Framework - ISO 27001 (Cyber)14 Okt 2025

Episode 39 — A.5.33–5.34 — Protection of records; Privacy & PII protection

A.5.33 mandates that records—authoritative evidence of activities performed—are protected so they remain authentic, reliable, and usable for as long as needed. For the exam, note the required controls: classification, retention rules, integrity safeguards, controlled access, and secure disposal. Records may include logs, audit trails, training attestations, incident reports, contracts, and design reviews, each carrying evidentiary value for audits and investigations. A.5.34 focuses on privacy and protection of personally identifiable information (PII), requiring that processing be lawful, fair, and transparent, with appropriate technical and organizational measures commensurate to risk. Candidates should be able to articulate how privacy principles intersect with security controls to protect individuals’ rights while supporting business operations.

Implementation uses records retention schedules aligned to legal and contractual requirements, write-once or append-only storage for critical logs, time synchronization for trustworthy timelines, and access controls with immutable audit trails. For privacy, organizations maintain data inventories, purpose limitations, minimization strategies, role-based access, encryption, and consent or notice mechanisms where applicable. Privacy by design introduces DPIAs for high-risk processing, de-identification where feasible, and data subject request workflows tested for timeliness and completeness. Pitfalls include retaining data longer than needed, incomplete log coverage in cloud services, weak key management, and privacy notices that do not match actual processing. Strong programs track DSAR response times, deletion SLA adherence, log integrity verification, and exceptions granted by counsel. Candidates should be ready to explain how records and privacy controls integrate with incident response, supplier agreements, and management review to form a defensible, people-centric compliance posture. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.

Denne episoden er hentet fra en åpen RSS-feed og er ikke publisert av Podme. Den kan derfor inneholde annonser.

Episoder(71)

Welcome to Framework - ISO 27001

Dive into a fast, no-fluff overview of what this podcast delivers, who it’s for, and how each episode helps you level up with practical, real-world takeaways. In this trailer, you’ll hear the show’s p...

14 Okt 20251min

Episode 70 — A.8.33–8.34 — Test information; Protecting systems during audit testing

A.8.33 governs test information—data and artifacts used to verify functionality and security—so that confidentiality, integrity, and legality are preserved. For the exam, distinguish data sources and ...

14 Okt 202513min

Episode 69 — A.8.31–8.32 — Separation of dev/test/prod; Change management

A.8.31 enforces separation between development, test, and production to prevent inadvertent changes, data leakage, and unauthorized access. For the exam, stress environment isolation, distinct identit...

14 Okt 202511min

Episode 68 — A.8.29–8.30 — Security testing in development & acceptance; Outsourced development

A.8.29 requires structured security testing throughout development and acceptance, proving that controls operate as intended before release. For the exam, differentiate testing modalities and purposes...

14 Okt 202513min

Episode 67 — A.8.27–8.28 — Secure system architecture & engineering; Secure coding

A.8.27 focuses on secure system architecture and engineering, requiring designs that partition trust, minimize attack surface, and enforce least privilege at every layer. For the exam, emphasize archi...

14 Okt 202514min

Episode 66 — A.8.25–8.26 — Secure development lifecycle; Application security requirements

A.8.25 requires a secure development lifecycle (SDLC) that embeds security from concept to retirement, not as a late-stage gate. For the exam, describe SDLC phases with explicit security tasks: threat...

14 Okt 202514min

Episode 65 — A.8.23–8.24 — Web filtering; Use of cryptography

A.8.23 establishes web filtering to manage risk from browsing and outbound HTTP/S traffic, acknowledging that the browser is a primary threat vector. For the exam, emphasize policy-aligned controls th...

14 Okt 202515min

Episode 64 — A.8.21–8.22 — Security of network services; Segregation of networks

A.8.21 requires that network services—whether internal or provided by third parties—be specified and secured to meet business and security requirements. For the exam, think beyond raw connectivity: se...

14 Okt 202513min