If my organization is ISO 27001 certified, does that mean we also are Safe Harbor compliant?
Ask the Expert!
Got a vexing problem for Mike Chapple or any of our other experts? Ask your enterprise-specific questions today! (All questions are anonymous.)
The ISO 27001 specification and the Safe Harbor, an agreement between the European Union (EU) and U.S. Department of Commerce, are two entirely different programs. While many of the security and privacy controls that organizations adopt for one program may partially or fully satisfy the requirements of another program, there is not generally a significant amount of overlap among multiple programs. In particular, organizations seeking to fulfill either ISO 27001 or Safe Harbor should fully understand the requirements of both.
ISO 27001 is an internationally accepted standard framework for an information security management system that includes control requirements in 11 domains. Organizations are not required to adopt ISO 27001, but may choose to do so on a voluntary basis. Those that do implement ISO 27001 may further choose to have their compliance independently audited to obtain ISO 27001 certification.
The Safe Harbor program allows a U.S.-based company to self-certify that it maintains data privacy controls that are adequate to comply with the EU's Data Privacy Directive. To become Safe Harbor compliant, companies must successfully complete the certification checklist to ensure adequate privacy controls are in place under the laws of the 28 member states of the European Union. An EU-based company can view qualified U.S. firms on the Safe Harbor website and receive assurance that the law permits them to exchange private information about EU citizens.
Related Q&A from Mike Chapple
The updated HITRUST Common Security Framework allows organizations to manage privacy, security and compliance with one framework. Here's how it works...continue reading
A HIPAA audit covers privacy compliance, and organizations need to be prepared. Expert Mike Chapple discusses privacy in the audits.continue reading
A data breach warranty may seem like a tempting way to survive a costly attack, but it may not be all it's hyped up to be. Expert Mike Chapple ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.