Verisign MS Sdn Bhd and ACPM IT Sdn Bhd are parts of ACPM network of firms headquartered in Budapest, Hungary. We provide a variety of training and implementation programs for digital banking, cybersecurity and governance, risk and compliance requirements.
We have our in-house developed product from Budapest for small and medium sized businesses who are working from home. SecureOffice is a secure, fast-to-deploy, budget-friendly web based platform where you can can share file and communicate to your colleagues securely via cloud.
Our management consulting services focus on our clients' most critical issues and opportunities: strategy, operations, technology, transformation, digital, advanced analytics, corporate finance, audit across all industries and geographies. We bring deep, functional expertise, but are known for our holistic perspective: we capture value across boundaries and between the silos of any organization. We have proven a multiplier effect from optimizing the sum of the parts, not just the individual pieces.
Our experience in IT security across multiple industries allows us to help our clients see their challenges from a new perspective. Our experts have over 20 years of experience in various fields of IT Security.
We provide audit services for IT systems of organizations with various business profiles.
We have experienced in program and project management tasks related to IT projects as well as strategic planning related to it. Our range of services on this field are:
We are working with a team of internationally experienced specialists who are able to provide extensive support to any organization trying to manage its XBRL compliance and operational challenges.
We are an international Trustmark Operator based in Europe. As part of ASEAN Trustmark Alliance with our Malaysian office, ACPM helps trustful businesses with its Trustmark operation. We issue Trustmark seals to businesses with reliable online presence after auditing their services, which promotes online business trust. For more information on our Trustmark services, please get in contact with us here.
We provide a great variety of training programs in the different fields of IT security. From introductory training programs, management IT security training programs to in-depth defensive and offensive cyber-security training courses, we cover an extensive range of topics related to information technology. ACPM’s experts are ready to provide your team with IT training in our facilities or your own office, according to your requirements. We are also able to customize training programs for to your specific needs. For our current range of training courses, please get in contact with us here. .
We provide digital banking consultancy services for financial institutions. ACPM brings experiences of assist clients in implementing digital banking solution both Islamic and conventional. Click the link below to find out more.
Malaysian businesses is on slowdown as Prime Minister has announced the Movement Control Order which started from 18 March 2020 till 31 March 2020 to prevent the spread of COVID-19. We are ready to assist businesses on practical advice on how to keep your business running during this troubled times.
Communication is key in a time of crisis. Your organization should identify a small, cross-functional group of people responsible for key communications to both employees and customers. Since the impact of COVID-19 is localized, but also changes daily, it’s important that this team be able to monitor news from the geographic areas specific to the organization’s employees and customers, and communicate this news effectively.
For your employees, make sure there is a central, reliable system to communicate day-to-day changes related to COVID-19. This platform may be a combination of the organization’s website, e-mail, and a 1-800 number but should be broadcast widely so employees can access relevant information easily from the office, home, or the road.
While customers and suppliers may understand that the spread of COVID-19 will impact your business, they need to be reassured that you have a plan to mitigate the impact of the virus on shipments, sales calls, customer service, or other parts of the business.
Our global coronavirus resource center provides organizations with preparedness support for their employees, customers and supply chain. Click the link to find out more.
The DOJ issued New April 2019 Guidance (“Guidance”, or “2019 Guidance”) detailing how prosecutors will evaluate the effectiveness of corporate programs to prevent fraud and other misconduct, a key consideration in determining the penalties imposed against companies. This is an update from the On February 8, 2017, the DOJ published Guidance entitled, “Evaluation of Corporate Compliance Programs”.
The 2019 Guidance contains 12 high-level topics (below) that are grouped to track the Three Core Questions about compliance program effectiveness contained in Section 9-28.800 of the Justice Manual and candidly are the key questions the board of directors should be asking. After all it’s expected the the organization’s “governing authority shall be knowledgeable about the content and operation of the compliance and ethics program and shall exercise reasonable oversight” of it (See U.S.S.G. § 8B2.1(b)(2)(A)-(C)).
Three Core Questions
The High-level Topics
Under each of the above topics, the 2019 Guidance sets forth multiple sample questions that prosecutors are likely to ask during an investigation. A few examples are:
Some Other Points of Focus
The 2019 Guidance seeks to understand how the organization approaches compliance and then what worked and what didn’t. So, one might consider reading both the old and new Guidance to understand how the evaluation of an organization’s compliance programs has changed.
If you are going to have your organization’s compliance program evaluated and you should!
The new General Data Protection Regulation (GDPR) came in to force from 25 May 2018.
The aim of data use by businesses is to target advertising more efficiently. However, data users have not always explained how this works or allowed individuals to opt out. There is also a secondary market for this data where details are bought and sold without
the knowledge of the individual. So the
new regulations set more explicit duties for organisations that use personal data and that includes just about everyone.
This guide sets out the scope of the new GDPR regime and explains the practical steps that should be taken to ensure compliance.
Who is affected?
All organisations are affected if they collect personal data.
Personal data is any record that identifies an individual through name, address, or other contact details. This is a wide definition and shows why everyone needs to have an awareness of GDPR and how it affects their organisation.
The impact of GDPR will depend on the nature of the personal data held and why the organisation holds it. There are legal grounds for holding data and businesses that are already compliant with existing data protection law will have a head start in meeting the new rules.
Any organisation active in direct marketing should already follow data protection law. However, the new rules are more demanding so a number of organisations will have to consider data protection for the first time. For example, there are specific rules for records of children and vulnerable people so the education and health sectors are a particular focus.
The Information Commissioner’s Office (ICO) was set up in 1984.
It upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals
in response to concerns about direct marketing. It has evolved over time and has acquired the ability to issue large fines. Several companies have been under scrutiny for large scale data breaches, including T-mobile and Superdrug. Its remit covers all marketing channels including mail, telephone and email. There are two legally distinct areas of activity; Data Protection and the Privacy and Electronic
Enforcement and fines
GDPR has raised the existing ceiling for fines to €20,000,000 or 4% of worldwide turnover, whichever is
greater. Fines have been levied on Google at €50million (£44m) for a privacy violation,issued by the French data protection authority in January 2019.
Fines can be levied where:
•An organisation is actively misusing the data and, as the bar on compliance is being raised, previous practice cannot be relied upon
•There is a failure to maintain adequate controls against misuse or data loss. Data can be lost through hacking of websites or theft of IT equipment and a fine will follow if adequate precautions have not been taken
•If individual rights are not protected and that individual complains to the ICO.
Every organisation needs to understand their responsibilities under GDPR and then take steps to make sure they are
compliant by 25 May 2018 and beyond. We recommend addressing these six, simple, key issues:
Get an understanding on GDPR, tailored to your industry so that you understand what matters for your organisation. This is particularly important if you are working with children or vulnerable adults
Understand what personal data your organisation uses, where it came from and why it is held.
This includes electronic databases
and hard copy filing
Ensure you have appropriate consent processes that give individuals control of their data. This includes asking for consent, how that consent is recorded and what happens if consent is not given
Consent is not the only legal basis for data processing. Make sure you understand the use of legitimate interests as a basis for lawful processing
Understand the strengthened individual rights and the ability of your organisation to meet them. This includes knowing where data is held, the deletion of data no longer needed and how you might pass data on to third parties when needed
Review your existing data protection regime and determine what needs to improve to meet GDPR; for example the ability to detect, report and investigate a personal data breach. The regime should satisfy both the letter and spirit of the law.
•We can provide a tailored briefing session for your organisation that will enable an action plan to be prepared
•We can support you in the implementation of your GDPR regime
•GDPR regime in place? We can audit your processes to ensure they are fully compliant
•We can help with maintenance and audit of your GDPR systems.
•You have looked into what GDPR is and what it entails. You have assessed how compliant your organisation is and what steps you need to take
•You have assigned someone to take responsibility for data protection compliance
•You have implemented processes and procedures to ensure that you are GDPR compliant
•You have communicated what GDPR is to staff and have ensured that they understand and are following correct processes and procedures. It’s everyone’s job to get this right and protect the data.
ACPM was founded and is headquartered in Budapest, Hungary. We have partners and representative offices in various locations around the world to provide top-quality service to our global clients.
Reach out to one of our offices to start a discussion.
Want to keep up with ACPM Events and News.
Visit our blog for more information
Find out more about the team at ACPMIT.ASIA Consultants and our Consulting Services
Lim Huck Hai has 30 years experience in Management Consulting and Technology Innovation. He is also the Managing Director / Partner of Baker Tilly in Malaysia.
With over 25 years of experience, Douglas is an expert in cybersecurity and technology consulting. His core assessment and deployment skills are in People, Process and Technology design that add to the wealth of ICT operational efficiency, effectiveness and security. Douglas has led, advised, and managed a broad range of assessment and co-sourcing Internal Audit roles for clients in Malaysia, ASEAN, Asia, North America and the Middle East.
Douglas has been involved in a number of WebTrust, Public Key Infrastructure (PKI), and Governance, Risk and Compliance (GRC) reviews and engagements with regulatory bodies, the public sector, GLCs, and the private sector. Douglas has extensive experience and is a proven performer where he understands the complexities, and sometimes frustrations, working within regulatory environments. He has clearly demonstrated his skills in both structured and less structured environments and is well versed in spanning technical and business issues.
His understanding and application of regulatory requirements and cross-recognition of compliance in relation to local and global standards will contribute to the success of this initiative.
Years of Experience: 25
Country Experience: Malaysia, ASEAN, North America, Middle East and Globally
Anuarul Hakim has been involved in the establishment and support of SSM BizTrust program and the completion of several digital security program engagements.
His core technical skills are in security design and build but add to that a wealth of security operational background and experience. He has designed and built several digital security integration projects and then been responsible for the ongoing delivery of our managed security services. He was the architect responsible for the design of the entire technology solution for digital security for clients. Aspects of the design included infrastructure and security requirements.
Years of Experience: 15
Country Experience: Malaysia
List of Skillsets: ISO/IEC 27001:2013 – Information Security Management System National Institute Standard of Technology (NIST) - Cyber Security Framework Center of Internet Security (CIS) Benchmark SABSA Enterprise Security Architecture Framework NIST 800-207 – Zero Trust Architecture.