-management-system","provider":"Apex Global Solutions","version":"1.0","type":"link"}