100% editable DOCX templates and expert consultancy for ISO 27001/27002:2022 ISMS, Cybersecurity Framework Law (21,663) and Personal Data Protection Law (21,719). Plus specialist programmes in ISO 27701, ISO 42001, ISO 9001, ISO 22301 and ISO/IEC 20000-1.
An ecosystem for information security, cybersecurity and personal data protection
All three share governance, risk analysis, incident management and access control. Implementing them on a single management system means building the information asset inventory once and evidencing each control once, even though it satisfies all three frameworks.
The documentation that backs it up y the consultancy that implements it.
Cybersecurity Framework Law requires institutions of vital importance to implement documented technical and administrative measures. The absence of documentary evidence is the most frequent risk in ANCI audits.
Identification and classification of assets before the ANCI with a formal methodology.
Risk matrices with a recognised methodology and a treatment plan.
Mandatory communication protocols within the established deadlines.
Business continuity and disaster recovery plan.
Unlike Law 21,663, this one draws no distinction by size or sector: it reaches any organisation that processes personal data. And it shifts the burden of proof — in an incident, it is the controller who has to show that the security measures existed and worked.
Article 14 ter requires twelve items to be published and kept on view, from letter a) to letter l). It is the heaviest documentary obligation in the law and the first one an inspector can review without having to ask anyone for anything.
Six rights —access, rectification, erasure, objection, portability and blocking— with acknowledgement of receipt, a reply within 30 days extendable once, and the record that proves the sending, its date and its full content.
It is not 72 hours: that deadline is the GDPR's. Article 14 sexies requires reporting «by the most expeditious means possible», and also notifying each data subject when the data is sensitive, belongs to children under fourteen or is economic in nature.
Mandatory before processing starts in four cases: profiling with legal effects, large-scale processing, monitoring of public areas and sensitive data without consent.
The leading international standard in information security management. Our templates cover every clause and every Annex A control.
The master document mapping each Annex A control to its implementation status.
Risk identification, analysis and evaluation following the ISO 31000 + 27005 methodology.
Annual plan, checklists by domain and forms for findings and non-conformities.
Governance framework aligned with clauses 5 and 6 of the standard.
Complete ISMS documentation, ready to present to your international certification body.
Your basket is empty
Add regulatory documentation packs or plans