课程大纲：

企业安全体系搭建培训

课程背景 Course Background:
2018年5月25日，GDPR（欧盟通用数据保护条例，General Data Protection Regulation）正式生效，开启了一个新的数据合规时代。1000万到2000万欧元，或企业全球年营业额2%到4%的罚款让所有受其管辖的企业都必须将数据保护合规提升到生存高度予以应对。面对新法，企业的应对仍然显得十分不足。2017年，英国政府在“四大”协助下发布了富时350指数网络治理健康检查报告，报告显示近六成的受访者表示对GDPR不太或并不了解，同时仅有8%的受访者表示已经做了充分的准备，接近75%的人表示仅做了部分准备。那么从国内外来看，未来数据安全法规趋势如何？网络安全问题的本质是什么？企业如何规避不合规数据的风险？怎样提供可切实实施的风险整改计划？
CCP法商精英荟特邀EY安永法证及诚信合规服务部门资深合伙人陈炽先生来为我们解读法规、分析案例、指点趋势。
On May 25, 2018, the General Data Protection Regulation (“GDPR”) formally came into force, opening a new era of data compliance. A fine of Euro 10-20 million or 2-4% of annual global turnover forces the companies bound by GDPR to pay high attention to data protection compliance. However, enterprises’ response to GDPR seems to be quite inadequate. In 2017, the British government issued FTSE 350 Network Governance Report under the assistance of Big 4 Accounting Firms. The Report shows that nearly 60% of the respondents did not know much about GDPR, only 8% of them said they had made adequate preparations, and nearly 75% of them said they had made some preparations only. What is the future trend of the data security regulations at home and abroad? What is the nature of cybersecurity issues? How to avoid the risks of non-compliant data? How to develop a practical and feasible risk control plan? 
Mr. Chen Chi, a senior partner of EY Forensic & Integrity Services was invited to interpret GDPR, analyze cases and explain the trends. 

课程收益 Course Benefits:
1.了解GDPR、中国网络安全法及其他相关法律法规要点
Understand the main points of GDPR, the Cybersecurity Law of the People’s Republic of China and other relevant laws and regulations
2.了解GDPR及其他相关法律对于企业所处行业的影响程度
Understand the impact of GDPR and other relevant laws and regulations on the industry
3.了解企业各个层级部门应如何应对外界监管规定
Understand how the departments of enterprises at each level should cope with the regulations
4.掌握提升企业数据合规、网络安全的方式方法
Learn the ways and means to improve enterprise data compliance and cybersecurity
5.了解危机发生时应如何进行处理和应对的方法
Understand how to deal with crises
6.学习先进风险评估框架，并能运用到实际工作中
Learn advanced risk assessment frameworks and apply them to practical work

谁该来参加 Who Should Attend:
企业合规、法务、信息安全部门负责人，拥有合规、法务、信息安全职能的纪检监察部门负责人，从事合规、法务、信息安全实务操作的部门主管及一般员工，其他对数据合规、网络安全感兴趣的有识之士，以及想提高企业综合管理能力的优秀积极人士。
Persons in charge of corporate compliance, legal affairs and information security departments; persons in charge of discipline inspection and supervision departments with the functions related to compliance, legal affairs and information security; department heads and general employees engaged in compliance, legal affairs and information security practices; far-sighted persons interested in data compliance and cybersecurity; and activists who want to improve the comprehensive management capabilities of their enterprises. 

课程大纲 Course Outline:
一、GDPR及相关法律法规 
GDPR and relevant laws and regulations
1.GDPR概述 
GDPR overview
2.中国网络安全法概述 
Overview of the Cybersecurity Law of the People’s Republic of China
数据隐私保护 Data privacy protection
网络安全等级保护 Classified protection of cybersecurity
信息跨境传输 Cross-border information transmission
网络安全监控与应急响应  Cybersecurity monitoring and emergency response
3.全球数据保护法律法规环境
Global data protection laws and regulations

二、数据合规、网络安全的趋势
Data compliance and cybersecurity trends
1.数据安全事件及处罚案件 
Data security incidents and punishment cases
2.企业应对现状
Enterprises’ response
3.从国内外大背景看趋势
Trends from the perspective of domestic and international background

三、企业应对策略
Enterprises’ countermeasures
1.管理层应对策略
Countermeasures at the management level
2.业务层应对策略
Countermeasures at the business level
3.技术层应对策略  
Countermeasures at the technology level

四、识别敏感信息
Identification of sensitive information
1.数据生命周期管理
Data lifecycle management
数据信息的收集与使用
Collection and use of data information
数据信息的加工、传输与共享
Processing, transmission and sharing of data information
数据信息的保存与销毁
Preservation and destruction of data information
2.识别个人数据、重要数据、商业秘密数据
Identification of personal data, important data and trade secrets

五、建立风险评估矩阵
Establishment of risk assessment matrix
1.怎样确定数据安全评估标准
How to establish data security assessment standards
2.定量化衡量风险等级及对企业的影响
Quantitatively measure risk levels and risk impact on enterprises
3.怎样提供可切实实施的风险整改计划
How to develop a practical and feasible risk control plan

六、建立数据治理框架
Establishment of data governance framework
1.数据治理的全过程
Whole process of data governance
2.应对型数据治理及主动型数据治理
Passive and active data governance
3.数据管理能力成熟度模型
Data management capability maturity model

七、搭建数据合规体系
Establishment of data compliance system
1.进行GDPR及网络安全法适用性评估
evaluate the applicability of GDPR and cybersecurity laws
2.划分数据类型及区别制定合规策略
Classify data and develop different compliance strategies based on the classification
3.更新与完善隐私政策
Update and improve privacy policies
4.建立风险评估、记录与响应机制
Establish risk assessment, recording and response mechanisms

八、搭建网络安全体系
Establishment of cybersecurity system
1.网络安全威胁类型
Types of cybersecurity threats
2.常见的安全服务机制
Common security service mechanisms
3.构建网络安全防护体系政策建议

企业安全体系搭建培训