The client's business structure involved interactions with a large number of independent legal entities within the client's corporate group.
Despite sharing information resources, these organizations were legally independent. Each processed personal data and operated information systems in accordance with its own goals and objectives. This situation presented potential risks of legal violations.
After delving into legal requirements, management decided to proactively improve all related processes and establish a systematic approach to personal data processing. The company needed a partner capable of understanding the interactions between corporate structures and providing practical and effective measures and tools to ensure protection.
Key Challenges
- Conduct an audit of the customer's personal data processing organization across all areas and prepare a survey report.
- Develop an information security threat model and an intruder model.
- Classify all identified personal data information systems.
- Create a complete set of organizational and administrative documentation (including documents for the company's websites).
The project began with an analysis of current personal data processing processes. The ICL Services team conducted a series of interviews with employees, reviewed the client's data processing business processes, job descriptions, contract forms, and existing information systems where personal data is processed.
This phase resulted in a report on the audit of the client's personal data processing organization for compliance with personal data legislation. The client received a report outlining the assessment of the current state of compliance with legal requirements and recommendations for achieving compliance.
The audit revealed that the actual data processing purposes differed from those declared in the original Roskomnadzor Notification, and the identified areas for improvement will significantly facilitate full compliance with regulatory requirements.
Next, the experts classified the information systems where the data is processed, after which they drafted reports determining the security levels of personal data information systems.
Following this, the team developed:
- a notification to Roskomnadzor regarding the processing of personal data;
- a notification of intent to carry out cross-border transfer of personal data;
- a complete set of organizational and administrative documentation regulating the processing of personal data for both internal use and for customer websites.
The final stage was the modeling of information security threats, in accordance with the Methodological Document approved by the Federal Service for Technical and Export Control of Russia on February 5, 2021, and the Federal Service for Technical and Export Control (FSTEC) BDU.
Results
- We developed a detailed report on the current state of personal data processing processes across all business areas. We identified risk areas and identified ways to address inconsistencies.
- The client received a basis for minimizing fines and reputational risks, as well as a clear plan for further enhancing the maturity of the information security function.
- All personal data information systems were identified and classified, and security levels were assigned.
- A complete set of mandatory notifications for Roskomnadzor was developed, including cross-border transfers, thereby eliminating the risk of regulatory claims.
- A threat and information security violator model was created. With its help, the company can now determine requirements for the system and data protection solutions.