# Commission Implementing Regulation (EU) No 1179/2011 of 17 November 2011 laying down technical specifications for online collection systems pursuant to Regulation (EU) No 211/2011 of the European Parliament and of the Council on the citizens’ initiative, Division 2.1

Extent: E+W+S+N.I.

Organisers provide documentation showing that they fulfil the requirements of standard ISO/IEC 27001, short of adoption. For that purpose, they have:
(a) performed a full risk assessment, which identifies the scope of the system, highlights business impact in case of various breaches in information assurance, enumerates the threats and vulnerabilities of the information system, produces a risk analysis document that also list countermeasures to avoid such threats and remedies that will be taken if a threat occurs, and finally draws up a prioritised list of improvements;
(b) designed and implemented measures for treating risks with regard to the protection of personal data and the protection of family and private life and measures that will be taken in the case risk occurs;
(c) identified the residual risks in writing;
(d) provided the organisational means to receive feedback on new threats and security improvements.

---
Source: https://www.legislation.gov.uk/eur/2011/1179/annex/division/2/division/1/division/2.1 (the official version)
Page: https://openlegislation.uk/eu-regulation-2011-1179/annex/division-2/division-1/division-2.1
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.