An ideal introduction and a quick reference to PCI DSS version 3.1 All businesses that accept payment cards are prey for hackers and criminal gangs trying to steal financial information and commit identity fraud. The PCI DSS (Payment Card Industry Data Security Standard) exists to ensure that businesses process credit and debit card orders in a way that protects cardholder data effectively. All organisations that accept, store, transmit or process cardholder data must comply with the Standard; failure to do so can have serious consequences for their ability to process card payments. Product overview Co-written by a PCI QSA (Qualified Security Assessor) and updated to cover PCI DSS version 3.1, this handy pocket guide provides all the information you need to consider as you approach the PCI DSS. It is also an ideal training resource for anyone in your organisation who deals with payment card processing. Coverage includes: An overview of Payment Card Industry Data Security Standard v3.1. A PCI self-assessment questionnaire (SAQ). Procedures and qualifications. An overview of the Payment Application Data Security Standard. Contents 1.What is the Payment Card Industry Data Security Standard (PCI DSS)? 2.What is the Scope of the PCI DSS? 3.Compliance and Compliance Programmes 4.Consequences of a Breach 5.How do you Comply with the Requirements of the Standard? 6.Maintaining Compliance 7.PCI DSS - The Standard 8.Aspects of PCI DSS Compliance 9.The PCI Self-Assessment Questionnaire 10.Procedures and Qualifications 11.The PCI DSS and ISO/IEC 27001 12.The Payment Application Data Security Standard (PA-DSS) 13.PIN Transaction Security (PTS) About the authors Alan Calder is the founder and executive chairman of IT Governance Ltd, an information, advice and consultancy firm that helps company boards tackle IT governance, risk management, compliance and information security issues. He has many years of senior management experience in the private and public sectors. Geraint Williams is a knowledgeable and experienced senior information security consultant and PCI QSA, with a strong technical background and experience of the PCI DSS and security testing. Geraint has provided consultancy on implementation of the PCI DSS, and conducted audits with a wide range of merchants and service providers. He has performed penetration testing and vulnerability assessments for various clients. Geraint leads the IT Governance CISSP Accelerated Training Programme, as well as the PCI Foundation and Implementer training courses. He has broad technical knowledge of security and IT infrastructure, including high performance computing, and Cloud computing. His certifications include CISSP, PCI QSA, CREST Registered Tester, CEH and CHFI."

When is a gift not a gift? When it's a bribe. For many, corporate hospitality oils the wheels of commerce. But where do you draw the line? Bribes, incentives and inducements are not just a matter of used banknotes stuffed in brown envelopes. Expenses, corporate settlement of personal bills, gifts and hospitality can all be used to influence business partners, clients and contractors. Can you afford unlimited fines? Under the Bribery Act 2010, a maximum of ten years' imprisonment and an unlimited fine may be imposed for offering, promising, giving, requesting, agreeing, receiving or accepting bribes. With such strict penalties, it's astonishing that so few companies have few or no measures in place to ensure that they are not liable for prosecution. This is especially astonishing as the Ministry of Justice's Quick start guide to the Bribery Act makes it clear that "There is a full defence if you can show you had adequate procedures in place to prevent bribery." Such procedures can be found in BS 10500:2010, the British Standard for anti-bribery management systems (ABMSs). How to implement an ABMS An Introduction to Anti-Bribery Management Systems (BS 10500) explains how to implement an ABMS that meets the requirements of BS 10500, from initial gap analysis to due diligence management: * An introduction to BS 10500 * An explanation of an ABMS * Management processes within an ABMS * Implementing an ABMS * Risk assessment in due diligence * Whistleblowing and bribery investigations * Internal auditing and corrective action * Certification to BS 10500 It provides helpful guidance on the importance of clearly defining policies; logging gifts and hospitality in auditable records; ensuring a consistent approach across the organisation; controls for contractors; facilitation payments; charitable and political donations; risk assessment in due diligence; whistle-blowing and bribery investigations; and internal auditing and corrective action. Meet the stringent requirements of the Bribery Act Not only will a BS 10500-compliant ABMS help your organisation prove its probity by meeting the stringent requirements of the Bribery Act, it can also be adapted to most legal or compliance systems. An ethical approach to business is not just a legal obligation but a way to protect your reputation. About the author Alan Field, MA, LL.B (Hons), PgC, MCQI CQP, MIIRSM, AIEMA, GIFireE, GradIOSH is a Chartered Quality Professional, an IRCA Registered Lead Auditor and member of the Society of Authors. Alan has particular expertise in auditing and assessing anti-bribery management systems to BS 10500 and public-sector counter-fraud systems to ISO9001. Alan has many years' experience with quality and integrated management systems in the legal, financial, property services and project management sectors in auditing, assessment and gap analysis roles. Your company's integrity is important. An Introduction to Anti-Bribery Management Systems (BS 10500) shows you how to maintain and prove it.

A global perspective on AI This book will provide a global perspective on AI and the challenges it represents, and will focus on the digital ethics surrounding AI technology.

This book is about cyber security. In Part 1, the author discusses his thoughts on the cyber security industry and how those that operate within it should approach their role with the mindset of an artist. Part 2 explores the work of Sun Tzu's The Art of War.

An accessible introduction to the most prevalent cyber threats in our current climate, this book discusses cyber terrorism, phishing, and ransomware attacks, and provides advice on how to mitigate such threats in our personal and professional lives.

Take the first steps to ISO 14001 certification with this practical overview. This book provides practical advice on how to achieve compliance with ISO 14001:2015, the international standard for an EMS (environmental management system). With an EMS certified to ISO 14001, you can improve the efficiency of your business operations and fulfil compliance obligations, while reassuring your employees, clients and other stakeholders that you are monitoring your environmental impact. This easy-to-follow guide takes a step-by-step approach, and provides many sample documents to help you understand how to record and monitor your organisation's EMS processes. Ideal for compliance managers, IT and general managers, environmental officers, auditors and trainers, this book will provide you with: The confidence to plan and design an EMS. Detailed descriptions of the ISO 14001:2015 requirements will give you a clear understanding of the standard, even if you lack specialist knowledge or previous experience; Guidance to build stakeholder support for your EMS. Information on why it is important for an organisation to have an environmental policy, and a sample communications procedure will help you to raise awareness of the benefits of implementing an EMS; and Advice on how to become an ISO 14001-certified organisation. The book takes a step-by-step approach to implementing an 1SO 14001-compliant EMS. Key features: A concise summary of the ISO 14001:2015 requirements and how you can meet them. An overview of the documentation needed to achieve ISO 14001:2015 accreditation. Sample documents to help you understand how to record and monitor your organisation's environmental management processes. New for the second edition: Updated for ISO 14001:2015, including terms, definitions and references; Revised approach to take into account requirements to address "risks and opportunities". Your practical guide to implementing an EMS that complies with ISO 14001:2015 - buy this book today to get the help and guidance you need!

The EU Data Protection Code of Conduct for Cloud Service Providers - A guide to complianceFormally founded in 2017, the EU Data Protection Code of Conduct for Cloud Service Providers (otherwise known as the EU Cloud Code of Conduct; the Code) is a voluntary code of conduct created specifically to support GDPR compliance within the B2B (business-to-business) Cloud industry. The EU Commission, the Article 29 Working Party (now the European Data Protection Board (EDPB)), the EU Directorate-General for Justice and Consumers, and Cloud-industry leaders have all contributed to its development, resulting in a robust framework that recognises the unique requirements of the Cloud industry. Cloud providers must ensure that their services - which by design involve accessing and transferring data across the Internet, exposing it to far greater risk than data stored and processed within an organisation's internal network - meet or exceed the GDPR's requirements in order to provide the security and privacy that the market expects. Organisations can achieve this via compliance to the EU Cloud Code of Conduct. The EU Cloud Code of Conduct has already been adopted by major Cloud service organisations, including: Microsoft; Oracle; Salesforce; IBM; Google Cloud; Dropbox; and Alibaba Cloud. Public and business focus on information security and data protection continues to increase in the face of a constantly changing threat landscape and ever-more stringent regulation, and compliance to initiatives such as the EU Cloud Code of Conduct demonstrates to current and potential customers that your organisation is taking data privacy seriously, as well as strengthens your organisation's overall approach to information security management, and defences against data breaches. The EU Data Protection Code of Conduct for Cloud Service Providers provides guidance on how to implement the Code within your organisation. It explores the objectives of the Code, and how compliance can be achieved with or without a pre-existing ISMS (information security management system) within the organisation. Begin your journey to EU Cloud Code of Conduct implementation with our guide to compliance - Buy this book today!

Why do projects fail?The people who plan and execute major projects are often highly skilled and highly regarded. They are not obviously incompetent. Where a project uses external suppliers or contractors as a significant support to project delivery, the risk of a fundamental failure seems to escalate. Is this a failure of project management? A failure of procurement? A failure of both? Or are there other factors at play? This book aims to be a self-help manual. It will enable you to improve your personal and corporate performance. It will also help you ensure that the sub-system elements of a project, where there are 'interfaces' between systems that need to 'talk' to each other, will be effectively managed - with no nasty surprises. Buying and integrating advanced technologyRight First Time - Buying and integrating advanced technology for project success does not pretend to hold the key to a 'nirvana' of project delivery. Rather, it gets straight to the point about buying - and integrating - advanced technology. It recognises that integrating sub-systems is fertile ground for failure and that effective procurement is increasingly important in project delivery. The failure of one sub-system can undermine an entire project, and the integration of sub-components is all too often assumed to be a technical problem that 'technical people' will overcome. Few projects make integration a defined subset of the overall project plan, yet most will benefit from doing so. A project management playbookA management book rather than a technical book, Right First Time - Buying and integrating advanced technology for project success focuses on the difficult issue of sub-system integration in the context of third-party (supply) relationships. If you are responsible for project management and practical delivery, at senior or junior level, it provides lots of practical questions to help you work through the issues, acting as a catalyst for supplementary questions and lines of investigation, focusing on potential problem areas relevant to your own context. Powerful learning outcomes and self-reflective questions at the end of each chapter enable you to create key action points and assess your organisation's approach to improve project management governance and ensure you get it right first time. Project managers, procurement managers, business change managers, commercial managers, mobilisation/transition managers, product managers and contract managers will all find value in this comprehensive guide to managing sub-system integration for project success.

The CCPA (California Consumer Privacy Act) is a data privacy law that took effect on January 1, 2020. It applied to businesses that collect California residents' personal information, and its privacy requirements are similar to those of the GDPR (General Data Protection Regulation). On May 4, 2020, Californians for Consumer Privacy (an advocacy group, founded by Alistair MacTaggart) announced that it had collected more than 900,000 signatures to qualify the CPRA (California Privacy Rights Act) for the November 2020 ballot. Also known as 'CCPA 2.0', the CPRA enhances privacy protections established by the CCPA and builds on consumer rights. CPRA effectively replaces the CCPA and bolsters privacy protections for California consumers. While many elements of the two laws are similar, there are some striking differences that could impact CPRA implementation plans, including: Limiting deletion rights that apply to unstructured data A new right to data minimization with retention requirements related to personal data New definitions and obligations related to cross-context behavioral advertising Amending breach liability to include an email address in combination with a password or security question Establishing a new regulatory enforcement body: the California Privacy Protection Agency Organizations that fail to comply with the CPRA's requirements are subject to civil penalties of up to $7,500 and a civil suit that gives every affected consumer the right to seek between $100 and $750 in damages per incident, or actual damages if higher. The law is complex and requires careful reading to understand the actual requirements for organizations - The California Privacy Rights Act - An implementation and compliance guide is here to help you. Ensure your business is CPRA compliant with essential guidanceThis book is your ideal resource for understanding the CPRA and how you can implement a strategy to ensure your organization complies with the legislation. It will give you a comprehensive understanding of the legislation by providing definitions of key terms, explanations of the security requirements, details of the breach notification procedure, and covering the penalties for noncompliance. The California Privacy Rights Act - An implementation and compliance guide is essential reading for anyone with business interests in the state of California. Not only does it serve as an introduction to the legislation, it also discusses the challenges a business may face when trying to achieve CPRA compliance. It gives you the confidence to begin your CPRA compliance journey, while highlighting the potential ongoing developments of the CPRA. Buy this book and start implementing your CPRA compliance strategy today!

The fastest-growing malware in the world The core functionality of ransomware is two-fold: to encrypt data and deliver the ransom message. This encryption can be relatively basic or maddeningly complex, and it might affect only a single device or a whole network. Ransomware is the fastest-growing malware in the world. In 2015, it cost companies around the world $325 million, which rose to $5 billion by 2017 and is set to hit $20 billion in 2021. The threat of ransomware is not going to disappear, and while the number of ransomware attacks remains steady, the damage they cause is significantly increasing. It is the duty of all business leaders to protect their organisations and the data they rely on by doing whatever is reasonably possible to mitigate the risk posed by ransomware. To do that, though, they first need to understand the threats they are facing. The Ransomware Threat Landscape This book sets out clearly how ransomware works, to help business leaders better understand the strategic risks, and explores measures that can be put in place to protect the organisation. These measures are structured so that any organisation can approach them. Those with more resources and more complex environments can build them into a comprehensive system to minimise risks, while smaller organisations can secure their profiles with simpler, more straightforward implementation. Suitable for senior directors, compliance managers, privacy managers, privacy officers, IT staff, security analysts and admin staff - in fact, all staff who use their organisation's network/online systems to perform their role - The Ransomware Threat Landscape - Prepare for, recognise and survive ransomware attacks will help readers understand the ransomware threat they face. From basic cyber hygiene to more advanced controls, the book gives practical guidance on individual activities, introduces implementation steps organisations can take to increase their cyber resilience, and explores why cyber security is imperative. Topics covered include: Introduction About ransomware Basic measures An anti-ransomware The control framework Risk management Controls Maturity Basic controls Additional controls for larger organisations Advanced controls Don't delay - start protecting your organisation from ransomware and buy this book today!

In the world as we know it, you can be attacked both physically and virtually. For today's organisations, which rely so heavily on technology - particularly the Internet - to do business, the latter is the far more threatening of the two. The cyber threat landscape is complex and constantly changing. For every vulnerability fixed, another pops up, ripe for exploitation. This book is a comprehensive cyber security implementation manual which gives practical guidance on the individual activities identified in the IT Governance Cyber Resilience Framework (CRF) that can help organisations become cyber resilient and combat the cyber threat landscape. Suitable for senior directors (CEO, CISO, CIO), compliance managers, privacy managers, IT managers, security analysts and others, the book is divided into six parts: Part 1: Introduction. The world of cyber security and the approach taken in this book. Part 2: Threats and vulnerabilities. A discussion of a range of threats organisations face, organised by threat category, to help you understand what you are defending yourself against before you start thinking about your actual defences. Part 3: The CRF processes. Detailed discussions of each of the 24 CRF processes, explaining a wide range of security areas by process category and offering guidance on how to implement each. Part 4: Eight steps to implementing cyber security. Our eight-step approach to implementing the cyber security processes you need and maintaining them. Part 5: Reference frameworks. An explanation of how standards and frameworks work, along with their benefits. It also presents ten framework options, introducing you to some of the best-known standards and giving you an idea of the range available. Part 6: Conclusion and appendices. The appendices include a glossary of all the acronyms and abbreviations used in this book. Whether you are just starting out on the road to cyber security or looking to enhance and improve your existing cyber resilience programme, it should be clear that cyber security is no longer optional in today's information age; it is an essential component of business success. Make sure you understand the threats and vulnerabilities your organisation faces and how the Cyber Resilience Framework can help you tackle them. Start your journey to cyber security now - buy this book today!

Understand your GDPR obligations and prioritise the steps you need to take to comply The GDPR gives individuals significant rights over how their personal information is collected and processed, and places a range of obligations on organisations to be more accountable for data protection. The Regulation applies to all data controllers and processors that handle EU residents' personal information. It supersedes the 1995 EU Data Protection Directive and all EU member states' national laws that are based on it - including the UK's DPA (Data Protection Act) 1998. Failure to comply with the Regulation could result in fines of up to 20 million or 4% of annual global turnover - whichever is greater. This guide is a perfect companion for anyone managing a GDPR compliance project. It provides a detailed commentary on the Regulation, explains the changes you need to make to your data protection and information security regimes, and tells you exactly what you need to do to avoid severe financial penalties. Clear and comprehensive guidance to simplify your GDPR compliance project Now in its fourth edition, EU General Data Protection Regulation (GDPR) - An implementation and compliance guide provides clear and comprehensive guidance on the GDPR. It explains the Regulation and sets out the obligations of data processors and controllers in terms you can understand. Topics covered include: The DPO (data protection officer) role, including whether you need one and what they should do; Risk management and DPIAs (data protection impact assessments), including how, when and why to conduct one; Data subjects' rights, including consent and the withdrawal of consent, DSARs (data subject access requests) and how to handle them, and data controllers and processors' obligations; Managing personal data internationally, including updated guidance following the Schrems II ruling; How to adjust your data protection processes to comply with the GDPR, and the best way of demonstrating that compliance; and A full index of the Regulation to help you find the articles and stipulations relevant to your organisation. Supplemental material While most of the EU GDPR's requirements are broadly unchanged in the UK GDPR, the context is quite different and will have knock-on effects. You may need to update contracts regarding EU-UK data transfers, incorporate standard contractual clauses into existing agreements, and update your policies, processes and procedural documentation as a result of these changes. We have published a supplement that sets out specific extra or amended information for this pocket guide. Click here to download the supplement. About the authors The IT Governance Privacy Team, led by Alan Calder, has substantial experience in privacy, data protection, compliance and information security. This practical experience, their understanding of the background and drivers for the GDPR, and the input of expert consultants and trainers are combined in this must-have guide to GDPR compliance. Start your compliance journey now and buy this book today.

The Universal Service Desk (USD) - Implementing, controlling and improving service delivery defines what a USD is, why it is valuable to an organisation and how to build and implement one. It also discusses the evolution of the USD as part of integrated workplace management. Understand the essentials of any USD - buy this book today!

Securing Cloud Services - A pragmatic guide gives an overview of security architecture processes and explains how they may be used to derive an appropriate set of security controls to manage the risks associated with working in the Cloud. Manage the risks associated with Cloud computing - buy this book today!

Cyber Security - Essential principles to secure your organisation takes you through the fundamentals of cyber security, the principles that underpin it, vulnerabilities and threats, and how to defend against attacks. Organisations large and small experience attacks every day, from simple phishing emails to intricate, detailed operations masterminded by criminal gangs, and for every vulnerability fixed, another pops up, ripe for exploitation. Cyber security doesn't have to cost vast amounts of money or take a short ice age to implement. No matter the size of your organisation, improving cyber security helps protect your data and that of your clients, improving business relations and opening the door to new opportunities. This pocket guide will take you through the essentials of cyber security - the principles that underpin it, vulnerabilities and threats and the attackers who use them, and how to defend against them - so you can confidently develop a cyber security programme. Cyber Security - Essential principles to secure your organisation Covers the key differences between cyber and information security; Explains how cyber security is increasingly mandatory and how this ties into data protection, e.g. the Data Protection Act 2018 and the GDPR (General Data Protection Regulation); Focuses on the nature of the problem, looking at technical, physical and human threats and vulnerabilities; Explores the importance of security by design; Gives guidance on why security should be balanced and centralised; and Introduces the concept of using standards and frameworks to manage cyber security. No matter the size of your organisation, cyber security is no longer optional - it is an essential component of business success and a critical defence against the risks of the information age. The only questions left are to decide when and where your journey will begin. Start that journey now - buy this book today!

ISO/IEC 27701:2019: An introduction to privacy information management offers a concise introduction to the Standard, aiding those organisations looking to improve their privacy information management regime, particularly where ISO/IEC 27701:2019 is involved.

ISO 50001 - A strategic guide to establishing an energy management system provides a practical but strategic overview for leadership teams of what an EnMS (energy management system) is and how implementing one can bring added value to an organisation.

Summary Explains in easy-to-understand terms what executives and senior managers need to know and do about the ever-changing cyber threat landscape. Gives strategic, business-focused guidance and advice relevant to C-suite executives. Provides an effective and efficient framework for managing cyber governance, risk and compliance. Explains what is required to implement an effective cyber security strategy. Description With high-profile cyber attacks, data breaches and fines for GDPR (General Data Protection Regulation) non-compliance hitting the headlines daily, businesses must protect themselves and their reputations, while reassuring stakeholders they take cyber security seriously. Cyber attacks are becoming more sophisticated and prevalent, and the cost of data breaches is soaring. In addition, new regulations and reporting requirements make cyber security a critical business issue. Board members and senior management must understand the threat landscape and the strategies they can employ to establish, implement and maintain effective cyber resilience throughout their organisation. How Cyber Security Can Protect your Business - A guide for all stakeholders provides an effective and efficient framework for managing cyber governance, risk and compliance, which organisations can adapt to meet their own risk appetite and synchronise with their people, processes and technology. It explains what is meant by governance, risk and compliance, how it applies to cyber security and what is required to implement an effective cyber security strategy. The pocket guide: Gives readers a greater understanding of cyber governance, risk and compliance; Explains what executives, senior managers and their advisors need to know and do about the ever-changing cyber threat landscape; Provides context as to why stakeholders need to be aware of and in control of their organisation's cyber risk management and cyber incident response; Gives guidance on building an appropriate and efficient governance framework that enables organisations to demonstrate their cyber approach in a non-technical, strategic, business-focused way; Details an overview process to enable risk assessment, assess existing defence mitigations and provide a framework for developing suitable controls; and Includes a checklist to help readers focus on their higher-priority cyber areas. Suitable for all managers and executives, this pocket guide will be of interest to non-cyber specialists, including non-executive directors, who may be required to review cyber arrangements. For cyber specialists, it provides an approach for explaining cyber issues in non-jargonistic, business-based language. Kick-start your journey to becoming cyber secure - buy this pocket guide today!

This useful pocket guide is an ideal introduction for those wanting to understand more about ISO 38500. It describes the scope, application and objectives of the Standard and outlines its six core principles.

A must-have resource for anyone looking to establish, implement and maintain an ISMS. Ideal for information security managers, auditors, consultants and organisations preparing for ISO 27001 certification, this book will help readers understand the requirements of an ISMS (information security management system) based on ISO 27001. Similarly, for anyone involved in internal or external audits, the book includes the definitive requirements that auditors must address when certifying organisations to ISO 27001. The book covers: Implementation guidance - what needs to be considered to fulfil the requirements of the controls from ISO/IEC 27001, Annex A. This guidance is aligned with ISO/IEC 27002, which gives advice on implementing the controls; Auditing guidance - what should be checked, and how, when examining the ISO/IEC 27001 controls to ensure that the implementation covers the ISMS control requirements. The implementation guidance gives clear descriptions covering what needs to be considered to achieve compliance against the requirements, with examples given throughout. The auditing guidance covers what evidence an auditor should look for in order to satisfy themselves that the requirement has been met. Useful for internal auditors and consultants, the auditing guidance will also be useful for information security managers and lead implementers as a means of confirming that their implementation and evidence to support it will be sufficient to pass an audit. This guide is intended to be used by those involved in: Designing, implementing and/or maintaining an ISMS; Preparing for ISMS audits and assessments; or Undertaking both internal and third-party ISMS audits and assessments About the author Bridget Kenyon (CISSP) is global CISO for Thales eSecurity. Her experience in information security started in 2000 with a role in network vulnerabilities at DERA, following which she has been a PCI Qualified Security Assessor, information security officer for Warwick University and head of information security for UCL, and has held a variety of roles in consultancy and academia. Bridget has been contributing to international standards since 2006, when she first joined BSI Panel 1, coordinating development of information security management system standards; she is currently editor for ISO/IEC 27014. Bridget has also co-authored three textbooks on information security. She strongly believes that "information security is fundamental to reliable business operations, not a nice-to-have". In 2018, she was named one of the top 25 women in tech by UK publication PCR.

This pocket guide is perfect as a quick reference for PCI professionals, or as a handy introduction for new staff. It explains the fundamental concepts of the latest iteration of the PCI DSS, v3.2.1, making it an ideal training resource. It will teach you how to protect your customers' cardholder data with best practice from the Standard.