Procedures for regular monitoring, analysis and evaluation a. Data protection management Data protection management Requirement Status References Data protection management system for the protection of Personal Data Data protection officer The organization has appointed a Security Manager who reports directly to executive management. The Security Manager’s role includes responsibility for data protection. • Information Security Policy Data protection policies The organization maintains appropriate information security policies that include provisions for data protection. • Information Security Policy • Access Control Policy • Data Retention and Disposal Policy • Internal Privacy Policy • Privacy Policy for Websites • Risk Assessment Policy • Server Security Policy • Vulnerability and Penetration Testing Management Policy Employees are required to review the policies on an annual basis as part of the organization’s security program. Continual improvement process for data protection and information security The organization maintains an effective information security management system. Policies and controls are reviewed on a regular basis. This ensures the technical and organizational measures will be checked on a regular basis and improvements will be tracked and documented. • Information Security Policy Auditing of data protection measures Control implementation status and effectiveness is reviewed during internal audits. Executive management reviews policies on a regular basis. Risk assessments are conducted on a regular basis. • Information Security Policy
