Setting Up Data Security Management Aligned with VGYS and ISO 27001
A Data Security Management System (VGYS) protects an organisation’s information assets, secures access and standardises personal-data processing. Based on ISO 27001 and ISO 27701, it combines…
What’s in this article?
Data Security & ISO Standards; 2025
Setting Up Data Security Management Aligned with VGYS and ISO 27001
A Data Security Management System (VGYS) protects an organisation’s information assets, secures access and standardises personal-data processing. Based on ISO 27001 and ISO 27701, it combines technical measures with a management-system approach.
Summary: A robust VGYS covers IT infrastructure, processes, people and legal requirements.1. The foundations of VGYS: ISO 27001 & ISO 27701
These two standards create internationally accepted frameworks for information security and privacy management:
| Standard | Focus | Application area |
|---|---|---|
| ISO 27001 | Information security management | System, access, encryption, logging |
| ISO 27701 | Privacy and personal data management | KVKK, GDPR and data protection processes |
"ISO 27001 builds security, ISO 27701 manages privacy."
2. Setting up VGYS step by step
- Create an asset inventory: List all digital and physical information assets, such as servers, cloud services and contracts.
- Risk assessment: Analyse confidentiality, integrity and availability risks for each asset.
- Policies and procedures: Prepare password policies, data-sharing protocols and access-authorisation documents.
- Access control: Implement role-based access control (RBAC). Each user should access only what their permissions allow.
- Logging and monitoring: Record system access, data transfers and administrator actions daily.
- Penetration testing cycle: Conduct penetration tests at least twice a year and document the results.
- Breach management: Prepare a data-breach notification procedure based on the 72-hour rule.
- Physical security: Control access to server rooms, archives and devices.
- Training: All staff must receive information-security awareness training at least once a year.
- Audit: Ensure continuous improvement through internal audits and management reviews.
3. Establishing a corporate Data Protection Board
To sustain corporate data security, establish a Data Protection Board. Its purpose is to make security decisions at management level and ensure regular oversight.
- Chair: Information security manager (CISO or IT director)
- Members: Representatives from Legal, HR, Operations, Marketing and the data controller
- Tasks:
- Define the annual security strategy.
- Review risk-analysis reports.
- Review breach records and logs.
- Approve internal and external audit results.
- Evaluate the security impact of new technologies.
“Data security is not just an IT issue; it is a management responsibility.”
4. B10 Digital Agency recommendation: an integrated VGYS approach
B10 takes a three-layer approach to configuring VGYS for each organisation:
- Technical layer: ISO 27001 infrastructure + penetration tests + log monitoring systems
- Management layer: Data-protection policies, role descriptions and approval workflows
- Compliance layer: KVKK and GDPR integration, data-transfer records and DPAs
Are you ready to install VGYS?
B10 Digital Agency provides VGYS configuration, log management, access policies and penetration-testing consultancy aligned with ISO 27001 & 27701.
Sources and related documents
These documents provide references for the methods and rules discussed in this article.