Governance of Enterprise IT - Discussion

26

Compliance

Control 18 is intended to ensure that the organization avoids breaches of any criminal or civil law, as well as any statutory, regulatory or contractual obligations, and any security requirements. It deals with legal requirements, security policy compliance and technical checking, and with system audit. It is the last clause of the standard and it has two objectives with eight support- ing controls.

The outline of relevant legislation in this, the legal requirements section of this book, is not intended to be authoritative. Current legal advice must be taken from qualified specialist legal advisers if an organization wants or needs to rely on any matter discussed here. Equally, it should be noted that this section is dealing with current compliance issues for organizations based or operating in or supplying either the UK or US market. Laws are likely to be different in other countries, and therefore organizations seeking certification that are based elsewhere should take specialist local advice. Organizations based in a jurisdiction with operations elsewhere in the world will need to deal with the local legal requirements as well as those of the foreign countries in which they operate, and again specialist legal advice should be taken.

E-commerce (even if the organization is based in one jurisdiction) could potentially take place in a multitude of countries, and the law in this area is constantly changing and developing. Any organization that is trading across the web without limits on who may access its website should take specialist advice to ensure that contractual and trading terms are watertight and that issues of jurisdiction and which law (that of the country in which the server is based, or the organization is based, or the customer is based, or to which delivery is made) will apply to any transaction have been resolved, and to ensure that there is an appropriate acceptance and/or waiver of liability on the entrance to the website.

IT GOVERNANCE340

Identification of applicable legislation

Control 18.1.1 of ISO27002 says the organization should explicitly define and document the statutory, regulatory and contractual requirements for each of its information systems, and this documentation should be kept up to date to reflect any relevant changes in the legal environment. The specific controls and individual responsibilities to meet these requirements should be similarly documented and kept up to date. The ISMS should already contain a complete list of all the data assets and processes in the organiza- tion, together with ownership details (see Chapter 8).

A sensible way to tackle this requirement is to create a database of appli- cable legislation (which will need to be updated as and when laws change) that identifies relevant laws, the specific clauses which may be applicable, and which links those specific clauses to individual controls in the ISMS. For each regulatory or contractual requirement on the database, someone in the organization should have allocated responsibility for ensuring compliance.

Of course, in an integrated management system there would be an inte- grated approach to tracking legal and compliance developments in all the components of the system. Information security, health and safety, environ- ment, quality, human resources, commercial and other issues would all be systematically tracked and appropriate steps taken towards compliance inside the organization.

The legislation that any organization might need to identify could include, but is not necessarily limited to:

● EU regulation. EU directives have been, and will continue to be, significant drivers of UK regulation. The two most important EU instruments, from the perspective of this clause of the standard, are the EU General Data Protection Regulation (GDPR) and the EU Privacy Directive of 2003. These instruments give the context for the UK legislation identified and discussed below, and for any changes that may occur in future.

● UK legislation. Intellectual property rights (IPR), through the Copyright, Designs and Patents Act 1988 (CDPA), are one of the most obvious legal issues for most information processing systems, but there is a web of other relevant legislation. The Companies Act 2006, which consolidates and replaces all the previous UK Companies Acts, contains a number of important provisions regarding electronic records, electronic trading and electronic communications. The next most important of these laws is the Data Protection Act 2018 (DPA), and in addition to this there are the

COMPLIANCE 341

Human Rights Act 1998 (HRA), the Regulation of Investigatory Powers Act 2000 (RIPA), the Computer Misuse Act 1990 (as updated by the Police and Justice Act 2006), the Electronic Communications Act 2000 and the Privacy and Electronic Communications Regulations 2003 (as amended). The Freedom of Information Act (FOIA) was passed in 2000 and, while primarily applicable to public bodies, it has the potential to force into the public arena confidential commercial information about (for instance) public-sector contracts.

● In the United Kingdom, there is a complex array of anti-money laundering laws including the Terrorism Act 2000, the Proceeds of Crime Act 2002 and the Money Laundering Regulations 2003. Compliance with this legislation means that detailed client verification records need to be maintained and kept secure.

● More recent UK laws include the Bribery Act, an array of Crime and Security Acts, plus assorted legislation dealing with identity cards and electronic money.

● There is an increasing amount of corporate governance legislation in the United Kingdom, which will require the collection and storage of commercially sensitive data in order to satisfy reporting obligations. In order to comply, directors will also need to satisfy themselves that the IT system itself does not pose any operational risks to the company. These requirements, originally contained in general legislation such as the Companies (Audit, Investigations and Community Enterprise) Act 2004 were carried forward to the Companies Act 2006. There is also sector- specific regulation enforced by bodies such as the Financial Services Authority.

● US legislation. Relevant US legislation and regulation include the Gramm–Leach–Bliley Act (GLBA), dealing with consumer financial data; the Fair Credit Reporting Act (FCRA), designed to protect people from identify theft; the Health Insurance Portability and Accountability Act (HIPAA), which requires healthcare organizations (and their business associates) to protect – and keep up to date – their patients’ healthcare records; the SEC’s Regulation FD, which bars selective disclosure of material non-public information; the SEC’s rule 17 a-4, which requires broker dealers to retain trading records (therefore including e-mails, etc) for six years; section 404 of Sarbanes–Oxley (the overall importance of which is much greater than this single issue), which requires companies to safeguard (among other assets) their information, including e-mails,

IT GOVERNANCE342

attachments, etc; the California Online Privacy Protection Act of 2004 (OPPA), which requires websites serving Californians (irrespective of their geographic or jurisdictional location) to comply with strict privacy guidelines; the CAN-SPAM Act, the Millennium Digital Copyright Act, FISMA and a growing number of state information security and data breach laws (such as the Californian Senate Bill 1386), which require notification of breaches of personal data security.

Most recently, California’s Consumer Privacy Act brings some of the EU GDPR regulatory heft to the USA and has triggered a federal-level review of US privacy regulation. Of course, the huge growth in anti-money-laundering regulation, including the requirements of the international Joint Task Force and the US Patriot Act, broadens the requirement on organizations to verify client details, and therefore to keep those personal details secure and in line with applicable data security regulations.

UK legislation

In the United Kingdom, there are now over 70 laws that, to one extent or another, may need to be reflected in the ISMS. A current list is included in the Vigilant Software Compliance Manager. The most important legislation includes the following.

THE DATA PROTECTION ACT 2018

The UK’s Data Protection Act 2018 (DPA), which puts the EU GDPR into UK statute, requires any organization that processes personal data to comply with six data protection principles. These are that personal data must be:

1 processed lawfully, fairly and in a transparent manner;

2 collected for specified, explicit and legitimate purposes;

3 adequate, relevant and limited to what is necessary;

4 accurate and, where necessary, kept up to date;

5 retained only for as long as necessary;

6 processed in an appropriate manner to maintain security.

The DPA 2018 is concerned with every conceivable category of personal data that relates to an identifiable natural individual and includes informa- tion such as ide ntification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental,

COMPLIANCE 343

economic, cultural or social identity of that natural person. Under the terms of the DPA, ‘processing’ includes any operation performed on personal data, and the requirements apply to both electronic data and paper records (if they are contained in a ‘relevant filing system’). The precise definitions of what is and what is not covered are set out in the GDPR.

Any organization that is going to collect personal data (a data controller) must register with the Information Commissioner. Notification lasts one year and must then be renewed.

The DPA covers all activities that involve processing personal data, including CCTV records, websites and internet activity, recruitment and selection of staff, employment records, staff monitoring (including, for example, checking telephone records or internet use) and information about workers’ health.

The Information Commissioner’s website provides detailed guidance and a number of codes of practice (some general codes and others specific to the public or private sectors) on the steps necessary for an organization to comply with the DPA. In that guidance, the Information Commissioner describes the approach that an organization should follow in its effort to comply with the sixth data protection principle. This approach is in line with ISO27001. It would be fair to assume from this that implementation of an accredited ISMS would be regarded as an appropriate step to comply with the requirements of the sixth principle of the DPA.

The key point is that data controllers and data processors – those organ- izations that process data on behalf of a data controller – must comply with the DPA; failure to do so could result in substantial fines for organizations, and particular attention should be paid to the requirement to keep data secure. The Information Commissioner has the power to levy fines of up to 4 per cent of global turnover for the most serious breaches of the DPA.

In particular, the GDPR requires organizations to take all appropriate steps to protect personal data from likely compromises to its confidentiality, integrity and availability and to do so after taking account of vulnerabilities, impacts and the ‘state of the art’. The risk-driven approach of ISO 27001 supports the requirements of the DPA.

DPA 2018 requires organizations that suffer data breaches (where there is a risk to the rights and freedoms of data subjects) to report them to the Information Commissioner within 72 hours. It also confers on data subjects the right to bring complaints to supervisory authorities or to bring court actions in circumstances where they consider their rights as data subjects to have been transgressed.

IT GOVERNANCE344

THE PRIVACY AND ELECTRONIC COMMUNICATIONS REGULATIONS 2003

AND 2011

The Privacy and Electronic Communications Regulations 2003 came into force on 11 December 2003 and superseded the earlier Telecommunications (Data Protection and Privacy) Regulations 1999. The Information Commissioner is responsible for enforcing them, and there is a section on the Information Commissioner’s website dealing with these regulations.

The regulations cover use, by telecommunication network and service providers and by individuals, of any publicly available electronic communi- cations network for direct marketing purposes, and any unsolicited direct marketing activity by telephone, fax, electronic mail (which includes text, video and picture messaging, SMS and e-mail) and automated telephone calling systems. The key right conferred both on individuals and on corpo- rate entities is the right to register their objection to receiving unsolicited direct marketing material, and it provides a mechanism for doing this. A number of requirements, including in some circumstances the obligation to obtain the prior consent of the person to whom marketing messages are to be directed, are imposed on direct marketers, and these will intersect with obligations under the DPA; organizations have to ensure that they comply with both. The 2011 amendment introduced a requirement to obtain the explicit prior consent of the surfer before installing a cookie in the browser. The Information Commissioner’s website supplies, and keeps up to date, detailed guidance on these regulations. The detailed law around data protec- tion and privacy is changing as cases work their way through the courts. Any organization engaged in direct electronic marketing of any sort needs to take appropriate legal advice and ensure that its operations remain in line with the law.

THE FREEDOM OF INFORMATION ACT 2000

The Information Commissioner enforces both the Freedom of Information Act 2000 (FOIA) and the Data Protection Act. The FOIA provides a general right of access to all types of information held by public authorities and those providing services for them. The FOIA is ‘intended to promote a culture of openness and accountability amongst public sector bodies, and therefore facilitate better public understanding of how public bodies carry out their duties, why they make the decisions they do, and how they spend public money’. Only public authorities are covered by the Act and there is a long list, at Schedule 1 of the FOIA, of all the organizations covered. It basi- cally includes any public body.

COMPLIANCE 345

The FOIA came fully into force on 1 January 2005, and the first adoption of a publication scheme under the FOIA was by government departments and their agencies in 2002. The rights of individuals to access information held by these organizations, and the responsibilities of the organizations, can be explored further on https://ico.org.uk (archived at https://perma.cc/ 6BTV-VF5H).

Private companies should note that one of the clear consequences of the FOIA is that details of their previously confidential public-sector tenders and contracts could now be made public, irrespective of any previous con- fidentiality clauses. This is a key area on which private-sector companies may urgently need to take contract-specific professional advice; certainly, their commercial practices may need to be adjusted to reflect the risk of disclosure.

The Information Commissioner is also now responsible for the Environmental Information Regulations 2004 (which also came into force on 1 January 2005), which enable people to access environmental informa- tion held by or on behalf of public authorities and those bodies carrying out a public function. Technically, any environmental information request is an FOIA request, but, as environmental information was exempted in the FOIA, these regulations are necessary. As part of the requested information might also be personal information (eg if the applicant is a subject of the information request), these regulations intersect with the DPA.

Public authorities will take appropriate legal advice on the issues contained in the three pieces of legislation; it is expected that use and prac- tice, court cases and ministerial interventions will all contribute to a changing privacy landscape. Introduction of a personal identity card will dramatically shake up the whole area.

THE COMPUTER MISUSE ACT 1990

The Computer Misuse Act 1990 (CMA) was designed to set up provisions for securing computer material against unauthorized access or modification. It created three offences: the first is knowingly to use a computer to obtain unauthorized access to any program or data held in the computer; the second is to use this unauthorized access to commit one or more offences; the third is to carry out an unauthorized modification of any computer material. The CMA allows for penalties in the form of both fines and imprisonment.

The CMA basically outlaws, within the United Kingdom, hacking and the introduction of computer viruses. It initially had a significant impact on

IT GOVERNANCE346

the computer policies of universities, often seen as the source of much of this sort of activity. It does have other implications for computer users in the United Kingdom. Anyone using someone else’s user name without proper authorization is potentially committing an offence. Anyone copying data who is not specifically authorized is potentially committing an offence. It also has relevance for organizations whose employees may be using organi- zational facilities to hack other sites or otherwise commit offences identified under the Act. The organization should take full advantage of the RIPA (see below) to ensure that staff are complying with the law.

The United Kingdom’s All Party Internet Group (APIG) reviewed this Act in mid-2004 and recognized that it had been ineffective, largely through inadequate enforcement resourcing. It recommended a limited number of changes to the CMA and a number of other actions by other bodies to improve the legal environment for computer security. This led to the Police and Justice Act (2006) which updated and modified the CMA.

THE POLICE AND JUSTICE ACT 2006

Clauses 35–38 of the Police and Justice Act 2006 (which also deals with many other issues) amended the CMA as follows:

● The maximum sentence for ‘unauthorised acts with intent to impair, or with recklessness as to impairing, operation of computer’ (aimed primarily at denial-of-service attacks, but with a far wider effect) was doubled from five to ten years.

● They created an offence of ‘making, supplying or obtaining articles for use in an offence’ as defined in the CMA, as amended. While it is claimed that this provision, which is clearly intended to deal with hacking tools, may have the unintended consequence of impacting ethical hacking and penetration testing, the wording of clause 3A indicates that there will only be an offence if the supply of hacking tools is done in the intention or belief that they will be used in (or used to assist) the commission of an offence as defined in the CMA (as amended).

THE COPYRIGHT, DESIGNS AND PATENTS ACT 1988

The internet starting point for organizations that want detailed advice on intellectual property is the Intellectual Property Office. The principal legislation on copyright can be found in the Copyright, Designs and Patents Act 1988 (CDPA). It has been amended a number of times and there is no

COMPLIANCE 347

official consolidation of it. A list of the most important pieces of legislation that have amended the 1988 Act and some other information about the legislation can be obtained from the UK Intellectual Property Office (www. gov.uk/government/organisations/intellectual-property-office (archived at https://perma.cc/J6EG-3ZL2)). This is a complex and difficult area for any organization that deals in intellectual property, and appropriate professional advice should be taken from a firm that specializes in this area.

Organizations with valuable digital assets should also track the develop- ments in steganography, which is a method of hiding information in other data, such as voice communications, visual images and music, in order to provide forensic evidence of copyright ownership and trace the source of infringing material. This might also be called ‘digital watermarking’ and is likely to become an important part of copyright management on the inter- net. There are a number of companies offering competing digital water- marking technologies, both to create and to view digital watermarks.

In the United Kingdom there are a number of collective bodies that handle licensing for specific sectors of the creative industries. They include the Copyright Licensing Agency (CLA), a non-profit-making company that licenses organizations for photocopying and scanning from magazines, books and journals. The CLA was established in 1982 by the Authors’ Licensing and Collecting Society (ALCS) (www.alcs.co.uk (archived at https://perma.cc/GBZ6-SXRD)) and the Publishers Licensing Society (PLS) (www.pls.org.uk (archived at https://perma.cc/82V3-PFJ4)) to perform collective licensing on their behalf. It provides a fair and effective way of collecting fees due to authors and publishers for the reproduction of their work. CLA licences permit the photocopying, scanning and e-mailing of articles from trade and consumer magazines, journals, books, law reports and press cuttings without having to seek permission from the copyright owner each time. As a matter of course, any organization that is likely to need legal access to such publications should get an appropriate CLA licence.

THE ELECTRONIC COMMUNICATIONS ACT 2000

The Electronic Communications Act, along with the Electronic Signatures Regulations 2002 and the Electronic Commerce Regulations 2002, is designed to regulate the use, within the United Kingdom, of cryptography and to make provision for the use of electronic signatures. Essentially, there are fall-back powers (not yet exercised) to create a central, statutory but voluntary register of approved providers of cryptography services in the

IT GOVERNANCE348

United Kingdom, and there are a number of regulations affecting how these approvals are given. The Act also provides for appropriately authenticated electronic signatures to be used in electronic commerce and allows for them to be admitted as evidence in court.

THE HUMAN RIGHTS ACT 1998

The Human Rights Act 1998 (HRA) was enacted in October 2000. It incor- porates into UK law the principles of the European Convention for the Protection of Human Rights and Fundamental Freedoms (the Convention). Most of the rights within the Convention are qualified, in so far as they are subject to limitations if the employer can show necessity to protect the rights and freedom of others. In particular, an employee could argue in a court or tribunal that monitoring or tapping of the employee’s work telephone or e-mail or internet activity by the employer was a breach of the employee’s rights under the Convention.

THE REGULATION OF INVESTIGATORY POWERS ACT 2000

Section 1 of the Regulation of Investigatory Powers Act 2000 (RIPA) makes it unlawful intentionally to intercept communications over a public or private telecommunications network without lawful authority. Section 3 allows a defence if it can be reasonably believed that both parties consented to the interception. The Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 were issued under the powers of the RIPA and these allow employers to monitor employee commu- nications where the employee has not given express consent, provided that the monitoring is for one or more of the following purposes. It should be carried out to:

● record evidence of business transactions;

● ensure compliance with regulatory or self-regulatory guidelines;

● maintain the effective operation of the employer’s systems;

● monitor standards of training and service;

● prevent or detect criminal activity;

● prevent the unauthorized use of computer or telephone systems (ensuring that the employer’s policies are not breached).

Employers also have to take reasonable steps to inform employees that their communications might be intercepted. This means that employers must

COMPLIANCE 349

introduce acceptable use policies (see Chapter 17) that set out for the employees the employer’s right to monitor such communications.

CODE OF PRACTICE

The Information Commissioner published a code of practice called ‘The use of personal data in employer/employee relationships’. This code is more restrictive than the Telecommunications (Lawful Business Practice) (Inter- ception of Communications) Regulations 2000 issued under the power of the RIPA. The code argues that the interception of personal electronic com- munications will almost certainly be covered by data protection principles. It says that unless the circumstances justify the additional intrusion, an employer should limit monitoring to traffic data rather than the contents of the communication, undertake spot checks rather than continuous mon- itoring, as far as possible, automate the monitoring so as to reduce the extent to which extraneous information is made available to any person other than the parties to a communication, and target monitoring to areas of highest risk.

While there will probably be a series of court and tribunal cases over the next few years that deal with the conflicts between the HRA, the RIPA and the code of practice, employers certainly need to introduce an acceptable use policy if they wish to be able to take legal or disciplinary action in respect of inappropriate employee behaviour.

Network and Information Security Directive

The EU’s Network and Information Security Directive requires member states to legislate for Critical National Infrastructure organizations to focus on the availability of crucial network and information systems. It became law in the UK on 10 May 2018. It affects operators of essential services (OES) and digital service providers (DSPs) that are established or which offer services within the EU. The regulations apply to large organizations and, apart from imposing cyber security obligations, the regulations also require an incident response process as well as incident notification. More detailed information is available on https://www.itgovernance.co.uk/nis- directive (archived at https://perma.cc/HU7R-ZG9F). ISO 27001 is an ideal standard for organizations implementing NIS; given that all such organiza- tions are also subject to GDPR, ISO 27001 can be used to create an integrated and compliant information security and incident response management system that is both cost effective and compliant.

IT GOVERNANCE350

US legislation

There is not yet any federal data protection legislation similar to that found in the EU or in countries such as Canada, Australia and South Africa. Most individual states have enacted their own laws around information security (eg 201.CMR.17, the Massachusetts law protecting personal information). Most of the individual states within the United States now have a data breach law, which sets out requirements and penalties for organizations that experience a breach that compromises personal information. A list of state data breach laws is maintained at www.ncsl.org/default.aspx?tabid=13489 (archived at https://perma.cc/VME6-DU6H). Work in the United States is also ongoing around the development of a National Office of Cyberspace and around the cyber security aspects of homeland security.

HIPAA

HIPAA, a US federal law passed originally in 1996, applies to health plans, healthcare clearinghouses and healthcare providers, which are known in the Act as ‘covered entities’. The Act requires healthcare organizations to protect – and keep up to date – their patients’ healthcare records (which includes patient account handling, billing and medical records), in order to stream- line health industry inefficiencies, reduce paperwork, make the detection and prosecution of fraud easier, and to enable workers to change jobs more easily, even if they have pre-existing medical conditions. The information security requirements of the Act are contained in Health Insurance Reform: Security Standards; Final Rule (45 CFR Parts 160, 162 and 164; 20 February 2003). This requires covered entities to ‘ensure the confidentiality, integrity, and availability of all electronic protected health information they create, receive, maintain, or transmit’ S 164.306(a)(1); to ‘protect against any reasonably anticipated threats or hazards to security or integrity of such information’ ibid (2), and to ‘protect against any reasonably anticipated uses or disclosures of such information that are not permitted’ ibid (3). The compliance date, for all covered entities with the exception of small health plans (which had an extra year) was 20 April 2005.

The Administrative Simplification (AS) Provisions state the specific rules that institutions must implement in order to comply with HIPAA; these include rules for EDI, for electronic signatures and standards of privacy. They are intended to be technology-independent and each institution is expected to deploy the technology it considers appropriate.

COMPLIANCE 351

The HITECH Act of 2009 was intended to accelerate the federal initia- tive for adoption of electronic health records (EHR) and extended the requirements of HIPAA to business associates of covered entities.

GLBA

GLBA, passed in 1999, applies to financial institutions and their service providers. The Financial Information Privacy Protection Act (to give it its full title) covers all US-regulated financial services corporations, and charges their boards with protecting their customers’ personal information against any ‘reasonably foreseeable’ threats to its security, confidentiality or integ- rity. GLBA also applies to a wide range of ‘non-bank’ managers and the Federal Trade Commission (FTC), which is responsible for enforcing the Act, requires compliance with both the letter and spirit of the Act. GLBA requires management to develop, draft, approve and implement an appro- priate information security program as part of their normal accountabilities. The information security requirements of the Act are contained in the Standards for Safeguarding Customer Information: Final Rule (16 CFR Part 314, May 23, 2002 – the rules issued by the other banking agencies are substantively identical). The rules relate to ‘nonpublic personal informa- tion’ which consists of ‘personally identifiable financial information’ and includes any information collected through a ‘cookie’. The purpose of GLBA is defined as setting standards for ‘developing, implementing, and main- taining reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of customer information’ S 314.1(a).

The GLBA Final Rule is explicit in requiring financial institutions to ‘identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compro- mise of such information’; to consider risks in each area of operations, particularly ‘information systems, including network and software design, as well as information processing, storage, transmission and disposal’, S314.4(a)(2); and to be responsible for ‘detecting, preventing and respond- ing to attacks, intrusions, or other systems failures’, S314.4(a)(3).

The interplay between regulatory regimes is exemplified in the statement that GLBA does not ‘modify, limit or supersede operation of the FRCA’, and does ‘not pre-empt any state law that provides greater protections’.

IT GOVERNANCE352

THE FAIR CREDIT REPORTING ACT (FCRA)

The FCRA was passed in 1999. It is designed to ‘promote accuracy and ensure the privacy of the information used in credit reports’, applies specifi- cally to consumer reporting agencies (such as credit bureaus) and is enforced by the FTC. It is underpinned by a range of state laws.

CAN-SPAM ACT

The CAN-SPAM Act (Controlling the Assault of Non-Solicited Pornography and Marketing Act) of 2003 set national standards for the sending of commercial e-mail and requires the Federal Trade Commission (FTC) to enforce its provisions. This act permits e-mail marketers to send unsolicited commercial e-mail as long as it contains: an opt-out mechanism, a function- ing return e-mail address, a valid subject line indicating it is an advertisement and the legitimate physical address of the mailer. The bill includes many other provisions, such as the formation of a national do-not-spam list, and the prohibition of certain e-mail address collection methods. The idea of a do-not-spam list was not a good one.

Many states have also enacted anti-spam laws, some of which prohibit sending unsolicited commercial e-mail to state residents unless they have specifically opted in to receive it.

Enforcement of legislation has been, in most jurisdictions, both weak and inconsistent. This is partly because enforcement is technologically difficult and partly because so much spam originates in jurisdictions beyond the control of any individual state. However, where authorities and affected organizations determine to take action, they do get results, as actions by various ISPs, by Microsoft, the jailing of a number of spammers and the April 2005 bankruptcy of the internet’s then third biggest spammer, all demonstrate.

The real anti-spam action, though, is being taken by individual organiza- tions. The most effective defences against spam are at the ISP level, the individual organization’s internet gateway, and the individual user’s anti- spam filters. These technological defences – which lead to the creation of ‘black’ and ‘white’ lists of e-mail marketers – are the key barriers now faced by any organization attempting legitimately to use e-mail marketing as part of its marketing mix. And e-mail marketing works, but it only works for reputable companies if they comply with the law and apply best practice. Your target customers have to trust you if they are going to put you on their e-mail marketing ‘white list’. These are all good reasons for the ISMS to deal effectively with both inbound and outbound e-mail marketing.

COMPLIANCE 353

FEDERAL INFORMATION SECURITY MANAGEMENT ACT (FISMA)

The E-Government Act, signed into law by the President in December 2002, recognized the importance of information security to the economic and national security interests of the United States. Title III of the E-Government Act, entitled the Federal Information Security Management Act (FISMA), required each federal agency to develop, document, and implement an agency-wide program to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by any other agency, contrac- tor, or other source.

FISMA, along with the Paperwork Reduction Act of 1995 and the Information Technology Management Reform Act of 1996, explicitly emphasized a risk-based policy for cost-effective security. In support of and reinforcing this legislation, the Office of Management and Budget (OMB) requires executive agencies within the federal government to:

● plan for security;

● ensure that appropriate officials are assigned security responsibility;

● periodically review the security controls in their information systems;

● authorize system processing prior to operations and, periodically, thereafter.

Contractual obligations

This clause of ISO27001 also covers contractual requirements. The Payment Card Industry Data Security Standard (PCI DSS) is an example of the type of security requirements that corporations might have to adopt as a result of contractual commitments, and therefore as part of organizational context and the baseline security controls. The five main payment card brands (Visa, MasterCard, Amex, JCB and Discover) collaborated on the development of a security standard (the PCI DSS) that they required all their merchants to accept, implement and provide evidence of successful compliance. The PCI requirements map to the controls of ISO/IEC 27001.

Intellectual property rights

Control 15.1.2 of ISO27002 says the organization should implement appropriate procedures to ensure compliance with legal restrictions on the

IT GOVERNANCE354

use of material to which intellectual property rights (IPR) might apply and on the use of proprietary software products.

Organizations deal with all sorts of third-party material, some of which may contain IPR in the form of copyright, design rights or trademarks. The CDPA is the cornerstone of copyright law in the United Kingdom. In the United States, the lay reader could begin an appreciation of the complexities of the subject by reference to the FAQs available from the United States Copyright Office (www.copyright.gov (archived at https://perma.cc/96BY- JTRN)) and the US Patent and Trademark Office (www.uspto.gov (archived at https://perma.cc/EJR5-HNYP)) and by reference to the DMCA itself: www.copyright.gov/legislation/dmca.pdf (archived at https://perma.cc/ Y8H9-XEVF).

Copyright infringement can lead to legal action even involving criminal proceedings if there has been a clear breach, in the United Kingdom, of the CDPA or, in the United States, of the DMCA. Organizations should there- fore adopt appropriate controls to avoid this happening. There are, broadly speaking, three controls that might be adopted.

The first is educational – ensuring that everyone in the organization understands the issues and takes action to avoid copyright infringement. Such an approach would require everyone to understand where the boundary between legal and illegal copying lies and what the requirements are, for instance, for identifying sources of information contained in new publications.

The second is simply to ban anyone in the organization from using any material that was not developed within the organization. This, while keep- ing the slate very clean, might be unnecessarily limiting, and the organization has to decide, in the light of a risk assessment, what its best course will be.

The third is to acquire appropriate licences from one or more of the licensing bodies that were described earlier in this chapter.

Software copyright

A most important issue in dealing with copyright is for the organization to ensure that it is not infringing the copyright of the suppliers of the software that it is using. Any software that is running on the organization’s network is potentially subject to copyright restrictions, and it is essential for the organization to ensure that it has the correct type and number of licences for this software.

There are two types of user licence. The first is known as a ‘per seat’ licence; the second is for ‘concurrent users’. ‘Per seat’ requires there to be a

COMPLIANCE 355

licence for every installation, or instance, of the software. Typically, Microsoft Office licences, for instance, are supplied on this basis. ‘Concurrent user’ allows for a maximum number of simultaneous users and is more normal for shared software, such as some database applications. This enables the client software to be installed on as many machines as is wished, but typi- cally the server software is set so that it will not allow more than the licensed number of users to work simultaneously. Different software packages are licensed on different bases, and the organization needs to be clear how each of its software packages is licensed and that it has paid for the correct number of licences.

There is also a wide range of ‘freeware’ available on the internet, which is software that can be downloaded subject to specific licence terms. It includes plug-ins such as Real Player, Macromedia Flash, etc. As these usually cannot be downloaded without the user accepting the licence conditions, there are not usually any licence-tracking issues here, although the organization ought to maintain a register of all such licences so as to ensure that their terms are being complied with. Wikipedia maintains a useful comparative list of open source licence terms at https://en.wikipedia.org/wiki/Comparison_of_ free_and_open-source_software_licenses (archived at https://perma.cc/ 49GU-A8VV).

Organizations need to maintain a register of software licences that lists all the licences they own as well as the purchase dates and, where appropri- ate, the disposal dates. Whenever a new PC is purchased, or added to the network, the register should be updated to reflect any additional software purchased or installed, and this requirement should be built into the change management documentation.

The organization should include in the access agreement signed by each member of staff before he or she is allowed to access any organizational computer a statement that only licensed and formally approved software may be used on the organization’s computers and that any use of illegally obtained or unlicensed software will lead to disciplinary action. The organi- zation will have to decide how to handle the wide range of freeware and shareware that is available across the internet. A risk assessment is the appropriate way to do this; maintaining a ban on the installation of freely downloadable software may be sensible, though it may not be cost-effective. This risk assessment needs to consider that allowing anyone to download whatever they want may result in non-business-related programs (including spyware and adware) appearing on the network and taking up valuable time, bandwidth and storage capacity. If these programs are then circulated

IT GOVERNANCE356

internally by e-mail, they could potentially cause a system crash as a result of system overload. This would be a security incident, as data required by the organization to pursue its objectives might become unavailable.

On a regular basis, the network administrator should carry out an audit of the software that is actually installed on the network PCs. This should be conducted at least annually, but experience shows that (particularly in fast- changing or growing networks) this could usefully be done as often as every quarter. These audits can be carried out by centralized network administra- tion software, and while this will deal with permanently connected PCs, it will be necessary to ensure that all notebooks are scanned on a regular basis as well. Records should be kept of these audits, demonstrating that all machines have been audited and showing what action, if any, has been taken to remove illegal software (or acquire additional licences where necessary) and to deal with offenders.

The Federation Against Software Theft (FAST – www.fast.org (archived at https://perma.cc/Z8MK-Y2FS)) was set up in 1984 by the British Computer Society’s Copyright Committee. It was the first software copy- right organization. It has concentrated on raising the awareness of software piracy and lobbying Parliament for changes to the Copyright Act 1956 to reflect the needs of software authors and publishers. It represents both soft- ware publishers and end users and has a long history of working with both sides of the copyright relationship to ensure that software is properly managed. Corporations can join FAST, which provides a range of services designed to assist them to manage software properly and to comply with the law. FAST offers advice, assistance and training; it also offers an audit certif- icate that recognizes that the organization concerned is managing its software properly. This certificate is not required for the achievement of ISO27001, but the membership services may be of benefit to organizations that have very complex and extensive software set-ups and, perhaps, a back- ground of inadequate management in this area. FAST says that there are many forms of software theft including:

‘Professional counterfeits – look the same as genuine boxed products

Quasi counterfeits – try to look like the genuine product but usually fail in the presentation

CD compilation disks – several programs copied onto one disk

Hard disk loaders – dealers who load a copy of software onto hardware but do not supply disks, licences, manuals and Certificates of Authenticity, etc

COMPLIANCE 357

Markets/Computer fairs – individuals selling obvious copies of computer programs

Peer to peer/IRC – individuals sharing software on the internet

Original equipment manufacturer (OEM) irregularity – software sold without a licence or the necessary hardware

Internet sites – downloading/uploading illegal software and utilities, down- loading legitimate freeware and shareware in breach of the licence

Unlicensed corporate use – number of installations exceeds number of licences, number of users able to access software on a server exceeds the number of licences, software transferred from one company to another outside terms of the licence, installation of employees’ own software onto company devices, different company name on opening screen etc.’

Anyone in the UK who decides to ‘blow the whistle’ on his or her employer for software infringement should be protected under the Public Interest Disclosure Act known as the ‘Whistle Blowers Act’. This Act includes three basic requirements:

● The employee believes that his or her employer is committing a criminal offence or a breach of civil law. Under-licensing falls within both these categories. The illegal use of software in a business, and a manager turning a blind eye to misuse, are both criminal offences. Software infringement such as buying one copy and using many is a civil infringement.

● The employee must believe that the disclosure is ‘substantially’ true, act in good faith and not make any personal gain. The Act has regard to the identity of the person to whom the disclosure is made. A complaint to FAST would be reasonable, whereas employees seeking a fee from a newspaper might not be on such safe ground.

● The employee’s disclosure was reasonable in all the circumstances. For instance, consideration should be given to whether the employee could have brought the matter to the attention of the company first without suffering detriment.

The implications of this should be clear for all organizations that are not already committed to complying with the existing software legislation. There is a very real risk that non-compliance will be exposed to FAST, to AAIPT or a similar organization, perhaps by a disgruntled current or former employee or competitor, with the potential consequences outlined above.

IT GOVERNANCE358

There are similar private organizations that are funded by the major soft- ware manufacturers to combat illegal use of software. They target organizations that they think may be using illegal software (which includes having more users of an off-the-shelf package than there are licences). There is no legal requirement to comply with their demands, and it is appropriate to take legal advice before responding to any demands that are made. It is always sensible, through the consistent application of an effective software copyright policy, to ensure that the organization is constantly able to demon- strate its compliance with the legislation and with the terms of any software licences.

Finally, organizations need to have an appropriate policy in place to deal with disposal of copyright material, which needs to be done in accordance with the licences.

Protection of organizational records

Control 18.1.3 of ISO27002 says the organization should protect its impor- tant records from loss, destruction or falsification. As ISO27002 explains, some records must be retained to meet statutory or regulatory requirements, while others may be needed to provide an adequate defence against poten- tial civil or criminal action or to prove the financial status of the organization to the range of potential interested parties, including shareholders, tax authorities and auditors, and to meet contractual liabilities. Records do not have to (and should not) be kept forever, which can make it difficult to find what is required as and when it is required.

Therefore, time limits should be set for the retention of individual catego- ries of information. After this time, records should be destroyed – in line with the procedure adopted by the organization to ensure that any confiden- tial information within those records is not inadvertently made public. Some time limits will be set by statute or regulation, and the organization should establish, with its legal advisers, what the current categories of documents and retention requirements are. In the United Kingdom, HM Revenue & Customs requirements should also be met. Other categories and retention periods should be set to meet the requirements of interested parties. The picture is similar for most companies in their local jurisdictions and much more complicated for multinational companies, or organizations operating in more than one jurisdiction.

Due consideration should be given to the possible degradation of media over time, and any manufacturer’s recommendations for storage should

COMPLIANCE 359

obviously be followed. There may be implications, in change programmes, for data stored on – or only accessible through – media that are being replaced; adequate resources may need to be retained to access this informa- tion throughout its designated retention period, and the need for this should be assessed at the outset of any IT change plan.

Where paper archive facilities are to be used, it is important to consider not only the physical security of the premises but also how watertight they are and what their fire defences are like. Consideration should be given to what the back-up plan would be in the case of the archive facilities themselves being the subject of destruction. Storage should be carefully planned and carried out; individual cartons or boxes should be clearly marked as to their contents, the owners of the contents, the date of storage and the planned date of destruction.

There needs to be an indexing system that enables the storage box for individual documents to be quickly identified and documents retrieved. The retrieval and document return process also needs to be tightly controlled to ensure that a neat archive system does not break down through use, with documents becoming increasingly difficult to find. Ideally, the organization should appoint someone to be responsible for the maintenance of the archive, and there should be clearly documented procedures, within the ISMS, about how to use the archive and also a regular audit to ensure that the records are being maintained in accordance with the procedure.

These same principles (retention schedule, data inventory, appropriate protective controls and clear allocation of responsibility) should be applied to information stored digitally or on microfiche. Where organizations have more than one medium for storage, there should be a master index and guidelines for how each type of data should be treated. Where digital data storage vaults are to be deployed, the organization will need to ensure that the technology enables it to meet its data storage responsibilities cost- effectively.

ISO 15489–1 provides further information about managing organiza- tional records, and, as it has been referenced by ISO27002, it would be worthwhile for any organization that has substantial record retention issues at least to be familiar with the guidance of this standard.

Privacy and protection of personally identifiable information

Control 18.1.4 of ISO27002 says the organization should develop and implement a data protection and privacy policy, applying controls to protect

IT GOVERNANCE360

personally identifiable information (PII) in accordance with relevant legisla- tion. Within the United Kingdom, this primarily means compliance with the DPA and the Privacy and Electronic Communications Regulations, although organizations operating internationally or globally are likely to be subject to other legislation in other countries, particularly US legislation, as identified earlier in this chapter. In these circumstances, specialist legal advice should be taken.

The DPA was outlined at the beginning of this chapter, and the Information Commissioner should accept the certification of an organization’s informa- tion security management system to ISO27001 as evidence that it does protect personal information in line with the legislation and applies ‘appro- priate security’. Registration with the Information Commissioner under the DPA is an absolute requirement, and there is no defence against a failure to do so, leaving an organization open to prosecution and fines.

Specific organizations, such as those processing high volumes of special categories of data, or those in the public sector, are legally required to appoint a data protection officer (DPO). The DPO can be either an employee or a contractor. Organizations that are not required to appoint a DPO will, given the complexity of the legislation and the potential liability, often do so. It is important to note that the GDPR forbids the appointment of DPOs that might have a conflict of interest; this tends to mean that those whose roles require them to determine the means and purposes of processing (such as, for instance, an information security manager) cannot also be the DPO.

In particular, organizations should be cognizant of the restrictions on transferring personal data to countries that are not within the European Union. This restriction is particularly important for organizations ‘offshor- ing’ any part of their customer support operations, or consolidating in a single location services previously delivered from multiple jurisdictions.

The EU–US Privacy Shield framework

This allows US corporations that are regulated by the Federal Trade Commission (FTC) and have operations in the EU to receive EU personal data. The Privacy Shield provides US organizations with a way to demon- strate a level of data protection that is not normally available under US Federal Law. The Privacy Shield compliance standards are certified through the Department of Commerce and enforced by the FTC; they are set out on the Commerce Department and FTC websites and carry Commerce Department certification. Only a small percentage of corporations have

COMPLIANCE 361

met a requirement that enables them to obtain EU member state (one year renewable) permission to transfer data out of the European Union. More information on the safe harbor framework is at https://www.export.gov/ safeharbor/eg_main_018236.asp (archived at https://perma.cc/3585- U2M4).

Regulation of cryptographic controls

Control 18.1.5 of ISO27002 says the organization should put in place controls to ensure compliance with any national agreements, laws, regula- tions or other requirements regarding the access to or use of cryptographic controls. This is because different countries have taken different steps to prevent the misuse of cryptography, including controls over the import and/ or export of hardware and software that have cryptographic capabilities, or that could have such capabilities added, and requirements as to ways in which authorities should be able to access information encrypted by par- ticular hardware or software. In the United Kingdom, relevant legislation includes the Electronic Communications Act 2000 (with the Electronic Signatures Regulations 2002 and the Electronic Commerce Regulations 2002) and the RIPA. There is also legislation that deals specifically with export/import restrictions on cryptography, including the Dual Use (Export Control) Regulations 2000.

Specialist legal advice should be taken to ensure that the organization is complying with the law as it currently stands, and where encrypted informa- tion or cryptographic equipment or controls are to be moved to another country, advice about that country should also be taken. It is worth consid- ering, by means of a risk assessment, the costs and benefits of implementing such a security approach.

Compliance with security policies and standards

Control objective 18.2 requires the organization to ensure that its systems comply with its policies and standards and that the security of its informa- tion systems is regularly reviewed against the policies and technical standards laid down for them. Control 18.2.1, Independent review of information security, was addressed in Chapter 4, Organizing information security.

IT GOVERNANCE362

Compliance with security policy and standards

Control 18.2.2 of ISO27002 says the organization’s managers should ensure that all security procedures within their areas of responsibility are carried out correctly; the organization also must ensure that all areas within the organization are subject to regular review to ensure that there is compliance with its documented security policies, procedures and standards. Clause 9.2 of ISO27001 (‘Internal ISMS audits’) sets out the broader requirement, and there should be a written procedure and an audit plan that describe how the audit process should be carried out. This will be essentially similar to an ISO9001 internal audit programme.

The first requirement is dealt with by including the responsibility for ensuring that security policies are complied with in the job description of all line managers. The real issue is for the organization to ensure that this is actually happening. The only effective way of ensuring management are doing their checks, as all ISO9001 organizations know, is through a programme of internal quality audits using appropriately trained staff or external consultants or other services providers. We recommend using the organization’s own staff for this role, as internal auditing provides them with a good developmental opportunity – not only in the direct training in audit skills but in gaining an understanding of how different functions of the organization interact and how their processes work. Auditors’ communica- tion skills become highly developed and their profiles are raised as a consequence of interviewing staff at all levels of the organization.

One or more members of each department throughout the organization should be encouraged to volunteer for basic internal auditor training (which is usually offered by consultancies or companies that provide ISO27001 accredited certification audit services) and should then receive internally whatever additional training they will need. They will not need a significant level of technical skill or competence. They should be able to undertake this audit activity in addition to their normal work, and this responsibility should be added to their existing job descriptions.

Staff should not out audits of their own departments or of areas that are the responsibility of their own line manager; they can carry out audits of other areas within the organization. The organization will need to have in place a method for ensuring that it trains up enough auditors to cover staff turnover, holidays and other absence, planned or unplanned. The informa- tion security adviser should plan the audit schedule at least a year ahead, and in conjunction with the existing internal quality department, so as to

COMPLIANCE 363

ensure that all areas are covered at least annually, that activities are coordi- nated and that there are no clashes or disruptions. A risk assessment might identify some areas as being in need of more frequent audit (the areas where the organization has most risk), and this should also be factored in.

Audits should be documented, with nonconformities identified in writ- ing. Managers are expected to determine the cause of nonconformities, determine appropriate actions including the need to prevent recurrence, implement the decision and review its effectiveness. These action plans for rectification, together with dates and responsibilities, should be documented, and the information security adviser (or internal quality function) should have a system for ensuring that all due dates are achieved or otherwise followed up as appropriate. All nonconformities, together with action plans and status (ie showing which are closed and which not), should be reported to the regular meetings of the information security committee (see Chapter 4), together with an analysis of trends or assessment of larger threats that might not be immediately apparent at the individual incident level. These internally identified nonconformities and the results of corrective action should be available to external auditors when they carry out their review of the ISMS.

Sensibly, the nonconformities raised by any external auditor should be integrated into the organization system and receive numbers (usually in addition to the numbers given by the external auditor) that tie them into the existing continual improvement system for purposes of monitoring and analysis.

Technical compliance review

Control 18.2.3 of ISO27002 says the organization should regularly perform independent checks of its information systems to ensure that they comply with their documented security requirements and that the required hard- ware and software controls have been correctly implemented and maintained. This applies to network protection hardware and software (firewalls, rout- ers) as well as to network resources (servers, user settings, access policies, etc). There should be a plan for these checks (which should be repeatable and documented) and they should be carried out as often as a risk assess- ment indicates is necessary. ISO/IEC 27008 provides guidance for auditing security controls. These checks should be carried out by someone who has the necessary technical skills and certainly not by those responsible for implementing the control in the first place.

IT GOVERNANCE364

Specialist assistance is required, and it can be obtained from any one of the security organization that has a security (penetration) testing offering. Some checking will have to be done manually by a trained tester; other checking can be done using automated software tools and the resulting reports can later be analysed by a trained tester. This type of checking includes intrusion or penetration testing of network defences. ISO27002 cautions that penetration testing should be carried out carefully, as it could lead to a system compromise. In practice, penetration testing has become one of the most important forms of technical compliance, as it identifies vulnerabilities that might be exploited by outside attackers.

A number of organizations should be approached with a schedule of the technical checking that will be required, and competitive prices obtained. References should be investigated thoroughly. The contract in place with any organization retained to do this sort of security checking should, of course, conform to the organizations standard requirements, and there should be particular consideration of how the contractor will be required to report vulnerabilities, so as to ensure that all that are detected are reported.

All nonconformities established under this process should be reported in accordance with the nonconformities procedure discussed earlier in this chapter and should be subject to the same level of monitoring, analysis and follow-up as any others.

Information systems audit considerations

Control 12.7.1 sets out how the organization should prepare for informa- tion systems audits (which might or might not) include technical compliance checking, as well as audits of, for example, licences and software installa- tions. Essentially, says ISO27002, such audits should be scheduled so they don’t interrupt business activity. In principle, of course, any audit interrupts business activity and therefore, the implementation of this control should be aimed at minimizing disruption and selecting periods of low or reduced activity and/or demand for carrying out any audit. Moreover, testing should be controlled, testers should preferably be limited to read-only access, and all testing logs should be controlled.