{"text_format":"3","workbook":"xlsx","n_sheets":4,"sheets":["Del 1. - Indledende spørgsmål","Del 2. Emnerspørgsmål","Del 3. Emnespørgsmål","Svar muligheder"],"read":"whole","date_system":"1900"}

{"sheet":"Del 1. - Indledende spørgsmål","index":0,"n_rows":9,"n_cols":5,"rows_kept":9,"merged":[[1,0,7,0]]}
["Topics","#","Questions","Guidance texts","Answer options for Master Data and Activities (select from drop-down menu)"]
["0. Basic Information",0.1,"Organisation’s company registration number","The information has been retrieved from CVR (www.cvr.dk) and cannot be changed.",44650975]
[null,{"$f":"+B2+0.1","v":0.2},"Organisation’s Industry code","The information has been retrieved from CVR (www.cvr.dk) and cannot be changed.","582900 Other software publishing"]
[null,0.30000000000000004,"Number of employees in the organisation","The information has been retrieved from CVR (www.cvr.dk) and cannot be changed.",4]
[null,{"$f":"+B4+0.1","v":0.4},"Legal form of the organisation","The information has been retrieved from CVR (www.cvr.dk) and cannot be changed.","Private limited company (Ltd.)"]
[null,0.5,"Is the organisation part of a group?","A group is an organisational structure consisting of several independent entities, one of which, the parent company, can control the others through majority ownership or board positions.","no"]
[null,0.6,"Is the organisation established in countries outside Denmark, but within the EU?","This particularly refers to departments, shops, premises, or similar from which business activities are conducted.","yes"]
[null,0.7,"Is the organisation established in countries outside the EU?","By ‘responsible’, this refers to whether one or more specific persons or a specific department has been expressly designated to report personal data security breaches to the Danish Data Protection Agency.","no"]
[null,{"$f":"+A10+0.1","v":0.1},"Has the organisation appointed a responsible person to report personal data security breaches? Select one of the specified job functions.","By ‘responsible’, this refers to whether one or more specific persons or a specific department has been expressly designated to report personal data security breaches to the Danish Data Protection Agency.","External consultant"]

{"sheet":"Del 2. Emnerspørgsmål","index":1,"n_rows":23,"n_cols":8,"rows_kept":23,"merged":[[1,0,8,0],[9,0,17,0],[18,0,22,0]]}
["Topics","#","Questions","Guidance texts","Has the organisation considered compliance with obligations in this area?","If “No” or “Not relevant” is answered in column F, a short justification must be provided here","Is there documentation for the consideration?","Relevant references"]
["1. Aktiviteter","1,10","Has the organisation appointed a person responsible for information security?","As ‘responsible for information security’, an organisation would typically appoint an IT manager, digitalisation manager, CISO or CTO, but this does not exclude the responsibility being placed with other employees.","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","ISO 27001 - A.6.1.1\n\nISO 27002 - 6.1.1"]
[null,{"$f":"+B2+0.01","v":1.11},"Has the organisation appointed a Data Protection Officer (DPO)?","A ‘Data Protection Officer’ carries out tasks and provides advice regarding data protection law.","No","Article 37(1)(a): Processing is not carried out by a public authority or body, as [Insert client] is a privately owned company.\nArticle 37(1)(b): [Insert client]’s core activities do not, by their nature, scope and/or purpose, require regular and systematic monitoring of data subjects on a large scale.\nArticle 37(1)(c): [Insert client]’s core activities do not consist of large-scale processing of special categories (Article 9) or personal data relating to criminal convictions and offences referred to in Article 10.\nThe above is reviewed on an ongoing basis, and appropriate measures will be implemented if necessary.","N/A","General Data Protection Regulation (GDPR) art 37., 39."]
[null,{"$f":"+B3+0.01","v":1.12},"Does the organisation follow one or more management-approved standards for information security?","An ‘information security standard’ is normally a framework tool organisations can use to ensure that their information security work is comprehensive. Commonly used standards include ISO 2700x, ISAE, COBIT and NIST.\nStandards can be found here:\n\nhttps://www.iso.org/isoiec-27001-information-security.html\n\nhttps://www.isaca.org/resources/cobit\n\nhttps://www.nist.gov/cyberframework","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","ISO 27002 - 18.2.2"]
[null,{"$f":"+B4+0.01","v":1.1300000000000001},"Has the organisation prepared a record (register) of processing activities carried out on behalf of a controller?","A ‘record’ of processing activities is a written and electronic overview that gives the organisation an overview of the personal data it processes, including the purposes. Further information on the record requirements can be found in the Danish Data Protection Agency’s guidance: https://www.datatilsynet.dk/media/6567/fortegnelse.pdf","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","General Data Protection Regulation (GDPR) art 30. ISAE3000 KM E and F"]
[null,1.1400000000000001,"Is the record updated periodically?","‘Periodically’ means an interval that is appropriate for the organisation – typically every year or every second year. The interval may however depend on, for example, the complexity of the organisation and processing activities, or significant organisational, physical, or IT-related changes.\nFurther information on the requirements can be found in the Danish Data Protection Agency’s guidance: https://www.datatilsynet.dk/media/6567/fortegnelse.pdf","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","General Data Protection Regulation (GDPR) art 30"]
[null,1.1500000000000001,"Has the organisation prepared risk assessments addressing threats to information security and the related risk that business activities are negatively affected (business risk assessment)?","A ‘business risk assessment’ means that the organisation considers the risks that are critical for its business activities (or for public authorities, the performance of public tasks). Such a risk assessment also includes evaluating what security level is appropriate (acceptable) for the organisation.\nA template for risk assessments can be found here: https://sikkerdigital.dk/media/10255/risikovurderingsmodel.xlsx","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","ISO 27001 - 6.1\n\nISO 27005\n\nISO 31000                                                                                                                                                                                                                                                                                                     "]
[null,1.1600000000000001,"Has the organisation prepared risk assessments addressing threats to information security and the related risk that the rights of data subjects are negatively affected (data protection risk assessment)?","A ‘data protection risk assessment’ means that the organisation considers the risks related to the processing of personal data, including risks to the data subjects. Such a risk assessment also includes evaluating what security level is appropriate for protecting the rights of the data subjects.\nFurther information can be found here: https://www.datatilsynet.dk/emner/persondatasikkerhed/risikovurdering/\n and https://www.datatilsynet.dk/media/7900/vejledende-tekst-om-risikovurdering.pdf","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","ISO 27001 - 6.1\n\nISO 27005\n\nISO 31000 ISAE3000 KM B"]
[null,1.1700000000000002,"Are risk assessments updated at periodic intervals?","An ‘update’ particularly means assessing changes in threats and risks (likelihood and impact) and adapting the risk assessment in line with the new threat and risk landscape. ‘Periodic intervals’ means intervals appropriate for the organisation – typically every year or every second year. The interval may however depend on, for example, the complexity of the organisation and processing activities, or significant organisational, physical, or IT-related changes.\nFurther information can be found here: https://www.datatilsynet.dk/emner/persondatasikkerhed/risikovurdering/\n and https://www.datatilsynet.dk/media/7900/vejledende-tekst-om-risikovurdering.pdf","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","ISO 27001 - 6.1\n\nISO 27005\n\nISO 31000 ISAE3000 KM B"]
["3. Informationssikkerhedspolitik",3.1,"Has the organisation prepared an information security policy addressing the security of personal data processing","An ‘information security policy’ sets out high-level principles for how the organisation and its employees should act to protect, among other things, IT systems, computers, mobile devices, and information, including personal data.\nA template can be found here: https://sikkerdigital.dk/virksomhed/saadan-beskytter-du-din-virksomhed/skabeloner-og-vaerktoejer/","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","ISO 27001 - A.5.1.1\n\nISO 27002 - 5.1.1 ISAE 3000 KM C"]
[null,{"$f":"+B10+0.1","v":3.2},"Has the information security policy been approved by top management?","By ‘top management’ is meant the person(s) with overall responsibility for daily management of the organisation, e.g. a CEO or deputy director. This does not include boards or parent companies.","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","ISO 27001 - A.5.1.2\n\nISO 27002 - 5.1.2 ISAE3000 KM C"]
[null,3.3000000000000003,"Does the organisation review (and update) the information security policy periodically to ensure it is accurate and up to date?","‘Periodically’ means an interval appropriate for the organisation – typically every year or every second year. The interval may however depend on complexity, processing activities, or significant organisational, physical, or IT-related changes.","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","ISO 27001 - A.5.1.2\n\nISO 27002 - 5.1.2"]
[null,3.4000000000000004,"Does the information security policy (or related documents) explicitly address employees’ responsibility for information security?","‘Explicitly address’ means that management has decided on the specific responsibilities of employee groups for compliance with information security.","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","ISO 27001 - A.6.1.1\n\nISO 27002 - 6.1.1 ISAE3000 KM C"]
[null,3.5000000000000004,"Is the information security policy communicated to relevant employees and, where applicable, external parties?","‘Communicated’ means that the information security policy is conveyed and made available to employees and possibly external parties in a way that is relevant and understandable.","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","ISO 27001 - A.5.1.1\n\nISO 27002 - 5.1.1 ISAE 3000 KM C"]
[null,3.6000000000000005,"Does the organisation periodically check that security is in compliance with the information security policy and other internal security rules (audits/controls)?","‘Check’ means that at suitable intervals the organisation follows up on whether the requirements in the policy (and related requirements) are actually complied with, including whether employees comply in practice.","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","General Data Protection Regulation (GDPR), art 32, (1), d\n\nISO 27001 - A.18.2.3\n\nISO 27002 - 18.2.3 ISAE 3000 KM C"]
[null,3.7000000000000006,"Does the organisation incorporate recommendations from the Centre for Cyber Security (CFCS) in its overall security work?","‘Incorporate’ means that the organisation stays informed of and applies recommendations from CFCS when relevant.\nCFCS handles national tasks as IT security authority and network security service. Guidance is available at www.cfcs.dk","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","ISO 27001 - A.6.1.4\n\nISO 27002 - 6.1.4"]
[null,3.8000000000000007,"Does the organisation incorporate recommendations from Sikkerdigital.dk in its overall security work?","‘Incorporate’ means that the organisation stays informed of and applies recommendations from www.sikkerdigital.dk\n.\nThe Danish Agency for Digitalisation and the Danish Business Authority operate Sikkerdigital.dk, which collects knowledge about information security.","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","ISO 27001 - A.6.1.4\n\nISO 27002 - 6.1.4"]
[null,3.900000000000001,"Does the organisation incorporate recommendations from the Danish Data Protection Agency in its overall work with data protection and information security?","‘Incorporate’ means that the organisation stays informed of and applies recommendations from the Data Protection Agency. Guidance is available at www.datatilsynet.dk","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","ISO 27001 - A.6.1.4\n\nISO 27002 - 6.1.4"]
["4. Sikkerhedsbrud",4.1,"Has the organisation prepared procedures for handling breaches of personal data security?","‘Handling’ means the ability to identify what constitutes a breach of personal data security, setting up processes for registration and reporting of incidents to relevant parts of the organisation, and defining requirements for when incidents must be reported to the Danish Data Protection Agency.\nFurther information here: https://www.datatilsynet.dk/media/6558/haandtering-af-brud-paa-persondatasikkerheden.pdf","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","ISO 27001 - A.16.1.1\n\nISO 27002 - 16.1.1\n\nISO 27701 - 6.13 ISAE 3000 KM I"]
[null,{"$f":"+B19+0.1","v":4.199999999999999},"Do breach handling procedures include a description of how and when to notify the Data Protection Agency?","‘How and when to notify’ primarily means a description of how employees must act so that the organisation complies with Article 33 GDPR requirements for timely and complete notification.\nMore information: https://www.datatilsynet.dk/sikkerhedsbrud/anmeld-sikkerhedsbrud/","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","General Data Protection Regulation (GDPR) art. 33\nISO 27001 - A.6.1.3\nISO 27001 - A.16.1.1\nISO 27001 - A.16.1.2\n\nISO 27002 - 6.1.3\nISO 27002 - 16.1.1\nISO 27002 - 16.1.2\n\nISO 27701 - 6.13 ISAE3000 KM I"]
[null,4.299999999999999,"Do breach handling procedures include a description of how and when to notify data subjects in case of a breach?","‘How and when to notify’ primarily means a description that a decision must be made on whether to notify and who makes that decision.\nThe requirement is set out in Article 34 GDPR.","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","General Data Protection Regulation (GDPR) art 34\n\nISO 27701 - 6.13 "]
[null,4.399999999999999,"Does the organisation keep a written record (log) of all past personal data breaches?","Record’ means a written document providing a clear overview of incidents, including facts (what happened?), effects (what were the consequences for affected individuals?), and remedial measures (what has been done to fix the situation short- and long-term).\nRequirement described in Article 33(5) GDPR.","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","General Data Protection Regulation (GDPR) art 33 (5)\n\nISO 27001 - A.16.1.4\nISO 27001 - A.12.4.1\n\nISO 27002 - 16.1\nISO 27002 - 12.4.1 ISAE 3000 KM I"]
[null,4.499999999999998,"Does the organisation periodically review its breach log to assess whether specific types of breaches can be prevented in future?","Assess’ means the organisation analyses the nature and frequency of past breaches with a view to preventing new ones, e.g. by training employees or implementing technical measures.\n‘Periodic review’ means intervals appropriate for the organisation – for example, every 6–12 months. The interval may depend on the number of breaches or significant organisational, physical, or IT changes.","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","General Data Protection Regulation (GDPR) art 32 (1) d)\n\nISO 27001 - A.16.1.6\nISO 27001 - A.12.4.1\n\nISO 27002 - 16.1.6\nISO 27002 - 12.4.1"]

{"sheet":"Del 3. Emnespørgsmål","index":2,"n_rows":17,"n_cols":8,"rows_kept":17,"merged":[[1,0,6,0],[7,0,16,0]]}
["Emne ","#","Spørgsmål","Vejledende tekst","Har organisation taget stilling til overholdelse af forpligtelser på området?","Hvis der er svaret \"Nej\" eller \"Ikke relevant\" i kolonne F skal der angives en kort begrundelse her","Findes der dokumentation for stillingtagen?","Relevante henvisninger"]
["17. Backup","17.1","Has the organisation explicitly decided whether selected data should be backed up?","By ‘explicitly decided’ is meant that either management or employees authorised to do so have actively considered and stated which data must be secured by backup. Such a decision may be reflected in internal policies, contingency plans, information security documents (e.g. a Statement of Applicability), meeting minutes, contracts with subcontractors, or email correspondence. By ‘backup’ is meant a copy of the organisation’s data so that the organisation always has two more or less identical data sets available – the original data and the backup. The backup must be stored separately from the original data and must ensure that the organisation can re-establish IT operations if the original data is lost or damaged. Further information on requirements for a robust backup solution can be found at: https://sikkerdigital.dk/virksomhed/saadan-beskytter-du-din-virksomhed/faa-styr-paa-teknikken/","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","General Data Protection Regulation (GDPR) art. 5 (1), litra e og art. 32, (1), litra b + c. \n\nSO 27001 - A.12.3.1\n\nISO 27002 - 12.3.1\n\nISO 27701 - 6.9.3 ISAE 3000 KM B"]
[null,"17.2","Is data backed up regularly in practice at appropriate intervals?","By ‘regularly’ is meant that backups are made at intervals appropriate to the organisation, taking into account the nature of the information – in particular, how critical it is for the organisation and/or its customers. Typically, it may be relevant to make full or partial (possibly date-driven) backups on an hourly, daily, or weekly basis.","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","General Data Protection Regulation (GDPR) art. 32, (1), litra b + c. \n\nSO 27001 - A.12.3.1\n\nISO 27002 - 12.3.1\n\nISO 27701 - 6.9.3 ISAE 3000 KM B"]
[null,"17.3","Has the organisation ensured the confidentiality of personal data during transmission and storage of backups?","By ‘confidentiality’ is meant whether the organisation has taken measures to prevent data from being accessed by unauthorised persons. This will typically involve encryption of data at rest and in transit, as well as user access controls for staff or suppliers.","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","General Data Protection Regulation (GDPR) art 32 (1) litra b \n\nISO 27002 - 12.3.1.f) ISAE 3000 KM B"]
[null,"17.4","Does the organisation keep a written record (log) of backup and restore?","By ‘restore’ is meant episodes where data has been reloaded and/or re-established (from a backup) into an IT system or device. By ‘log’ is meant a written record showing when backup and restore were performed. Such a log may also include information on the persons who carried out the backup/restore as well as descriptions of the data concerned.","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","ISO 27701 - 6.9.3.1     ISAE 3000 KM B"]
[null,"17.5","Has the organisation tested backup solutions within the past year?","By ‘test of backup solutions’ is meant whether the organisation has at least checked in practice that backups are made in accordance with the required intervals (frequency), that the backup contains all relevant data (scope), that the data is accurate (integrity), and that the data can be restored as intended.","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","ISO 27001 - A.12.3.1\n\nISO 27002 - 12.3.1\n\nISO 27701 - 6.9.3      ISAE 3000 KM B"]
[null,"17.6","If the organisation uses external providers, have requirements for the backup solution been set out in a contract, standard terms or other written form?","By ‘requirements’ is meant expressly defined obligations regarding handling of backup and restore, including frequency, scope, security, access to data and any relevant deadlines.","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","ISO 27001 - A.12.3.1\nISO 27001 - A.15.1.2\n\nISO 27002 - 12.3.1\nISO 27002 - 15.1.2\n\nISO 27701 - 6.9.3"]
["20. Beredskabsplan","20.1","Has the organisation decided who is responsible for restoring IT systems and IT operations in the event of a breakdown?","By ‘decided’ is meant that management has expressly determined who holds responsibility for recovery. By ‘who’ is meant that responsibility is assigned to one or more persons or clearly defined functions, e.g. an IT manager. Responsibility may also rest with a department, e.g. the IT department. Further information and a contingency plan template can be found here: https://sikkerdigital.dk/virksomhed/saadan-beskytter-du-din-virksomhed/skabeloner-og-vaerktoejer/ and https://brs.dk/planlaegning/helhed/beredskabsplaner/Pages/beredskabsplaner.aspx","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","General Data Protection Regulation (GDPR) art 32 (1) litra b + c\n\nISO 27001 - A.17.1.1\n\nISO 27002 - 17.1\n\nISO 27031\nISO 22301"]
[null,"20.2","Has the organisation decided how IT systems and IT operations will be restored in the event of physical security incidents, including fire, flooding, theft, power failure, illness of key staff, etc.?","By ‘decided’ is meant that the person responsible for recovery (or management) has expressly considered restoration. By ‘how’ is meant that processes for restoration have been defined, including who performs specific tasks, what those persons should do in practice, and when/in what order.","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","General Data Protection Regulation (GDPR) art 32 (1) litra b + c\nISO 27001 - A.17.1.2\n\nISO 27002 - 17.1\n\nISO 27031\nISO 22301"]
[null,"20.3","Has the organisation decided how IT systems and IT operations will be restored in the event of IT-related security incidents, including ransomware, hacking, phishing, software failure, system overload, etc.?","By ‘decided’ is meant that the person responsible for recovery (or management) has expressly considered restoration. By ‘how’ is meant that processes for restoration have been defined, including who performs specific tasks, what those persons should do in practice, and when/in what order.","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","General Data Protection Regulation (GDPR) art 32 (1) litra b + c\n\nISO 27001 - A.17.1.2\n\nISO 27002 - 17.1\n\nISO 27031\nISO 22301"]
[null,"20.4","Has the organisation considered the consequences for continued business operations if IT support fails for a shorter or longer period?","By ‘considered’ is meant that one or more representatives from ongoing business operations (typically people with broad knowledge of the organisation’s business areas) have expressly considered the business consequences of lacking IT support. ‘Consequences for the business’ may include financial losses, inability to produce or deliver goods and services on time, and reputational damage (negative media or customer/ supplier perception).","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","ISO 27002 - 17.1\nISO 27002 - 17.2"]
[null,"20.5","Has the organisation considered the consequences for individuals if IT support fails for a shorter or longer period?","By ‘consequences for individuals’ is meant an assessment of what the lack of IT support could mean for employees, customers, or citizens. This could include financial losses or reputational harm, as well as consequences ranging from minor to life-threatening, e.g. failure to pay wages, deliver goods/services, or provide medicine and medical treatment on time. Further information can be found in the Danish Data Protection Agency’s guidance on personal data breach handling, section 3.2: https://www.datatilsynet.dk/media/7591/haandtering-af-brud-paa-persondatasikkerheden.pdf","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","ISO 27002 - 17.1\nISO 27002 - 17.2"]
[null,"20.6","Has the organisation considered how critical business operations will be maintained wholly or partly without IT support for a shorter or longer period?","By ‘how’ is meant that, before any incident occurs, the organisation has expressly considered how and to what extent employees should perform their tasks without IT support. By ‘critical business operations’ is meant tasks essential to avoid or limit serious negative consequences for the organisation and/or individuals. Examples: staff at a nursing home have considered how to ensure correct distribution of medicine if IT systems are unavailable, or payroll staff have considered how to pay salaries if the payroll system is down (e.g. by issuing advance payments).","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","ISO 27002 - 17.1\nISO 27002 - 17.2"]
[null,"20.7","Has top management approved plans or procedures for restoring IT operations?","By ‘top management’ is meant the person(s) with overall responsibility for the daily management of the organisation, e.g. a CEO or deputy director. This does not include boards or parent companies.","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","ISO 27001 - A.17.1.1\n\nISO 27002 - 17.1.1"]
[null,"20.8","Does the organisation periodically review any plans or procedures for restoring IT operations to assess whether updates or adjustments are needed?","‘Periodically’ means intervals appropriate for the organisation – typically every year or every second year. The interval may however depend on factors such as organisational complexity, processing activities, or major organisational, physical, or IT changes.","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","ISO 27001 - A.17.1.1\n\nISO 27002 - 17.1.1"]
[null,"20.9","Does the organisation periodically review any plans or procedures for handling critical business operations in case of IT failure to assess whether updates or adjustments are needed?","‘Periodically’ means intervals appropriate for the organisation – typically every year or every second year. The interval may however depend on factors such as organisational complexity, processing activities, or major organisational, physical, or IT changes. Further information, advice and recommendations for evaluating contingency plans can be found here: https://sikkerdigital.dk/myndighed/iso-27001-implementering/beredskabsstyring/afproevning-og-evaluering/ and https://brs.dk/planlaegning/helhed/skabeloner/Pages/skabeloner.aspx","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","ISO 27001 - A.17.1.3\n\nISO 27002 - 17.1.3"]
[null,"20.10","Does the organisation perform periodic tests of plans or procedures relating to contingency, in particular procedures for restoring IT operations and maintaining critical business operations without normal IT support?","‘Periodically’ means intervals appropriate for the organisation – typically every year or every second year. The interval may however depend on factors such as organisational complexity, processing activities, or major organisational, physical, or IT changes. By ‘test’ is meant that selected scenarios are carried out (either through simulated crisis exercises or so-called tabletop exercises) to train relevant staff and identify weaknesses in plans and procedures. Further information and advice can be found here: https://sikkerdigital.dk/myndighed/iso-27001-implementering/beredskabsstyring/beredskabsspillet/","Yes",null,"Yes, in a management-approved, structured, and date-stamped form","General Data Protection Regulation (GDPR) art 32 (1) litra d\nISO 27001 - A.17.1.3\n\nISO 27002 - 17.1.3"]

{"sheet":"Svar muligheder","index":3,"n_rows":15,"n_cols":8,"rows_kept":15,"hidden":true}
[]
[]
[]
[]
["Kolonne1","Gør du det?","Kan du dokumentere det?","Hvor hurtigt kan du fremvise det?","Ja/nej Spørgsmål","Organisation","Intervaler","Jobfunktion"]
[null,"Ja","Ja, i ledelsesgodkendt struktureret datomærket form","Inden for 1 uge","Ja","Offentlig","1-10","Nej, Ingen er udpeget"]
[null,"Delvist 1/3 opfyldt","Ja, i struktureret datomærket form","Inden for 2 uger","Nej","Privat","10-50","DPO - Databeskyttelsesrådgiver"]
[null,"Delvist 2/3 opfyldt","Ja, i ustruktureret datomærket form","Inden for 4 uger","Uafklaret",null,"50-100","It-sikkerhedschef"]
[null,"Nej","Ingen skriftlig dokumentation findes","Kan ikke fremsendes","Ikke relevant",null,"100-150","DPA - Databeskyttelsesambassadør"]
[null,"Ikke relevant","Ikke relevant","Ikke relevant",null,null,"150-200","HR-ansvarlig"]
[null,"Uafklaret","Uafklaret","Uafklaret",null,null,"200-250","Jurist med ansvar for databeskyttelse"]
[{"$nulls":6},"250-300","IT-sikkerhedskonsulent med ansvar for databeskyttelse"]
[{"$nulls":6},"300-350","Ekstern konsulent"]
[{"$nulls":6},"350-500","Ledelsen"]
[{"$nulls":6},"500<"]