ISACA, a non-profit global association of more than 100,000 IT audit, security, risk and governance professionals, today released a guide to help Indian enterprises secure sensitive data and comply with India’s IT Act. Titled Securing Sensitive Personal Data or Information Under India’s IT Act Using COBIT 5, the book will educate business and IT leaders and other key stakeholders on the importance of securing sensitive personal data or information (SPDI) as required by India’s Information Technology Amendment Act, 2008. The guide is freely available in ISACA’s Knowledge Center at www.isaca.org/spdi.

The book provides a structured approach to comply with the Indian IT Act by using the COBIT 5 framework, the only business framework for the governance and management of enterprise information technology. It helps business leaders understand how to secure SPDI from risk mitigation, operational and implementation perspectives. Additionally, the book provides guidance to map the enterprise’s stakeholders with their specific needs on securing SPDI, using COBIT 5.

Commenting on the launch of the guide, Mr. Avinash Kadam, CISA, CISM, CGEIT, CRISC, advisor to ISACA’s India Task Force, said, “This guidance will surely act as a convenient code of good practices and guide for decision makers in enterprises to meet the requirements of Indian IT Act provisions on Sensitive Personal Data Protection.

“In today’s world, SPDI is used in every aspect of a business. It is used by very small organisations as well as very large enterprises. Securing SPDI cannot be done in isolation; the entire enterprise needs to be involved. The approach should be holistic as well as customisable to suit the size and nature of the business of the organisation, and COBIT 5 helps enable that.”

The Indian IT Act has a specific category, “sensitive personal data or information,” which consists of password, financial information (including bank account, credit card, debit card or other payment details), physical, physiological and mental health conditions, sexual orientation, medical records, and biometric information. This category in the Indian IT Act legally obligates all stakeholders (i.e., any individual or organisation that collects, processes, transmits, transfers, stores or deals with sensitive personal data) to adhere to its requirements. Some of the largest stakeholders could include owners of websites, banks, insurance companies, financial institutions, hospitals, educational institutions, service providers, travel agents, payment gateway providers and social media platforms, among many other entities.

According to India’s IT Act, the accountability for SPDI is with the governing body, which could be the chairman, board of directors, owner, proprietor, partner, head of an association or head of an institute.

The book discusses how COBIT 5 can help an enterprise meet the requirements of the IT Act by providing appropriate governance and management guidance and direction for securing SPDI, thus, also achieving the enterprise governance objective of risk optimization. It equips enterprises in India to govern and manage IT in a holistic manner, using the full, end-to-end business and IT functional areas of responsibility, and considering the IT-related interests of internal and external stakeholders.

ISACA also offers resources for Indian enterprises in its Knowledge Center. The India topic (www.isaca.org/topic-india) includes links, resources and discussions for IT and business professionals in India.

Additional information on Securing Sensitive Personal Data or Information Under India’s IT Act Using COBIT 5 is available at www.isaca.org/spdi.

About ISACA

With 100,000 members in 180 countries, including more than 6,000 members in India, ISACA^® (www.isaca.org) is a global provider of knowledge, certifications, community, advocacy and education on information systems assurance and security, enterprise governance and management of IT, and IT-related risk and compliance. Founded in 1969, the nonprofit, independent ISACA advances and attests IT skills and knowledge through the Certified Information Systems Auditor^® (CISA^®), Certified Information Security Manager^® (CISM^®), Certified in the Governance of Enterprise IT^® (CGEIT^®) and Certified in Risk and Information Systems Control^™ (CRISC^™) designations. ISACA also continually updates and expands the practical guidance and product family based on the COBIT^® framework.

Follow ISACA on Twitter: https://twitter.com/ISACANews