S3 E30: ISO as a Catalyst, Not a Checkbox

WEBVTT
00:00:00.300 --> 00:00:03.240
Welcome to Compliance Pointers, where we take
00:00:03.240 --> 00:00:06.200
an in -depth look into the latest news, trends,
00:00:06.379 --> 00:00:08.800
and challenges surrounding information security,
00:00:09.220 --> 00:00:12.660
privacy, and marketing compliance. Let's dive
00:00:12.660 --> 00:00:16.219
in with your host, Jordan Eisner. Welcome to
00:00:16.219 --> 00:00:18.960
another episode of Compliance Pointers. I'm Jordan
00:00:18.960 --> 00:00:21.339
Eisner, VP of Growth at Compliance Point, and
00:00:21.339 --> 00:00:24.339
today I'm joined in person. In person. That's
00:00:24.339 --> 00:00:27.179
a big deal. By David Foreman. It is a big deal,
00:00:27.219 --> 00:00:29.339
and we're hoping it's a big deal to them watching
00:00:29.339 --> 00:00:31.960
and listening to this. I'm watching the live
00:00:31.960 --> 00:00:34.700
feed right now. Viewership is just going through
00:00:34.700 --> 00:00:36.579
the roof. That's right. Look at the likes. Oh,
00:00:36.619 --> 00:00:40.380
wow. New record. Keep going. For those of you
00:00:40.380 --> 00:00:41.899
that have watched or listened to podcasts in
00:00:41.899 --> 00:00:44.340
the past, you know who David Foreman is. And
00:00:44.340 --> 00:00:46.609
those of you who haven't. You might know who
00:00:46.609 --> 00:00:48.689
David Foreman is, right? You're making yourself
00:00:48.689 --> 00:00:53.409
known out there. David's CEO of Mastermind Certification
00:00:53.409 --> 00:00:56.990
Body, accredited to assess and certify governance
00:00:56.990 --> 00:00:59.810
programs against standards by the International
00:00:59.810 --> 00:01:05.129
Organization for Standardization, ISO. They're
00:01:05.129 --> 00:01:08.530
the first company in the U .S. to focus exclusively
00:01:08.530 --> 00:01:12.609
on ISO certifications. That is one of the most
00:01:12.609 --> 00:01:15.090
trusted forms of third -party assurance used
00:01:15.090 --> 00:01:17.950
by... technology service providers. You should
00:01:17.950 --> 00:01:20.069
sell ISO certs. You're pretty good at that. In
00:01:20.069 --> 00:01:27.689
a way, I do. That includes 27001, ISO 9001. Well,
00:01:27.829 --> 00:01:30.209
not Mastermind, but your experience. Correct.
00:01:30.650 --> 00:01:36.269
9001. But with Mastermind, 27001, 27701, 42001.
00:01:36.329 --> 00:01:37.950
Of course. Anything I left out? Those are the
00:01:37.950 --> 00:01:39.829
management system standards. So we do extensions
00:01:39.829 --> 00:01:43.890
as well. So 270017, 270018, and then CSA Star
00:01:43.890 --> 00:01:45.780
Level 2 certification as well. That's right.
00:01:45.920 --> 00:01:47.859
And you've been in business for a little over
00:01:47.859 --> 00:01:50.500
a year now. Yeah, we're 15, 16 months now. 15,
00:01:50.640 --> 00:01:53.280
16 months. And David, you just got back from,
00:01:53.340 --> 00:01:56.260
what, two, three weeks? You were in Japan. You
00:01:56.260 --> 00:01:59.040
were in London for a little while. You were in
00:01:59.040 --> 00:02:01.049
Morocco. Yeah, how much more do you follow me?
00:02:01.129 --> 00:02:02.469
There's one more country. Constantly, I've got
00:02:02.469 --> 00:02:05.189
you bummed. Yeah, Germany as well. Germany. Appreciate
00:02:05.189 --> 00:02:08.349
it. I do enjoy travel, but I also enjoy being
00:02:08.349 --> 00:02:10.110
at home, and I'm happy I'm back home in Atlanta
00:02:10.110 --> 00:02:13.210
right now. Says many people after that long of
00:02:13.210 --> 00:02:15.889
travel. It is grueling, especially the time zone
00:02:15.889 --> 00:02:17.229
differences. I think that's the hardest part.
00:02:17.229 --> 00:02:20.180
Well, that's because... Being a founder of an
00:02:20.180 --> 00:02:23.379
emerging provider, although you could argue that
00:02:23.379 --> 00:02:25.560
you're the leading 42 ,001. I would say we're
00:02:25.560 --> 00:02:28.379
enterprise at this point. Enterprise. Yeah. But
00:02:28.379 --> 00:02:30.280
the life you lived, I was just talking to you
00:02:30.280 --> 00:02:32.819
about it, so you were still working. 5 a .m.,
00:02:32.819 --> 00:02:34.680
10 a .m., wherever you were, local time, you
00:02:34.680 --> 00:02:36.620
were working. Afternoons, you were sightseeing
00:02:36.620 --> 00:02:38.939
and eating the good food, and you said you don't
00:02:38.939 --> 00:02:42.210
sleep. Yeah, I struggle with lack of sleep, to
00:02:42.210 --> 00:02:44.750
be honest. But more importantly, I think the
00:02:44.750 --> 00:02:46.750
Asia part of the travel, that was more difficult
00:02:46.750 --> 00:02:49.009
because just like more opposite time zones from
00:02:49.009 --> 00:02:51.229
the U .S. market. But yeah, there's a lot of
00:02:51.229 --> 00:02:54.330
5 to like 10 a .m. type co -working spaces in
00:02:54.330 --> 00:02:57.270
Tokyo or Osaka. But still, we had a really good
00:02:57.270 --> 00:02:59.590
time over there and ate amazing food. If you're
00:02:59.590 --> 00:03:03.520
a fan of sushi, I'm a fan of you. So this is,
00:03:03.560 --> 00:03:05.879
we've done podcasts in this room before. This
00:03:05.879 --> 00:03:08.699
is the Compliance Point offices, but this is
00:03:08.699 --> 00:03:10.659
the first one we're doing on camera inside this
00:03:10.659 --> 00:03:12.680
room. So hopefully this goes very well. I requested
00:03:12.680 --> 00:03:14.360
it, to be honest, and I think we should request
00:03:14.360 --> 00:03:16.000
Jordan to do this more often. This is nicer than
00:03:16.000 --> 00:03:17.500
his home office. That's right. That's right.
00:03:17.599 --> 00:03:21.360
So reason to keep doing it. And we've invited
00:03:21.360 --> 00:03:23.979
David in for two podcasts today. The one we're
00:03:23.979 --> 00:03:26.539
going to be speaking about. is what we've titled
00:03:26.539 --> 00:03:30.780
ISO as a Catalyst, not a Checkbox. And so that's
00:03:30.780 --> 00:03:32.520
what we're going to get into in this first episode.
00:03:32.879 --> 00:03:37.740
So it's really about ISO being viewed as a launching
00:03:37.740 --> 00:03:41.439
point for improving security, ops, trust, and
00:03:41.439 --> 00:03:43.900
not just a compliance checkbox. So many times
00:03:43.900 --> 00:03:46.699
when, at least in my experience, somebody's...
00:03:47.519 --> 00:03:50.099
pursuing ISO, it's because they have to. Somebody's
00:03:50.099 --> 00:03:52.060
requiring them to do so, and that's probably
00:03:52.060 --> 00:03:54.360
going to continue to be the case for a long time.
00:03:54.580 --> 00:03:56.360
It's typically someone at sales like you. Right.
00:03:56.479 --> 00:03:57.919
They're pushing the company forward. Sales are
00:03:57.919 --> 00:03:59.759
saying, hey, we need this cert to get this business,
00:03:59.879 --> 00:04:02.259
right? Pay -to -play type thing. But the more
00:04:02.259 --> 00:04:04.300
I've learned about ISO, and I know you're very
00:04:04.300 --> 00:04:07.419
passionate about it, obviously, with your business.
00:04:08.000 --> 00:04:11.530
Understatement. It really is an incredible framework,
00:04:11.610 --> 00:04:14.110
and you're going to speak to that. For security,
00:04:14.229 --> 00:04:15.990
it allows you to bring your own controls, and
00:04:15.990 --> 00:04:19.329
there's some really management as part of the
00:04:19.329 --> 00:04:21.410
process. So that's what we're going to get into.
00:04:21.529 --> 00:04:26.029
So let's start there. Why, you know, when we
00:04:26.029 --> 00:04:29.870
say ISO can be viewed as a catalyst versus just
00:04:29.870 --> 00:04:33.259
a checkbox? For a security program or for a privacy
00:04:33.259 --> 00:04:36.040
program or for an AI governance program. Yeah,
00:04:36.079 --> 00:04:38.100
I think let's break down that title a little
00:04:38.100 --> 00:04:39.480
bit more too. Like you think about catalyst.
00:04:40.279 --> 00:04:42.560
Like really what I was kind of seeking out here
00:04:42.560 --> 00:04:44.899
with this episode too is talking about you don't
00:04:44.899 --> 00:04:46.939
have to certify necessarily to an ISO standard
00:04:46.939 --> 00:04:49.480
in order for you to benefit from an ISO standard.
00:04:50.259 --> 00:04:52.060
If you're unfamiliar with ISO standards, there's
00:04:52.060 --> 00:04:54.100
way more than just ISO 27001 that we're talking
00:04:54.100 --> 00:04:57.000
about. There's over 25 ,000 now. And they cover
00:04:57.000 --> 00:04:59.579
every part of our life, including this coffee
00:04:59.579 --> 00:05:02.990
that was not. meant to be kind of a prop in this
00:05:02.990 --> 00:05:05.670
episode but here it is but like when we think
00:05:05.670 --> 00:05:08.009
about like you know how to roast coffee you think
00:05:08.009 --> 00:05:10.189
about a cacao bean and like when it's considered
00:05:10.189 --> 00:05:13.769
ripe for harvesting all that is based on some
00:05:13.769 --> 00:05:16.029
sort of calibration or standardization somewhere,
00:05:16.269 --> 00:05:19.310
and that's found in an ISO standard. And why
00:05:19.310 --> 00:05:21.930
I think it has such great adoption and enforcement
00:05:21.930 --> 00:05:24.649
in some cases across the world, too, is ISO has
00:05:24.649 --> 00:05:26.529
always been set up as kind of this neutral body
00:05:26.529 --> 00:05:29.350
for standards, and it creates this kind of alignment
00:05:29.350 --> 00:05:32.209
worldwide regardless of geography, nationality,
00:05:32.230 --> 00:05:33.829
country pride, anything like that. It's just
00:05:33.829 --> 00:05:36.449
like viewed as kind of a trade mechanism. Well,
00:05:36.470 --> 00:05:38.230
it's out of Switzerland. It is out of Switzerland.
00:05:38.230 --> 00:05:39.889
It's the most neutral country in the world, right?
00:05:40.050 --> 00:05:42.170
It originated in the U .K., though, so we've
00:05:42.170 --> 00:05:44.920
got to be careful. Careful there. But going back
00:05:44.920 --> 00:05:46.839
to kind of your original question, too. When
00:05:46.839 --> 00:05:51.639
you build a program based on 27001, for example,
00:05:51.800 --> 00:05:53.620
it's called an information security management
00:05:53.620 --> 00:05:56.259
system. When you build 9001, you mentioned that
00:05:56.259 --> 00:05:59.439
earlier, quality management system. 42001 is
00:05:59.439 --> 00:06:01.100
an artificial intelligence management system.
00:06:01.339 --> 00:06:03.720
We have to get down to what is a management system.
00:06:04.100 --> 00:06:06.399
And that's a fancy term for a governance program.
00:06:06.639 --> 00:06:10.040
It's basically some way we manage, I'll say,
00:06:10.160 --> 00:06:12.870
the risk. We manage the uncertainty. We manage
00:06:12.870 --> 00:06:15.470
the evolution, the emerging parts of our business,
00:06:15.629 --> 00:06:18.689
et cetera. All of that plays into how you would
00:06:18.689 --> 00:06:20.509
build such a management system based on this
00:06:20.509 --> 00:06:23.389
kind of risk taxonomy that might be information
00:06:23.389 --> 00:06:26.089
security, might be AI, might be quality. It could
00:06:26.089 --> 00:06:28.110
be a bunch of other different taxonomies as well.
00:06:28.889 --> 00:06:31.089
So getting back to kind of the root of your question
00:06:31.089 --> 00:06:32.750
here, and I've explained the title of the episode,
00:06:32.949 --> 00:06:36.310
when I think about kind of like how it can be
00:06:36.310 --> 00:06:40.699
a catalyst for business, I use... kind of my
00:06:40.699 --> 00:06:43.339
i'll say response here on how i built mastermind
00:06:43.339 --> 00:06:46.620
too like we built it thinking about like how
00:06:46.620 --> 00:06:49.519
can it be set up for basically a stable foundation
00:06:49.519 --> 00:06:52.819
that's the start but then continuously improving
00:06:52.819 --> 00:06:55.480
as well as it grows and it has more interested
00:06:55.480 --> 00:06:58.220
parties or even just more business revenue and
00:06:58.220 --> 00:07:01.339
business volume and um i have a couple examples
00:07:01.339 --> 00:07:03.019
that are in my head maybe we'll talk about a
00:07:03.019 --> 00:07:05.199
little bit later too of some of our end customers
00:07:05.199 --> 00:07:07.920
that have actually built management systems kind
00:07:07.920 --> 00:07:09.860
of in a similar business focus versus thinking
00:07:09.860 --> 00:07:12.699
about just like how do i secure our cyber security
00:07:12.699 --> 00:07:16.420
um and all in all i basically what i want to
00:07:16.420 --> 00:07:19.980
like i'll say evangelize the most here, is these
00:07:19.980 --> 00:07:23.420
standards are meant to fit every type of organization
00:07:23.420 --> 00:07:27.560
from mastermind on day one as a startup to whether
00:07:27.560 --> 00:07:29.379
you're an enterprise and you're in Amazon Web
00:07:29.379 --> 00:07:31.259
Services and Google Cloud that is implementing
00:07:31.259 --> 00:07:34.759
ISA 27001. Basically, the standard is really
00:07:34.759 --> 00:07:36.779
one size fits all. It's just how do you interpret
00:07:36.779 --> 00:07:38.459
the requirements based on your risk landscape.
00:07:39.120 --> 00:07:40.620
That's what I like about the flexibility of it.
00:07:40.620 --> 00:07:42.800
Threats to your organization and what's the risk
00:07:42.800 --> 00:07:46.220
treatment around it. Does that qualify? Totally.
00:07:46.480 --> 00:07:49.360
And I'll say, if I was to give a contrast real
00:07:49.360 --> 00:07:52.360
quick to other popular schemes out there that
00:07:52.360 --> 00:07:54.399
we all work with and encounter on a daily basis,
00:07:54.439 --> 00:07:57.240
especially in the U .S. market, PCI DSS, high
00:07:57.240 --> 00:08:00.259
trust with its CSF, the FedRAMP, CMMC, a lot
00:08:00.259 --> 00:08:02.660
of buzz around those items lately and during
00:08:02.660 --> 00:08:04.720
the current administration as well. All those
00:08:04.720 --> 00:08:07.759
are basically frameworks that have controls addressing
00:08:07.759 --> 00:08:10.870
risk. When you look at a management system standard
00:08:10.870 --> 00:08:13.269
like these ISO standards, they are governance
00:08:13.269 --> 00:08:16.389
first based on your scope, a risk assessment
00:08:16.389 --> 00:08:18.610
based on your threats and vulnerabilities unique
00:08:18.610 --> 00:08:20.790
to your business, your business sector, your
00:08:20.790 --> 00:08:23.649
current customers, your current objectives as
00:08:23.649 --> 00:08:26.569
well, and then you implement those controls.
00:08:27.399 --> 00:08:29.699
Because of those kind of first two steps I just
00:08:29.699 --> 00:08:31.540
articulated as part of the governance program,
00:08:31.920 --> 00:08:34.700
your controls will look very different from organization
00:08:34.700 --> 00:08:37.419
to organization. Even if you're 50 people and
00:08:37.419 --> 00:08:40.179
you look at the next 50 -person company, no two
00:08:40.179 --> 00:08:42.799
are the same. So from a career perspective, I
00:08:42.799 --> 00:08:44.879
really like ISO standards because everyone in
00:08:44.879 --> 00:08:47.100
my clients looks a little bit different. From
00:08:47.100 --> 00:08:50.360
a, I'll say, implementation perspective, if you're
00:08:50.360 --> 00:08:52.360
a company implementing an ISO standard, it's
00:08:52.360 --> 00:08:55.120
going to be very much tailor -made. Yeah. Yeah.
00:08:55.340 --> 00:08:57.820
What about? Now you just got the wheels turning
00:08:57.820 --> 00:09:00.940
a little bit. All those ones you mentioned, totally
00:09:00.940 --> 00:09:04.500
agree. Prescriptive controls, already built in,
00:09:04.580 --> 00:09:05.840
recommended for how you implement them. What
00:09:05.840 --> 00:09:08.500
about SOC 2? Yeah. Would that maybe be the most
00:09:08.500 --> 00:09:10.779
similar here? I know this is about ISO, but in
00:09:10.779 --> 00:09:12.700
terms of... Like more risk -based, though, to
00:09:12.700 --> 00:09:15.080
your point? And how you're applying it. Now there's
00:09:15.080 --> 00:09:21.190
controls. That you're going to borrow from. And
00:09:21.190 --> 00:09:23.009
ISO has that a little bit too, right, with some
00:09:23.009 --> 00:09:25.909
recommended controls. Yeah, so I would say we
00:09:25.909 --> 00:09:27.830
can create some parallels there. So in SOC 2,
00:09:27.990 --> 00:09:29.889
there are the trust services criteria. So security,
00:09:30.090 --> 00:09:32.070
availability, confidentiality, processing integrity,
00:09:32.250 --> 00:09:34.710
and privacy criteria. So you can kind of build
00:09:34.710 --> 00:09:38.169
these into what is your SOC 2 examination. The
00:09:38.169 --> 00:09:41.690
security, TSC, trust services criteria is always
00:09:41.690 --> 00:09:43.370
required in order for you to go through a SOC
00:09:43.370 --> 00:09:46.460
2 Type 1 or SOC 2 Type 2. Right. With that being
00:09:46.460 --> 00:09:48.580
said... The common criteria, as they call it.
00:09:48.679 --> 00:09:53.620
Yes. SOC 2, you look at that criteria, and then
00:09:53.620 --> 00:09:55.100
based on your organization, you'll build controls
00:09:55.100 --> 00:09:57.899
around that criteria. It's similar to thinking
00:09:57.899 --> 00:10:00.000
in terms of risk -based approach, whereas with
00:10:00.000 --> 00:10:02.460
ISO, you have control descriptions, or depending
00:10:02.460 --> 00:10:04.019
on the standard, it could be a control objective,
00:10:04.299 --> 00:10:07.000
and you build, basically, or implement those
00:10:07.000 --> 00:10:08.940
controls to meet those objectives or descriptions.
00:10:09.700 --> 00:10:12.929
Now, I'll say the difference here. While SOC
00:10:12.929 --> 00:10:15.090
2 has criteria and you build controls, that criteria
00:10:15.090 --> 00:10:17.490
is typically a little bit more rigid, a little
00:10:17.490 --> 00:10:18.809
bit more prescriptive than what you're going
00:10:18.809 --> 00:10:22.570
to find in ISO. So if I use ISO 27001 as an example
00:10:22.570 --> 00:10:26.649
and one of its 93 Annex A controls. Both ISO
00:10:26.649 --> 00:10:30.129
27001 and SOC 2 have a control around secure
00:10:30.129 --> 00:10:32.909
authentication or passwords, okay? If you go
00:10:32.909 --> 00:10:35.590
look at SOC 2 and its criteria, it's going to
00:10:35.590 --> 00:10:39.149
prescribe certain strength of passwords. That
00:10:39.149 --> 00:10:40.850
might be character link limits. That might be
00:10:40.850 --> 00:10:43.929
rotation requirements. Can't use any of the passwords
00:10:43.929 --> 00:10:46.730
you used in the last three tries of that user
00:10:46.730 --> 00:10:49.509
credential or that kind of thing. Whereas with
00:10:49.509 --> 00:10:53.200
ISO, it just says strong quality password. You
00:10:53.200 --> 00:10:55.500
decide what is strong, what is quality. And it's
00:10:55.500 --> 00:10:57.940
meant to be more, I'll say, purpose -built based
00:10:57.940 --> 00:11:00.379
on what is the system or environment it's trying
00:11:00.379 --> 00:11:05.379
to protect. So maybe a password for a R &D -type
00:11:05.379 --> 00:11:07.740
environment that has no production data, no customer
00:11:07.740 --> 00:11:10.600
information, no PII of any sort in there, maybe
00:11:10.600 --> 00:11:13.120
that has less strength of a password credential
00:11:13.120 --> 00:11:16.039
required on it than one that is covering customer
00:11:16.039 --> 00:11:19.340
prod. And that's how you're designed to think
00:11:19.340 --> 00:11:22.179
about these controls, unique based on environment.
00:11:22.320 --> 00:11:24.840
based on risk when you are applying ISO. And
00:11:24.840 --> 00:11:28.320
I think that speaks back to the title too, and
00:11:28.320 --> 00:11:30.679
I know you talked about the term catalyst, not
00:11:30.679 --> 00:11:35.059
checkbox, but ISO is an opportunity if it is
00:11:35.059 --> 00:11:37.620
something that you need to go through for certification
00:11:37.620 --> 00:11:40.799
for some third party or a client to demonstrate
00:11:40.799 --> 00:11:43.460
good data stewardship, you still have the opportunity
00:11:43.460 --> 00:11:46.240
to design those controls based on your business,
00:11:46.419 --> 00:11:51.049
how impactful you want it to be. and how you
00:11:51.049 --> 00:11:52.690
want to manage it moving forward and how it wants
00:11:52.690 --> 00:11:55.330
to grow. You don't have to operate on the exact
00:11:55.330 --> 00:11:57.090
same playbook as every single other company,
00:11:57.190 --> 00:12:01.149
and that could be advantageous. What I like to
00:12:01.149 --> 00:12:04.250
always tell people when they are trying to basically
00:12:04.250 --> 00:12:06.009
uncover the bare minimum, I'm not saying you're
00:12:06.009 --> 00:12:07.809
trying to do that, but sometimes it leads to
00:12:07.809 --> 00:12:10.850
that type of conversation. Technically speaking,
00:12:11.190 --> 00:12:13.830
you could have a four -character password, protect
00:12:13.830 --> 00:12:16.730
a system, and depending on your perspective,
00:12:16.970 --> 00:12:20.600
POV on ISO 27001. That could be conforming. That
00:12:20.600 --> 00:12:24.519
could meet that control. So yes there. Now, taking
00:12:24.519 --> 00:12:27.820
a step back, what is minimum benchmark practice?
00:12:28.440 --> 00:12:30.500
Now you're talking about best practice at all.
00:12:30.639 --> 00:12:32.519
Yeah, you need better than a four -character
00:12:32.519 --> 00:12:34.740
password. It's essentially a pin. And there's
00:12:34.740 --> 00:12:37.440
only so many permutations of the four numbers
00:12:37.440 --> 00:12:39.860
or four letters that could exist, and you could
00:12:39.860 --> 00:12:43.139
easily crack that password. With that being said,
00:12:44.250 --> 00:12:46.850
I will say there is definitely kind of two sides
00:12:46.850 --> 00:12:49.269
to the market here. You have the market where
00:12:49.269 --> 00:12:51.950
it's like I have my salesperson. Every time I
00:12:51.950 --> 00:12:54.970
think about sales, I just point to you. VP growth,
00:12:55.230 --> 00:13:00.289
not sales. Different. But every time I think
00:13:00.289 --> 00:13:02.309
about like a customer going the first time through
00:13:02.309 --> 00:13:05.509
ISO 27001 since we're on that topic, typically
00:13:05.509 --> 00:13:10.190
it's coming from kind of a buy side. thought
00:13:10.190 --> 00:13:11.950
process where it's like, hey, we want to make
00:13:11.950 --> 00:13:15.350
it easier to purchase from us. Our sales team
00:13:15.350 --> 00:13:17.470
might be saying like, hey, we have a prospect
00:13:17.470 --> 00:13:20.169
ready to sign on the dotted line. It's worth
00:13:20.169 --> 00:13:22.649
six figures in annual value to us in terms of
00:13:22.649 --> 00:13:25.549
revenue. We just have to have this one thing.
00:13:25.750 --> 00:13:28.289
How do we go get this one thing? And because
00:13:28.289 --> 00:13:31.649
of that urgency and that $100 ,000 project sitting
00:13:31.649 --> 00:13:34.090
out there in the ether, they say, what do I have
00:13:34.090 --> 00:13:36.669
to do bare minimum to get that thing so we can
00:13:36.669 --> 00:13:41.360
move forward? Approach it more proactively where
00:13:41.360 --> 00:13:43.240
you're not in that type of time -bound urgency
00:13:43.240 --> 00:13:46.620
situation. You can do way more things with the
00:13:46.620 --> 00:13:50.200
standard. And from my perspective as an auditor,
00:13:50.399 --> 00:13:53.620
certification body, we want to see customers
00:13:53.620 --> 00:13:56.120
really adopt the standard. That doesn't mean
00:13:56.120 --> 00:13:58.360
go get certified. That means actually implement
00:13:58.360 --> 00:14:00.940
it how it was meant to be implemented. That means
00:14:00.940 --> 00:14:03.610
not just a super narrow scope. That means applying
00:14:03.610 --> 00:14:05.549
it to the organization and applying it to the
00:14:05.549 --> 00:14:07.169
organization based on its current practices.
00:14:07.629 --> 00:14:09.450
So one of the examples I like to use is... Well,
00:14:09.450 --> 00:14:11.389
I was about to say, before we go into that, because
00:14:11.389 --> 00:14:13.049
that's a good segue to the next question, and
00:14:13.049 --> 00:14:15.399
I think you were almost about to answer. before
00:14:15.399 --> 00:14:18.340
I even asked it. What are some examples, right,
00:14:18.480 --> 00:14:21.460
of organizations where you've seen their security,
00:14:21.460 --> 00:14:24.779
their privacy posture improve because of implementation
00:14:24.779 --> 00:14:27.720
of my standards? I would say conceptually, but
00:14:27.720 --> 00:14:29.360
then also I think you were about to talk about
00:14:29.360 --> 00:14:31.480
real -world examples. Yeah, and I can touch on
00:14:31.480 --> 00:14:33.000
a few of these. They're public information, and
00:14:33.000 --> 00:14:36.580
some of them are actually even open source. One
00:14:36.580 --> 00:14:38.720
of the examples I like, I actually talked about
00:14:38.720 --> 00:14:40.779
them on LinkedIn earlier this week, and depending
00:14:40.779 --> 00:14:42.259
on when this gets released, maybe earlier this
00:14:42.259 --> 00:14:46.500
month. But a company called Dadooply. Dadooply
00:14:46.500 --> 00:14:48.940
is a CRM tool, if you want to think of it that
00:14:48.940 --> 00:14:52.379
way. And as it sounds like they de -duplify or
00:14:52.379 --> 00:14:55.259
de -duplicate, whatever the right word is, any
00:14:55.259 --> 00:14:57.539
sort of like Salesforce or HubSpot type entry
00:14:57.539 --> 00:15:00.379
at an account level or contact level, opportunity
00:15:00.379 --> 00:15:02.820
level, when you might be merging databases. You
00:15:02.820 --> 00:15:05.120
have Salesforce familiarity. Oh, of course. Yeah.
00:15:05.919 --> 00:15:08.200
You can't be in this industry and not know sales
00:15:08.200 --> 00:15:11.559
and Salesforce or any sort of CRM. But it helps
00:15:11.559 --> 00:15:13.100
you basically keep integrity of your data, keep
00:15:13.100 --> 00:15:17.389
it clean, good hygiene. sales team i know you
00:15:17.389 --> 00:15:18.509
don't have a sales team you have a growth team
00:15:18.509 --> 00:15:21.750
but um for your growth team if they are you know
00:15:21.750 --> 00:15:24.970
um having async access into a crm and they need
00:15:24.970 --> 00:15:27.210
to deduplicate like whatever parts of an account
00:15:27.210 --> 00:15:29.509
or an account merges with another account that
00:15:29.509 --> 00:15:30.909
kind of thing it allows for you to do that more
00:15:30.909 --> 00:15:33.029
efficiently uh efficiently with like fuzzy matches
00:15:33.029 --> 00:15:35.570
and then you can see it all in one pane very
00:15:35.570 --> 00:15:37.909
cool company but they're less than 15 people
00:15:37.909 --> 00:15:41.769
or fewer than 15 people um they uh adopted iso
00:15:41.769 --> 00:15:45.889
27001 and actually 27017 and 27018 as well, so
00:15:45.889 --> 00:15:47.690
cloud security and cloud privacy extensions.
00:15:48.389 --> 00:15:51.789
As of last year, 2024, they were an early customer
00:15:51.789 --> 00:15:55.570
mastermind as well. And they basically used ISO
00:15:55.570 --> 00:15:58.389
27001 specifically around like their management
00:15:58.389 --> 00:16:01.070
review process that's prescribed in 27001 clause
00:16:01.070 --> 00:16:04.740
9 .3 to basically build out like what is top
00:16:04.740 --> 00:16:06.399
management going to review when we periodically
00:16:06.399 --> 00:16:08.600
meet? So almost like a version of a steering
00:16:08.600 --> 00:16:11.200
committee. Really? Okay. And I think it's really
00:16:11.200 --> 00:16:13.580
interesting when companies do that very early
00:16:13.580 --> 00:16:16.879
because they didn't have... a meeting mechanism
00:16:16.879 --> 00:16:19.600
like this previously. They started looking at
00:16:19.600 --> 00:16:22.840
27 ,001. They were seeing it come out as nice
00:16:22.840 --> 00:16:24.200
-to -haves. Why did they start looking at it
00:16:24.200 --> 00:16:25.440
in the first place? Initially, it was sales -driven.
00:16:25.500 --> 00:16:27.639
It was nice -to -haves. There was nothing that
00:16:27.639 --> 00:16:29.759
was saying, hey, sign on the dotted line once
00:16:29.759 --> 00:16:32.679
you have this. But it was a little bit more proactive
00:16:32.679 --> 00:16:34.120
because they were hearing noise about it in the
00:16:34.120 --> 00:16:37.320
space through some of their deals. They went
00:16:37.320 --> 00:16:39.039
ahead and started implementing it and said, all
00:16:39.039 --> 00:16:40.940
right, we do a lot of these control stuff already.
00:16:41.159 --> 00:16:44.629
We built a secure platform. But from a governance
00:16:44.629 --> 00:16:46.889
standpoint, they had not done much of it yet.
00:16:46.990 --> 00:16:48.850
To be frank, they were probably a little bit
00:16:48.850 --> 00:16:50.970
early of doing any of that governance stuff because
00:16:50.970 --> 00:16:53.009
of the size of the company at that point. But
00:16:53.009 --> 00:16:55.029
they used it as an opportunity, especially in
00:16:55.029 --> 00:16:57.570
that management review, to start having periodic
00:16:57.570 --> 00:17:00.070
steering committee meetings where top management,
00:17:00.149 --> 00:17:02.350
like the CTO and CEO, like original founders,
00:17:02.610 --> 00:17:04.609
were meeting with the rest of the org. And they
00:17:04.609 --> 00:17:07.450
had a specific agenda that was based on the management
00:17:07.450 --> 00:17:10.450
review inputs found in 27001. It served kind
00:17:10.450 --> 00:17:13.130
of as... guideline for how they were going to
00:17:13.130 --> 00:17:14.730
run those steering committees on a go -forward
00:17:14.730 --> 00:17:18.109
basis. So now year two comes around. This was
00:17:18.109 --> 00:17:22.140
earlier this summer here in 2025. Come back in,
00:17:22.240 --> 00:17:24.480
doing the surveillance audit now for Ddubly,
00:17:24.640 --> 00:17:26.779
and I'm seeing kind of the evolution of how the
00:17:26.779 --> 00:17:29.140
steering committee has worked now over a full
00:17:29.140 --> 00:17:32.519
12 -month term at this point. And every quarter,
00:17:32.680 --> 00:17:35.759
like, these topics have now expanded from what
00:17:35.759 --> 00:17:38.420
was the original, say, five or seven inputs required
00:17:38.420 --> 00:17:41.339
by the standard have now all blown up into each
00:17:41.339 --> 00:17:45.200
individual, like, section of the slide deck where
00:17:45.200 --> 00:17:47.619
everyone's reporting out KPIs based on, like,
00:17:47.640 --> 00:17:50.970
how the business is doing. And so not every company
00:17:50.970 --> 00:17:53.569
is going to get the opportunity to like literally
00:17:53.569 --> 00:17:55.710
charter their steering committee of top management
00:17:55.710 --> 00:17:59.630
using 27001 at the time 27001 is needed. But
00:17:59.630 --> 00:18:03.390
it shows how 27001 can like morph into these
00:18:03.390 --> 00:18:05.529
regular business functions, whether it be just
00:18:05.529 --> 00:18:09.009
a KPI review, it be a meeting of the minds at
00:18:09.009 --> 00:18:11.940
top management, like executive level. Or it's
00:18:11.940 --> 00:18:14.079
possibly used as an intake mechanism where they
00:18:14.079 --> 00:18:15.539
say, hey, we have this business opportunity.
00:18:16.039 --> 00:18:18.420
Maybe we expand product catalog or service catalog.
00:18:18.559 --> 00:18:19.720
That's what I was going to ask. Like, how does
00:18:19.720 --> 00:18:23.519
security play into that? Because ISO 27001, you
00:18:23.519 --> 00:18:25.460
talked about earlier, so that certification of
00:18:25.460 --> 00:18:28.259
an information security management system, ISMS.
00:18:30.660 --> 00:18:32.559
To me, what I just heard there is they're really
00:18:32.559 --> 00:18:35.420
focusing on the mechanism of the management system
00:18:35.420 --> 00:18:37.380
and how it allows them to manage for information
00:18:37.380 --> 00:18:41.250
security. So maybe you can't speak to this. you
00:18:41.250 --> 00:18:44.019
know, it's confidential, but so. What I just
00:18:44.019 --> 00:18:45.799
gathered from that is they use it for that, but
00:18:45.799 --> 00:18:47.759
then they started to use that mechanism for other
00:18:47.759 --> 00:18:49.579
KPIs and things. See, they like the structure
00:18:49.579 --> 00:18:51.759
and the model and the consistency. I mean, not
00:18:51.759 --> 00:18:53.819
to make fun of you, they use it for growth. They
00:18:53.819 --> 00:18:57.539
do. I mean, it's for business enablement. It's
00:18:57.539 --> 00:18:59.779
understanding, like, hey, we have an opportunity
00:18:59.779 --> 00:19:03.019
to, you know, service a new CRM platform. It's
00:19:03.019 --> 00:19:05.039
not Salesforce or HubSpot, for example. And,
00:19:05.059 --> 00:19:06.579
like, you know, does that make sense for us as
00:19:06.579 --> 00:19:08.900
well? So they're viewing it not just in a security
00:19:08.900 --> 00:19:11.819
lens. It's blown into, like, just... Total business
00:19:11.819 --> 00:19:13.980
growth and, you know, how we think about the
00:19:13.980 --> 00:19:15.440
vision for the company as well. That's great.
00:19:15.579 --> 00:19:17.160
Yeah. That's great. That's a good one. I'll give
00:19:17.160 --> 00:19:19.500
a second example too here briefly. I wouldn't
00:19:19.500 --> 00:19:23.299
doubt it. Thanks. Another public client, a mastermind
00:19:23.299 --> 00:19:25.319
as well, and they're a really cool company, is
00:19:25.319 --> 00:19:29.140
called Sourcegraph. Sourcegraph is very unique
00:19:29.140 --> 00:19:32.079
in the fact that they open source. all of their
00:19:32.079 --> 00:19:34.579
security documentation. So it's all hosted on
00:19:34.579 --> 00:19:38.220
a Notion page, Notion dashboard. And you can,
00:19:38.319 --> 00:19:39.960
I don't have the hyperlink off the top of my
00:19:39.960 --> 00:19:41.220
mind right now, I'll put it in the comments of
00:19:41.220 --> 00:19:44.900
this, but you can go review all of Sourcegraph's
00:19:44.900 --> 00:19:48.609
policies. They are all online for anybody with
00:19:48.609 --> 00:19:51.549
the hyperlink to go access. And it's a different
00:19:51.549 --> 00:19:53.410
kind of level of transparency, if you want to
00:19:53.410 --> 00:19:55.509
think of it that way. So, you know, we have trust
00:19:55.509 --> 00:19:57.109
centers out there. You can go review our security
00:19:57.109 --> 00:19:58.730
documentation and compliance. You're a big fan,
00:19:58.769 --> 00:20:00.329
according to your LinkedIn. Love the trust centers.
00:20:00.430 --> 00:20:02.289
Yeah, I mean, why are we hiding it? Remember,
00:20:02.410 --> 00:20:04.029
I have your bugs. Thank you. I know what you
00:20:04.029 --> 00:20:06.859
said yesterday. Very true. But, you know, if
00:20:06.859 --> 00:20:09.059
you want to dig a little bit deeper than a traditional
00:20:09.059 --> 00:20:11.299
trust center, like let's actually go read that
00:20:11.299 --> 00:20:13.740
incident response policy. Let's see like what
00:20:13.740 --> 00:20:16.140
mechanisms they put in place and how they respond.
00:20:16.400 --> 00:20:18.319
Should there be a breach of their end customer
00:20:18.319 --> 00:20:20.400
data if I'm going to be a customer of them as
00:20:20.400 --> 00:20:24.019
well? I think that's. I'll say extreme, but I
00:20:24.019 --> 00:20:25.599
don't mean that in a negative commentation. I
00:20:25.599 --> 00:20:27.720
think it's more of like you just don't see it
00:20:27.720 --> 00:20:31.019
yet in our industry. And I say yet because, you
00:20:31.019 --> 00:20:32.839
know, we're talking about trust centers. I think
00:20:32.839 --> 00:20:35.339
there's a growing economy of trust centers as
00:20:35.339 --> 00:20:38.160
a service. Like there's one side of the house
00:20:38.160 --> 00:20:39.740
that will say trust centers are just going to
00:20:39.740 --> 00:20:42.400
become like this, you know, no fee feature on
00:20:42.400 --> 00:20:44.440
top of all these popular GRC platforms. And to
00:20:44.440 --> 00:20:46.480
an extent, we've seen that. I think that's trust
00:20:46.480 --> 00:20:48.809
centers 1 .0. I think there's a Trust Centers
00:20:48.809 --> 00:20:51.250
2 .0 emerging here in the next three to five
00:20:51.250 --> 00:20:53.650
years where it will allow for a user like me
00:20:53.650 --> 00:20:55.990
and you doing due diligence on a service provider
00:20:55.990 --> 00:20:58.849
to double -click into some of these areas. They
00:20:58.849 --> 00:21:00.869
say, hey, we have multi -factor authentication
00:21:00.869 --> 00:21:03.710
across all our systems. We're like, okay, prove
00:21:03.710 --> 00:21:06.390
it. Click on it. Oh, I can see they're using
00:21:06.390 --> 00:21:09.700
Okta. Great. Click on Okta. I can see currently
00:21:09.700 --> 00:21:12.539
it is monitoring these assets within their infrastructure.
00:21:12.880 --> 00:21:15.599
And it is green light right now. And then I can
00:21:15.599 --> 00:21:18.680
also verify that red light, green light is not
00:21:18.680 --> 00:21:21.500
being manipulated by the company as well who's
00:21:21.500 --> 00:21:24.660
hosting that trust center. Unfortunately, right
00:21:24.660 --> 00:21:27.319
now, I have yet to see a red light on a trust
00:21:27.319 --> 00:21:30.680
center ever, meaning there's probably some levels
00:21:30.680 --> 00:21:33.519
of stage gating prior to a red light hitting
00:21:33.519 --> 00:21:37.839
a trust center. Okay. Those are great examples.
00:21:39.400 --> 00:21:41.819
Not just for, I think, information security,
00:21:42.099 --> 00:21:44.240
but just the management system, right? It's openness.
00:21:44.339 --> 00:21:48.440
It's transparency. And frankly speaking, if you
00:21:48.440 --> 00:21:51.160
have a management system that is built into,
00:21:51.400 --> 00:21:53.900
I'll say, the fibers of the business, how it
00:21:53.900 --> 00:21:58.819
operates, then you have nothing to hide. I think
00:21:58.819 --> 00:22:01.539
we've got to get away, and it's tough. I understand
00:22:01.539 --> 00:22:04.180
different pressures here. I think we have to
00:22:04.180 --> 00:22:07.880
get away from these companies constantly seeking
00:22:07.880 --> 00:22:10.539
out what we say is clean or no findings audit
00:22:10.539 --> 00:22:14.140
reports. It is okay to have exceptions, issues,
00:22:14.359 --> 00:22:17.960
nonconformities. That is healthy in a way. And
00:22:17.960 --> 00:22:20.220
I'll tell you from an auditor perspective, it's
00:22:20.220 --> 00:22:22.200
healthy when I see it in an audit report because
00:22:22.200 --> 00:22:24.460
it tells me that, hey, we actually had an auditor
00:22:24.460 --> 00:22:27.200
that was actually hunting for something. doing
00:22:27.200 --> 00:22:30.019
their job. Yeah, I don't remember the name of
00:22:30.019 --> 00:22:31.660
the movie, but I saw a movie a long time ago,
00:22:31.720 --> 00:22:33.680
and this is probably a terrible analogy, but
00:22:33.680 --> 00:22:35.460
I think maybe it was called Cheaters or something
00:22:35.460 --> 00:22:37.740
like that, but it was these high schoolers. It's
00:22:37.740 --> 00:22:39.319
probably a terrible movie. It's probably been
00:22:39.319 --> 00:22:41.079
over 20 years. You're on a roll here. It was
00:22:41.079 --> 00:22:43.579
basically a cheating scheme that they put together,
00:22:43.640 --> 00:22:46.079
and one of them got busted, and I remember him
00:22:46.079 --> 00:22:48.460
saying to the other one, you never get 100. You
00:22:48.460 --> 00:22:50.339
never get a perfect score. Yeah, that's good.
00:22:51.339 --> 00:22:53.160
Was the movie called The Perfect Score? It might
00:22:53.160 --> 00:22:55.079
have been called Cheaters. I don't know. I remember
00:22:55.079 --> 00:22:58.460
some movie about SAT cheating or something. It
00:22:58.460 --> 00:23:02.059
was back when the TV guide was channel 20, and
00:23:02.059 --> 00:23:03.660
you had to sit and watch to see what everything
00:23:03.660 --> 00:23:04.960
was. So you just had to watch it. That must have
00:23:04.960 --> 00:23:06.619
been a decade before I was born. I can't remember
00:23:06.619 --> 00:23:08.200
that. You don't remember TV guides? That's good.
00:23:09.559 --> 00:23:12.279
That's good. But, I mean, it's really true. It
00:23:12.279 --> 00:23:15.279
almost doesn't pass the eye test if you see these
00:23:15.279 --> 00:23:18.400
clean honor boards time and time again. I've
00:23:18.400 --> 00:23:21.180
had clients. Sorry to cut you off. No, you're
00:23:21.180 --> 00:23:25.259
good. Say, you know, they use a low -budget auditor.
00:23:25.579 --> 00:23:27.220
And they've said, oh, no, we had a clean report.
00:23:27.359 --> 00:23:30.380
I don't know how, but it's what the report says.
00:23:30.640 --> 00:23:33.519
Well, it's also very telling, too, when, like,
00:23:33.539 --> 00:23:35.180
a new GRC, like, director comes in and takes
00:23:35.180 --> 00:23:39.130
over a program. they're not familiar with the
00:23:39.130 --> 00:23:41.589
auditor and they start scrutinizing the external
00:23:41.589 --> 00:23:43.069
audit reports they've been getting year after
00:23:43.069 --> 00:23:45.730
year for that organization. And they say, look,
00:23:45.809 --> 00:23:48.190
I've peeked under the hood for 30 minutes and
00:23:48.190 --> 00:23:50.269
I don't understand how we keep getting passes
00:23:50.269 --> 00:23:53.910
on X, Y, and Z. So a whole other topic around
00:23:53.910 --> 00:23:56.150
low -budget firms and low -budget quality and
00:23:56.150 --> 00:23:57.789
you get what you pay for. Another day, another
00:23:57.789 --> 00:24:00.890
podcast. Maybe. Another trip up here. I hate
00:24:00.890 --> 00:24:04.309
that topic, but maybe. Well, let's switch gears
00:24:04.309 --> 00:24:07.670
here then as we get into, I'd say, the back half
00:24:07.670 --> 00:24:10.390
or the final few questions of this podcast, this
00:24:10.390 --> 00:24:15.190
episode. Where's 27701 stand? Oh, you like 27701.
00:24:15.329 --> 00:24:18.410
Well, you know, I like privacy. I like data privacy.
00:24:18.630 --> 00:24:20.609
We do a lot of data privacy work. That's a question
00:24:20.609 --> 00:24:24.410
of mine. And it's funny. You're going to have
00:24:24.410 --> 00:24:28.509
thoughts on this. I find, you know, in my conversations
00:24:28.509 --> 00:24:34.170
that it seems like the 27701 certification privacy
00:24:34.170 --> 00:24:37.170
information management system, that the auditors
00:24:37.170 --> 00:24:39.410
and those helping even implement that system
00:24:39.410 --> 00:24:43.289
are not super familiar with privacy law. No,
00:24:43.390 --> 00:24:44.869
it's very accurate. Which is what it was built
00:24:44.869 --> 00:24:47.329
for. It was. And so we have a whole privacy group,
00:24:47.430 --> 00:24:50.269
and it's always, well, why don't they do 27701?
00:24:50.309 --> 00:24:51.890
It's like, well, it's more of an audit function.
00:24:51.990 --> 00:24:53.650
They're not auditors. They're more advisors.
00:24:54.779 --> 00:24:58.460
I'm getting off topic. Where's the updates stand?
00:24:58.559 --> 00:25:00.420
And then maybe you can address that question
00:25:00.420 --> 00:25:03.859
too. Yeah, happy to. And I'll say your question
00:25:03.859 --> 00:25:07.099
around competency, essentially, extends to...
00:25:07.420 --> 00:25:11.700
AI and 48001 as well. Same issue. We can do that
00:25:11.700 --> 00:25:13.539
on the next episode. We can talk about that whenever
00:25:13.539 --> 00:25:18.559
you want, Jordan. With that being said, ISO 27001
00:25:18.559 --> 00:25:20.960
versus ISO 27701, for people who may not be familiar,
00:25:21.220 --> 00:25:23.900
it's one digit different. One's an extra seven
00:25:23.900 --> 00:25:28.440
in there. For 27701, it is building a privacy
00:25:28.440 --> 00:25:31.660
information management system. Currently, the
00:25:31.660 --> 00:25:34.259
revision is 2019, so it was published in August
00:25:34.259 --> 00:25:38.980
of 2019. ISO 27701 has a co -requisite requirement,
00:25:39.019 --> 00:25:42.119
almost a prereq, where it has to be supported
00:25:42.119 --> 00:25:45.519
by an underlying ISO 27001 information security
00:25:45.519 --> 00:25:48.619
management system. So basically, the adage of
00:25:48.619 --> 00:25:51.019
you can't have privacy without security holds
00:25:51.019 --> 00:25:55.599
true currently. Currently. With ISO 27701, it
00:25:55.599 --> 00:25:58.619
is under major revision right now by JTC1, which
00:25:58.619 --> 00:26:00.059
is the Joint Technical Committee that authors
00:26:00.059 --> 00:26:03.460
that standard. And as of the first week of July,
00:26:03.720 --> 00:26:05.940
it went into kind of the final stage of publication
00:26:05.940 --> 00:26:08.579
for that new major revision. It goes to a seven
00:26:08.579 --> 00:26:11.700
-week ballot now. So we should be expecting if
00:26:11.700 --> 00:26:13.559
it meets that timeline sometime here in August.
00:26:14.420 --> 00:26:16.839
However, just looking at a few other singers
00:26:16.839 --> 00:26:18.980
that just got recently published, like 40 -2006,
00:26:19.259 --> 00:26:21.740
they can break that seven weeks if they need
00:26:21.740 --> 00:26:24.319
to. So I would probably say more conservatively
00:26:24.319 --> 00:26:25.640
it's going to come out next month in September.
00:26:26.339 --> 00:26:29.220
And when it comes out, we already have seen what's
00:26:29.220 --> 00:26:31.250
called the final draft. international standard,
00:26:31.329 --> 00:26:34.230
the FDIS. We know that it is decoupling that
00:26:34.230 --> 00:26:36.609
co -requisite relationship. So you could have
00:26:36.609 --> 00:26:41.529
standalone ISO 27701 certification without the
00:26:41.529 --> 00:26:43.190
security component here in the future as well.
00:26:44.430 --> 00:26:46.009
Answer your question here a little bit on the
00:26:46.009 --> 00:26:49.049
competency question, if I should rephrase that
00:26:49.049 --> 00:26:52.210
a little bit. Well, I guess it's part of the
00:26:52.210 --> 00:26:55.369
theme again of this podcast, using it as a catalyst,
00:26:55.589 --> 00:26:58.390
using it to improve processes, not just a checkbox.
00:26:59.289 --> 00:27:03.130
I would challenge that on 27701. If the organization's
00:27:03.130 --> 00:27:04.970
helping you prepare for that and get audited
00:27:04.970 --> 00:27:06.789
against it or not well -versed in data privacy,
00:27:07.009 --> 00:27:09.720
are you really building? and effective data privacy
00:27:09.720 --> 00:27:12.619
management. Yeah, so I'll speak to it a little
00:27:12.619 --> 00:27:14.519
bit more objectively at first, and I'll give
00:27:14.519 --> 00:27:16.539
you a little bit more of a penny on here. So
00:27:16.539 --> 00:27:21.359
27701, it has two annexes full of controls. Annex
00:27:21.359 --> 00:27:24.119
A is found for the PII controller, and that has
00:27:24.119 --> 00:27:28.380
31 controls. Annex B is a PII processor, and
00:27:28.380 --> 00:27:31.079
that has 18 controls. And this is current 2019?
00:27:31.599 --> 00:27:33.680
The current 2019 major revision that's currently
00:27:33.680 --> 00:27:37.680
in force right now. First thing I'll say, is
00:27:37.680 --> 00:27:42.160
all ISO certifications can be scoped as narrowly
00:27:42.160 --> 00:27:44.900
or as broadly as the organization wants. Ultimately,
00:27:44.940 --> 00:27:47.480
as the certification body, the auditor, we audit
00:27:47.480 --> 00:27:49.519
to the scope that the organization dictates.
00:27:49.980 --> 00:27:52.519
And so when you run into a situation like this,
00:27:52.599 --> 00:27:55.059
and this is the same thing with the GDPR, every
00:27:55.059 --> 00:27:57.759
attorney everywhere always wants to limit liability.
00:27:58.339 --> 00:28:02.220
And so I will tell you of the 27701 certifications
00:28:02.220 --> 00:28:03.779
I've been involved in, I'm a current company,
00:28:03.799 --> 00:28:08.140
prior company, very few. adopt the PII controller,
00:28:08.460 --> 00:28:10.799
the 31 of the total 49 controls in the entire
00:28:10.799 --> 00:28:13.940
standard. Most of them say we're a processor.
00:28:14.500 --> 00:28:17.579
Most say we're a processor, and even at that,
00:28:17.700 --> 00:28:20.519
we're a limited processor. We don't have any
00:28:20.519 --> 00:28:22.859
responsibility. It's all our own customers. Or
00:28:22.859 --> 00:28:24.299
at least that's what they want their cert to
00:28:24.299 --> 00:28:25.420
say. That's what they want their certification
00:28:25.420 --> 00:28:28.160
to say, and they can dictate that scope. We're
00:28:28.160 --> 00:28:30.420
running into something similar for A2001, which
00:28:30.420 --> 00:28:33.680
I can articulate here in a future episode. But
00:28:33.680 --> 00:28:36.859
with 27701, don't always point fingers back to
00:28:36.859 --> 00:28:40.160
the auditor for lack of substance. The organization
00:28:40.160 --> 00:28:43.599
is dictating that. You're giving an audit package
00:28:43.599 --> 00:28:46.019
to audit. Of course. Now, from a competency standpoint,
00:28:46.400 --> 00:28:50.119
is conformity assessments and ISO certifications
00:28:50.119 --> 00:28:53.220
the same as compliance to law and regulation?
00:28:53.460 --> 00:28:57.140
And the answer to that is no. So when 27701 first
00:28:57.140 --> 00:29:00.769
came out, it had a lot of fanfare. Some authors
00:29:00.769 --> 00:29:03.890
on... Yeah, it came out the year after GDPR was...
00:29:03.890 --> 00:29:05.930
Went into force, yeah. So GDPR went into force
00:29:05.930 --> 00:29:09.269
May 2018, August 2019, you have 27701. It's starting
00:29:09.269 --> 00:29:11.210
to feel like, hey, maybe this is what we call
00:29:11.210 --> 00:29:14.009
the certification mechanism for the EU GDPR.
00:29:14.049 --> 00:29:16.990
If you read Article 42 of 43, it talks about,
00:29:17.009 --> 00:29:19.950
hey, there is a way to certify to the GDPR. You're
00:29:19.950 --> 00:29:24.680
quoting one of the 99 GDPR articles now. Is there
00:29:24.680 --> 00:29:26.880
99 total? Yeah. There was. I want to make sure
00:29:26.880 --> 00:29:30.700
I'm clear on that. I know 42 and 43 really well.
00:29:30.700 --> 00:29:33.019
Look at you. I have to because I'm confident.
00:29:33.279 --> 00:29:36.960
And you say mastermind is about making your clients
00:29:36.960 --> 00:29:38.619
mastermind. Yeah. Well, we're educating right
00:29:38.619 --> 00:29:41.119
now. I just want to make sure I'm clear on the
00:29:41.119 --> 00:29:42.640
total number of articles there. I think there's
00:29:42.640 --> 00:29:45.380
some that are like kind of prefaces to that.
00:29:45.519 --> 00:29:48.819
Well, I heard a great talk at a privacy conference
00:29:48.819 --> 00:29:53.759
one time. And the topic was. I got 99 articles,
00:29:53.940 --> 00:29:56.980
but something's not won, right? That was good.
00:29:56.980 --> 00:29:59.660
That was good. That was good. It wasn't the JC
00:29:59.660 --> 00:30:02.539
lyric. Yeah, there you go. Where I'll go with
00:30:02.539 --> 00:30:05.599
that, though, is GDPR certification eventually
00:30:05.599 --> 00:30:08.000
did get approved by the European Data Protection
00:30:08.000 --> 00:30:11.480
Board. And there are GDPR certification mechanisms
00:30:11.480 --> 00:30:16.200
out today that are not ISO 27701. ISO 27701 never
00:30:16.200 --> 00:30:18.660
became that GDPR certification mechanism. However,
00:30:18.859 --> 00:30:20.220
people were thinking originally when it came
00:30:20.220 --> 00:30:22.420
out it might be it because none had been approved
00:30:22.420 --> 00:30:24.960
yet. And the CNIL, which is the Data Protection
00:30:24.960 --> 00:30:27.779
Authority out of France, was actually... part
00:30:27.779 --> 00:30:30.740
of the authorship or group of that joint technical
00:30:30.740 --> 00:30:33.119
committee that authored 27701. So everyone's
00:30:33.119 --> 00:30:35.900
like, okay, like we have DPA involvement here
00:30:35.900 --> 00:30:38.039
that are actually authoring the standard. And
00:30:38.039 --> 00:30:39.440
then if you looked at the standard when it came
00:30:39.440 --> 00:30:41.380
out, there was an informative reference in one
00:30:41.380 --> 00:30:43.859
of the annexes that actually mapped it to the
00:30:43.859 --> 00:30:47.319
European Union GDPR. So you're saying all signs
00:30:47.319 --> 00:30:49.279
are pointing to that this could possibly be a
00:30:49.279 --> 00:30:52.400
certification mechanism. Unfortunately, it never
00:30:52.400 --> 00:30:54.799
became that certification mechanism. If you read
00:30:54.799 --> 00:30:57.079
the GDPR, one of the articles, I think it's 43
00:30:57.079 --> 00:30:59.720
for this one, it talks about another ISO standard,
00:30:59.880 --> 00:31:03.759
17065. And that is a product and services certification,
00:31:04.079 --> 00:31:06.019
not a management system certification, which
00:31:06.019 --> 00:31:09.960
would be under 1701. And so technically, 2701
00:31:09.960 --> 00:31:11.960
could have never been it. It would have had to
00:31:11.960 --> 00:31:13.880
have been extended, augmented some way to apply
00:31:13.880 --> 00:31:16.319
to a specific product or service. Getting back
00:31:16.319 --> 00:31:18.460
to the competency piece here, and I'll wrap up.
00:31:18.619 --> 00:31:21.740
But ultimately speaking, these auditors are not
00:31:21.740 --> 00:31:24.430
supposed to be... super well -versed in law.
00:31:24.990 --> 00:31:28.450
One, law changes more frequently than even these
00:31:28.450 --> 00:31:30.250
ISO standards that are served as references and
00:31:30.250 --> 00:31:34.210
normal criteria. But second, when we have this
00:31:34.210 --> 00:31:36.269
intake process of certification that I'm intimately
00:31:36.269 --> 00:31:39.089
familiar with, customers have to apply for certification.
00:31:40.289 --> 00:31:42.250
We'll think of that more like a scoping call
00:31:42.250 --> 00:31:45.069
almost, like with an early prospect. But if we
00:31:45.069 --> 00:31:47.789
get a customer that works in a specific sector,
00:31:48.150 --> 00:31:51.690
say... something illicit, for example, maybe
00:31:51.690 --> 00:31:55.869
like something adult, we can reject that applicant
00:31:55.869 --> 00:31:59.720
or that prospect. on the basis that we don't
00:31:59.720 --> 00:32:01.960
have sector -specific knowledge to apply that
00:32:01.960 --> 00:32:04.240
criteria to it. I'm using an extreme example
00:32:04.240 --> 00:32:07.319
here. But if for some reason there's some sort
00:32:07.319 --> 00:32:10.000
of sensitive data there, we're supposed to reject
00:32:10.000 --> 00:32:11.779
it based on our sector -specific competency.
00:32:12.220 --> 00:32:14.220
If you feel like, okay, you're beyond your skis
00:32:14.220 --> 00:32:15.819
on it. Well, actually, for Mastermind, we're
00:32:15.819 --> 00:32:17.799
actually very specific. We can only work with,
00:32:17.900 --> 00:32:19.180
and you might think this is broad, but these
00:32:19.180 --> 00:32:20.599
are a little bit more contained than you think,
00:32:20.720 --> 00:32:23.039
but technology companies, financial services,
00:32:23.180 --> 00:32:25.700
and healthcare. Now, you can apply that first
00:32:25.700 --> 00:32:28.089
one. Is that per your... Under accreditation
00:32:28.089 --> 00:32:30.230
scope, yeah. You don't find that on the certificate
00:32:30.230 --> 00:32:32.609
or the scope of accreditation. It's found in
00:32:32.609 --> 00:32:34.650
our quality system, and that's audited by that
00:32:34.650 --> 00:32:36.869
accreditation body when they're approving accreditation.
00:32:37.569 --> 00:32:39.630
It's more pertinent in quality management, but
00:32:39.630 --> 00:32:42.910
it comes up in 2017. So what do you do when they're
00:32:42.910 --> 00:32:45.730
outside of that? You can't support it. You introduce
00:32:45.730 --> 00:32:48.710
them elsewhere? You reject the applicant. You
00:32:48.710 --> 00:32:51.069
say, okay, we can't work with you. So I'll give
00:32:51.069 --> 00:32:52.890
you an example, though. That technology pillar.
00:32:53.359 --> 00:32:55.940
that can be pretty elastic. So you can have a
00:32:55.940 --> 00:32:58.019
company that works in maybe a sector that you
00:32:58.019 --> 00:33:00.019
don't have a ton of knowledge in, but if they
00:33:00.019 --> 00:33:02.220
have an IT platform, then you can accept that
00:33:02.220 --> 00:33:05.019
applicant. So if that IT platform is what's under
00:33:05.019 --> 00:33:07.420
scope for the 27 ,000 one audit, if you want
00:33:07.420 --> 00:33:10.000
to use that as an example. Gotcha. It comes up
00:33:10.000 --> 00:33:11.559
more often. I'm going to mute my phone. Oh, you're
00:33:11.559 --> 00:33:14.000
good. Ding, ding. In the middle of our first
00:33:14.000 --> 00:33:16.059
recorded podcast. You're good. Amateur. Yeah,
00:33:16.079 --> 00:33:18.079
very much. You must have not done this before.
00:33:18.879 --> 00:33:20.980
But even more interesting is, like, I say 9001
00:33:20.980 --> 00:33:22.660
quality management. There's different, like,
00:33:22.700 --> 00:33:24.880
what they call EA or industry codes. And so,
00:33:24.920 --> 00:33:27.440
like, we would only operate if we ever did 9001
00:33:27.440 --> 00:33:31.480
under EA code 33, which is IT. There's EA codes
00:33:31.480 --> 00:33:33.960
for, like, nuclear, aerospace, or manufacturing.
00:33:34.539 --> 00:33:37.160
And basically, like, if you think about 9001,
00:33:37.220 --> 00:33:40.339
or, like, I'll say origins, this was, like, basically
00:33:40.339 --> 00:33:42.599
certifying, like, an assembly line, like, at
00:33:42.599 --> 00:33:45.539
a car manufacturing plant. Like, David Foreman
00:33:45.539 --> 00:33:47.299
is not qualified to tell you whether or not that,
00:33:47.319 --> 00:33:49.140
you know, like, car. part coming off the line
00:33:49.140 --> 00:33:52.039
is conforming to 9001 and whatever other industry
00:33:52.039 --> 00:33:54.140
statements. Not yet. I don't think I'm going
00:33:54.140 --> 00:33:58.859
to be. Okay. I think that's probably a wrap for
00:33:58.859 --> 00:34:00.779
today. Excellent. That was a lot of good stuff.
00:34:00.819 --> 00:34:03.160
Well, not for today. For this episode. Oh, good.
00:34:03.180 --> 00:34:04.500
Because we're going to take a quick break and
00:34:04.500 --> 00:34:06.299
you're going to come back and... We'll talk about
00:34:06.299 --> 00:34:11.320
AI. And 42001 and 42006 apparently. Yeah. 42005
00:34:11.320 --> 00:34:14.820
too if you want to. 8, 9, 10. I don't think those
00:34:14.820 --> 00:34:18.630
exist yet. Yeah. How do people get in touch with
00:34:18.630 --> 00:34:20.469
Mastermind? Yeah, so you can find us online.
00:34:20.510 --> 00:34:23.869
Our website is mastermindassurance .com. You
00:34:23.869 --> 00:34:25.909
can email us at hello at mastermindassurance
00:34:25.909 --> 00:34:29.210
.com. You can find us on LinkedIn. Jordan's already
00:34:29.210 --> 00:34:32.130
alluded that we are very noisy on LinkedIn. You
00:34:32.130 --> 00:34:34.530
can follow me specifically. My handle is masterminddavid.
00:34:34.889 --> 00:34:37.449
Or you can find our company page and you'll be
00:34:37.449 --> 00:34:40.750
linked to all the good news. But also, just continue
00:34:40.750 --> 00:34:42.429
watching this podcast because we're a frequent
00:34:42.429 --> 00:34:45.690
guest. That's right, yeah. And if you like what
00:34:45.690 --> 00:34:47.199
you hear on these podcasts and you're... interested
00:34:47.199 --> 00:34:49.820
in contacting Compliance Point, you've probably
00:34:49.820 --> 00:34:51.900
heard it by now, but if not, compliancepoint
00:34:51.900 --> 00:34:53.940
.com. You can email us directly at connect at
00:34:53.940 --> 00:34:56.500
compliancepoint .com. I'm also active on LinkedIn
00:34:56.500 --> 00:34:59.900
and would welcome any messages there. David,
00:35:00.000 --> 00:35:02.679
we'll take a break and do it again soon. Thanks,
00:35:02.739 --> 00:35:02.900
everybody.