Manage Learn to apply best practices and optimize your operations.

Does ISO 27001 certification make an enterprise Safe Harbor compliant?

Expert Mike Chapple details the ISO 27001 certification and why achieving it may not make an organization Safe Harbor compliant.

If my organization is ISO 27001 certified, does that mean we also are Safe Harbor compliant?

Ask the Expert!

Got a vexing problem for Mike Chapple or any of our other experts? Ask your enterprise-specific questions today! (All questions are anonymous.)

The ISO 27001 specification and the Safe Harbor, an agreement between the European Union (EU) and U.S. Department of Commerce, are two entirely different programs. While many of the security and privacy controls that organizations adopt for one program may partially or fully satisfy the requirements of another program, there is not generally a significant amount of overlap among multiple programs. In particular, organizations seeking to fulfill either ISO 27001 or Safe Harbor should fully understand the requirements of both.

ISO 27001 is an internationally accepted standard framework for an information security management system that includes control requirements in 11 domains. Organizations are not required to adopt ISO 27001, but may choose to do so on a voluntary basis. Those that do implement ISO 27001 may further choose to have their compliance independently audited to obtain ISO 27001 certification.

The Safe Harbor program allows a U.S.-based company to self-certify that it maintains data privacy controls that are adequate to comply with the EU's Data Privacy Directive. To become Safe Harbor compliant, companies must successfully complete the certification checklist to ensure adequate privacy controls are in place under the laws of the 28 member states of the European Union. An EU-based company can view qualified U.S. firms on the Safe Harbor website and receive assurance that the law permits them to exchange private information about EU citizens.

This was last published in January 2014

Dig Deeper on Security audit, compliance and standards

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.