{
  "url": "https://openlegislation.uk/eu-regulation-2011-1179/annex/division-2/division-1/division-2.2",
  "json_url": "https://openlegislation.uk/eu-regulation-2011-1179/annex/division-2/division-1/division-2.2.json",
  "legislation": "eur/2011/1179",
  "legislation_title": "Commission Implementing Regulation (EU) No 1179/2011 of 17 November 2011 laying down technical specifications for online collection systems pursuant to Regulation (EU) No 211/2011 of the European Parliament and of the Council on the citizens’ initiative",
  "legislation_url": "https://openlegislation.uk/eu-regulation-2011-1179",
  "path": "annex/division/2/division/1/division/2.2",
  "kind": "division",
  "number": "2.2",
  "heading": null,
  "text": "Organisers choose security controls based on the risk analysis in 2.1(a) from the following standards:\n(1) ISO/IEC 27002; or\n(2) the Information Security Forum’s ‘Standard of Good Practice’\nto address the following issues:\n(a) risk assessments (ISO/IEC 27005 or another specific and suitable risk assessment methodology are recommended);\n(b) physical and environmental security;\n(c) human resources security;\n(d) communications and operations management;\n(e) standard access control measures, in addition to those set forth in this Regulation;\n(f) information systems acquisition, development and maintenance;\n(g) information security incident management;\n(h) measures to remedy and mitigate breaches in information systems which would result in the destruction or accidental loss, alteration, unauthorised disclosure or access of personal data processed;\n(i) compliance;\n(j) computer network security (ISO/IEC 27033 or the SoGP are recommended).\nApplication of these standards can be limited to the parts of the organisation that are relevant for the online collection system. For instance, human resources security can be limited to any staff that has physical or networking access to the online collection system, and physical/environmental security can be limited to the building(s) hosting the system.",
  "extent": "E+W+S+N.I.",
  "status": null,
  "version": "current",
  "annotations": [],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eur/2011/1179/annex/division/2/division/1/division/2.2",
    "retrieved_at": "2026-11-01T14:49:45.469880+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}