Mgsict

🎬 Minerva Group Service ( Mgsict MGSLegal sta MGS Mediapress) & E-venture
💻🔒La protezione dei dati e la sicurezza informatica per le PMI

🎯La sicurezza delle informazioni e la cybersecurity è sempre più importante anche per le Piccole Media Imprese che necessitano di soluzioni ad hoc, integrate, sostenibili e scalabili!

📘Questo a fronte di requisiti normativi sempre più complessi:
✅Privacy Data Protection (EU GDPR e LPD-DSG-LPD Svizzera)
✅Direttiva NIS 2
✅Sistemi di gestione per la sicurezza delle informazioni ISO 27001
✅MOG ex d.lgs. 231/01.

🎤Andrea Leonardi (Minerva Group Service e Alpemi Consulting srls) ne ha parlato all’evento svoltosi a Varese il 25 Ottobre u.s..

🎬Minerva Group Service (Mgsict MGSLegal sta MGS Mediapress) & E-Venture
💻🔒Data protection and cybersecurity for SMEs

🎯Information security and cybersecurity are increasingly important also for Small Medium Businesses that need ad hoc, integrated, sustainable and scalable solutions!

📘This in the face of increasingly complex regulatory requirements:
✅Privacy Data Protection (EU GDPR and LPD-DSG-LPD Switzerland)
✅NIS 2 EU Directive (EU cybersecurity)
✅ISO 27001 information security management systems standard
✅Organizational Control Model pursuant to Italian Legislative Decree 231/01 (corporate criminal liability)

🎤Andrea Leonardi ( Minerva Group Service and Alpemi Consulting srls) spoke about it at the event held in Varese on October 25th.

📰 GRC Infographic
🧠💻 Artificial Intelligence
📘 Sistemi di gestione per l’intelligenza artificiale (standard ISO 42001) e trattamento dei rischi

💻🧠 Lo standard ISO/IEC 42001:2023 Information technology Artificial intelligence Management system riporta nell’Allegato 1 una serie di obbiettivi di controllo e di controlli operative applicabili per indirizzare i rischi.

📘 In particolare l’Allegato A dello standard ISO 42001 riposte I seguenti obbiettivi di controllo:
✅ A.2 Policies related to AI
✅ A.3 Internal Organization
✅ A.4 Resources for AI Systems
✅ A.5 Assessing Impact of AI Systems
✅ A.6 AI System Life Cycle
✅ A.7 Data for AI System
✅ A.8 Information for interested parties in AI systems
✅ A.9 Use of AI systems
✅ A.10 Third parties and customer relationships

📘 Molte e significative le correlazioni tra I controlli operative dell’Allegato A dello standard ISO 42001 con I seguenti standards:
💻 🔒 Sicurezza delle informazioni ISO 27001 (Appendice A controlli operative)
💻⚙️ Servizi IT ISO 20000-1

📰 GRC Infographic
🧠💻 Artificial Intelligence
📘 Management systems for artificial intelligence (ISO 42001 standard) and risk treatment

💻🧠 The ISO/IEC 42001:2023 Information technology Artificial intelligence Management system standard reports in Annex 1 a series of control objectives and operational controls applicable to address risks.

📘 In particular, Annex A of the ISO 42001 standard addresses the following control objectives:
✅ A.2 Policies related to AI
✅ A.3 Internal Organization
✅ A.4 Resources for AI Systems
✅ A.5 Assessing Impact of AI Systems
✅ A.6 AI System Life Cycle
✅ A.7 Data for AI System
✅ A.8 Information for parties interested in AI systems
✅ A.9 Use of AI systems
✅ A.10 Third parties and customer relationships

📘 There are many and significant correlations between the operational controls of Annex A of the ISO 42001 standard with the following standards:
💻 🔒 ISO 27001 Information Security (Appendix A Operational Controls)
💻⚙️ IT Services ISO 20000-1

📋 GRC Infographic
🩺🌡💉 Dispositivi medici
📘 Regolamento MDR UE 745/2017 e Direttiva UE NIS2

💻🔒Il d.lgs. 138/2024 ha recepito la direttiva (UE) 2022/2555 relativa a misure per un livello comune elevato di cibersicurezza nella UE (direttiva meglio conosciuta come NIS 2).

🩺🌡💉 Il d.lgs. 138/2024 definisce anche il campo di applicazione della direttiva NIS 2 mediante individuazione di aziende che operano in settori ad alta criticità (Allegato 1) e in settori critici (Allegato 2). In tale campo di applicazione rientrano anche alcuni fabbricanti di dispositivi medici.

⚠️ Tra le aziende operanti nei settori ad alta criticità sono individuate i fabbricanti di dispositivi medici considerati critici durante un’emergenza di sanità pubblica così come definiti dall’art.22 del Regolamento UE 2022/123.

⚠️ Tra le aziende operanti nei settori critici sono individuate i fabbricanti di dispositivi medici così come definiti dal Regolamento UE MDR 2017/745 all’articolo 2 ed i fabbricanti di dispositivi medici diagnostici in vitro.

📋 GRC Infographic
🩺🌡💉 Medical devices
📘 EU MDR Regulation 745/2017 and EU NIS2 Directive

💻🔒Italian Legislative Decree 138/2024 implemented Directive (EU) 2022/2555 relating to measures for a high common level of cybersecurity in the EU (directive better known as NIS 2).

🩺🌡💉 Legislative Decree 138/2024 also defines the field of application of the NIS 2 directive by identifying companies that operate in highly critical sectors (Annex 1) and in critical sectors (Annex 2). Some medical device manufacturers also fall into this field of application.

⚠️ Among the companies operating in highly critical sectors, manufacturers of medical devices considered critical during a public health emergency as defined by article 22 of EU Regulation 2022/123 have been identified.

⚠️ Among the companies operating in critical sectors are the manufacturers of medical devices as defined by EU Regulation MDR 2017/745 in article 2 and the manufacturers of in vitro diagnostic medical devices.

📝 GRC Infographics
📘 I requisiti della FINMA per i servizi ICT nel settore finance della Svizzera: approccio GRC e principali standard correlati.

⚖️💻La FINMA (l’autorità di vigilanza della Svizzera per il settore finance) ha emanato a Gennaio 2013 la circolare 2023/1 «rischi operativi e resilienza – banche». La ricolare 2023/1 sostituisce la precedente circolare 08/21.

⚖️ La circolare 23/01 definisce una serie di requisiti applicabili alle risorse ICT delle aziende del settore finance sottoposte a vigilanza:
💻 capitolo IV «Gestione dei Rischi Operativi»
✅ A. Gestione Trasversale dei Rischi Operativi
✅ B. Gestione dei Rischi TIC
✅ C. Gestione dei Cyber Rischi
✅ D. Gestione dei Rischi dei dati critici
✅ E. Business Continuity management (BCM)
✅ F.Gestione dei rischi afferenti alla prestazione di servizi transfrontalieri
💻 capitolo V «Garanzia della resilienza operativa»

❓Come gestire in modo sistematico i requisiti della circolare 2023/01 applicabili alle risorse ICT?

🎯 Un moderno approccio GRC basato sui principali standard ISO (ISO 38500 Governance, ISO 31000 Risk Management, ISO 37301 Compliance Management) può supportare la gestione integrata di tutti i requisiti applicabili alle risorse ICT: sicurezza delle informazioni, continuità operativa e servizi IT.

⚙️ In particolare l’adozione di un approccio GRC consente di adottare e di integrare i diversi standard di riferimento (ad esempio standard ISO e standard NIST):
📘 Standard ISO 27001 sicurezza delle informazioni, standard ISO 27110 cybersecurity framework e standard NIST;
📘 Standard ISO 22301 business continuity;
📘 Standard ISO 20000-1 servizi IT

📝GRC Infographics
📘 FINMA requirements for ICT services in the Swiss finance sector: GRC approach and main related standards.

⚖️💻 FINMA (Switzerland's supervisory authority for the finance sector) issued Circular 2023/1 "operational risks and resilience - banks" in January 2013. Recirculation 2023/1 replaces the previous circular 08/21.

⚖️ Circular 23/01 defines a series of requirements applicable to the ICT resources of companies in the finance sector subject to supervision:
💻 chapter IV «Management of Operational Risks»
✅ A. Transversal Management of Operational Risks
✅ B. ICT Risk Management
✅ C. Cyber ​​Risk Management
✅ D. Risk management of critical data
✅ E. Business continuity management (BCM)
✅ F. Management of risks relating to the provision of cross-border services
💻 chapter V «Ensuring operational resilience»

❓ How to systematically manage the requirements of Circular 2023/01 applicable to ICT resources?

🎯 A modern GRC approach based on the main ISO standards (ISO 38500 Governance, ISO 31000 Risk Management, ISO 37301 Compliance Management) can support the integrated management of all requirements applicable to ICT resources: information security, business continuity and IT services.

⚙️ In particular the adoption of a modern GRC approach allows the adoption and the integration of the various reference standards (for example ISO standards and NIST standards):
📘 ISO 27001 information security standard, ISO 27110 cybersecurity framework standard and NIST standard;
📘 ISO 22301 business continuity standard;
📘 Standard ISO 20000-1 IT services

📰 GRC Infographic
🧠💻 Artificial Intelligence
📘 Intelligenza Artificiale e Governance (ISO 38507)

🎲🧠Lo standard ISO/IEC 38507:2022 “ Information technology — Governance of IT — Governance implications of
the use of artificial intelligence by Organizations” fornisce line guida per l’Organo di Governo delle Organizzazioni che utilizzano l’Intelligenza artificiale.

🧠💻 Lo standard ISO 38507 è direttamente correlato allo standard ISO/IEC 42001:2023 “Information technology Artificial intelligence Management system”.

📘 In particolare l’approccio alla governance dell’AI dello standard ISO 38507 è allineato all’appoccio del noto standard ISO/IEC 38500:2015, “Information technology — Governance of IT for the organization”

⚠️🧠Lo standard ISO 38507 richiama lo standard ISO IEC 28394:2023 “ Information technology — Artificial
intelligence — Guidance on risk management che indirizza la gestione dei rischi.

📰 GRC Infographic
🧠💻 Artificial Intelligence
📘 Artificial Intelligence and Governance (ISO 38507)

🎲🧠The ISO/IEC 38507:2022 standard “ Information technology — Governance of IT — Governance implications of
the use of artificial intelligence by Organizations” provides guidelines for the Governing Body of Organizations that use Artificial Intelligence.

🧠💻 The ISO 38507 standard is directly related to the ISO/IEC 42001:2023 “Information technology Artificial intelligence Management system” standard.

📘 In particular, the approach to the Governance of AI of the ISO 38507 standard is aligned with the approach of the well-known ISO/IEC 38500:2015 standard, "Information technology - Governance of IT for the organization"

⚠️🧠The ISO 38507 standard recalls the ISO IEC 28394:2023 “ Information technology — Artificial
intelligence — Guidance on risk management that directs risk management.

🎬 PITCH Minerva Group Service (MGS) Ecosystem
📈 Private Equity Crowfunding Venture Capital

🎯 MGS è un brand internazionale riconosciuto come centro di competenza tecnico e di innovazione nel settore del compliance management.

🧰 MGS è una società italo svizzera che eroga servizi professionali alle imprese (consulenza, formazione, audit e business assurance) nelle seguenti aree:
⚙️ ISO Management Systems standards compliance;
🌱 Sustainability ESG compliance;
🩺 Medical Dervices regulation compliance;
✅ Corporate Legal Compliance (OHSAS, Privacy, AML, Corporate Criminal Liability…)
⚖️ Legal services & trust services
💻 IT, AI e Cybersecurity
📣 Marketing and Communication
📘 Digital and multimedial publishing

🌐 MGS opera in Italia e all’estero in diversi settori: ICT, aerospace and defense, medical device, healthcare, luxury hotels, public utilities, legal services, finance, building, etc.

🌐 L’ecosistema MGS si articola in diverse società e business unit:
🪪 MGSLegal sta (spin off company): law firm, legal services
🪪 MGS Mediapress (spin off company): digital publishing and multimedia content;
🪪 Mgsict (business unit): ICT, AI, cybersecurity, digital innovation:
🪪 Mgsmkt (business unit): digital marketing and communication
🪪 ST Paul Professional Trust CO. srl (participated company): trust services and wealth management.

🇨🇭 MGS è azienda associata a Itsmf Switzerland

🎬 PITCH Minerva Group Service (MGS) Ecosystem
📈 Private Equity Crowdfunding Venture Capital

🎯 MGS is an international brand recognized as a center of technical competence and innovation in the compliance management sector.

🧰 MGS is an Italian-Swiss company that provides professional services to companies (consultancy, training, audit and business assurance) in the following areas:
⚙️ ISO Management Systems standards compliance;
🌱 Sustainability ESG compliance;
🩺 Medical Devices regulation compliance;
✅ Corporate Legal Compliance (OHSAS, Privacy, AML, Corporate Criminal Liability…)
⚖️ Legal services & trust services
💻 IT, AI and Cybersecurity
📣 Marketing and Communication
📘 Digital and multimedia publishing

🌐 MGS operates in Italy and abroad in various sectors: ICT, aerospace and defense, medical devices, healthcare, luxury hotels, public utilities, legal services, finance, building, etc.

🌐 The MGS ecosystem is divided into various companies and business units:
🪪 MGSLegal sta (spin off company): law firm, legal services
🪪 MGS Mediapress (spin off company): digital publishing and multimedia content;
🪪 Mgsict (business unit): ICT, AI, cybersecurity, digital innovation:
🪪 Mgsmkt (business unit): digital marketing and communication
🪪 ST Paul Professional Trust CO. srl (participated company): trust services and wealth management.

🇨🇭 MGS is a company associated with Itsmf Switzerland

💡Minerva Group Service (Mgsict) & Alpemi Consulting srls for Innovation
🧠💻GRC.AI.Lab

🧰 MGS eroga servizi professionali alle imprese (consulenza, formazione, audit e business assurance) per la compliance nelle seguenti aree:
⚙️ ISO Management standards compliance;
⚖️ Sustainability ESG compliance;
🩺 Medical Dervices regulation compliance;
⚖️ Corporate Legal Compliance (OHSAS, Privacy, AML, Corporate Criminal Liability…)

🧰 MGS ha negli anni sviluppato uno specifico know how in materia di compliance management trasversale a diversi settori e tipologie di imprese tanto da essere ormai riconosciuta come centro di competenza.

⚠️ La gestione della compliance in ambito nazionale ed internazionale è sempre più complessa, delicata ed onerosa sia per le grandi sia per le piccole e medie Organizzazioni. Questo in quanto:
⚠️ I requisiti tecnici, cogenti e regolamentari sono sempre più tra loro correlati;
⚠️ Il quadro normativo è sempre più dinamico e articolato;

🧠📈Nonostante lo sviluppo di AI «general purpose» abbia fatto grandi progressi, queste sono ancora lontane dal fornire adeguato supporto alle imprese nel particolare settore della compliance.

💡 ✅GRC.AI.Lab è il gruppo di lavoro di MGS MGS ICT e Alpemi Consulting che studia e sviluppa soluzioni innovative basate sulla IA specificatamente per la compliance sulla base del know how pluriennale sviluppato in questo settore.

💡Minerva Group Service (Mgsict) & Alpemi Consulting srls for Innovation
🧠💻GRC.AI.Lab

🧰 MGS provides professional services to companies (consultancy, training, audit and business assurance) for compliance in the following areas:
⚙️ ISO Management standards compliance;
⚖️ Sustainability ESG compliance;
Medical Devices regulation compliance;
⚖️ Corporate Legal Compliance (OHSAS, Privacy, AML, Corporate Criminal Liability…)

🧰 MGS has over the years developed specific know-how in the field of compliance management across different sectors and types of companies, so much so that it is now recognized as a center of expertise.

⚠️ Compliance management at national and international levels is increasingly complex, delicate and expensive for both large and small and medium-sized organisations. This is because:
⚠️ The technical, binding and regulatory requirements are increasingly interrelated;
⚠️ The regulatory framework is increasingly dynamic and articulated;

🧠📈Although the development of "general purpose" AI has made great progress, they are still far from providing adequate support to companies in the particular compliance sector.

💡 ✅GRC.AI.Lab is the working group of MGS MGSICT and Alpemi Consulting that studies and develops innovative AI-based solutions specifically for compliance based on the many years of know-how developed in this sector.

📐 Infografica GRC
🌡💉Dispositivi medici
💿 Health Software

📘Lo standard IEC 81001-5-1:2021 «Health software and health IT systems safety, effectiveness and security –Part 5-1: Security – Activities in the product life cycle” fornisce i requisiti per lo sviluppo e la manutenzione del software sanitario.

💿🔒 Lo scopo è aumentare la sicurezza informatica del software sanitario nei processi del ciclo di vita del software sanitario e aumentare la sicurezza dei processi del ciclo di vita del software.

⚖️ Lo standard presenta naturali correlazioni con il regolamento europeo MDR 2027/745 sui dispositivi medici sia per i SW incorporati nei dispositivi medici sia ovviamente per i SW as Medical Devices.

💿 ⚙️Un altro punto di interesse sono le correlazioni con lo standard ISO ISO/IEC 20000-1:2018 “Information technology — Service management Part 1: Service management system requirements” per i comuni requisiti applicabili al ciclo di sviluppo del SW.

🧠💻 In prospettiva saranno sempre più rilevanti anche le correlazioni tra la gestione del ciclo del SW ed I requisiti di sicurezza nello sviluppo di soluzioni di intelligenza artificiale nel settore dei dispositive medici con riferimento allo standard ISO/IEC 42001:2023 “Information technology — Artificial intelligence — Management system”

📐 GRC infographic
🌡💉Medical devices
💿 Health Software

📘IEC 81001-5-1:2021 «Health software and health IT systems safety, effectiveness and security –Part 5-1: Security – Activities in the product life cycle” provides requirements for development and maintenance of health software.

💿🔒 The purpose is to increase the cybersecurity of health software in the health software life cycle processes and to increase the security of software life cycle processes.

⚖️ The standard has natural correlations with the European regulation MDR 2027/745 on medical devices both for SW incorporated into medical devices and obviously for SW as Medical Devices.

💿 ⚙️Another point of interest are the correlations with the ISO standard ISO/IEC 20000-1:2018 "Information technology - Service management Part 1: Service management system requirements" for the common requirements applicable to the SW development cycle.

🧠💻 In the future, the correlations between the management of the SW cycle and the security requirements in the development of artificial intelligence solutions in the medical device sector will also be increasingly relevant with reference to the ISO/IEC 42001:2023 standard "Information technology - Artificial intelligence — Management system”

📝GRC Infographics
🔒 💻 Information Security
📘 Direttiva NIS2 e principali standard ISO

📘 DIRETTIVA (UE) 2022/2555 DEL PARLAMENTO EUROPEO E DEL CONSIGLIO del 14 dicembre 2022 relativa a misure per un livello comune elevato di cibersicurezza nell'Unione, recante modifica del regolamento (UE) n. 910/2014 e della direttiva (UE) 2018/1972 e che abroga la direttiva (UE) 2016/1148 (direttiva NIS 2)

⚖️Il NIS2 si applica a settori definiti critici quali ad esempio: energia, servizi pubblici, servizi finanziari, servizi sanitari, telecomunicazioni, spazio, pubblica amministrazione, etc.

📘 La direttiva NIS 2 si articola nei seguenti capitoli:
✅ -.Considerando (144)
✅ Capo I Disposizione generali
✅ Capo II Quadri Coordinati in materia di cybersicurezza
✅ Capo III Cooperazione a livello dell’unione e internazionale
✅ Capo IV Misure di gestione del rischio di cybersicurezza e obblighi di segnalazione
✅ Capo V Giurisdizione e registrazione
✅ Capo VI Condivisione delle informazioni
✅ Capo VII Vigilanza ed Esecuzione
✅ Capo VIII Atti delegati ed atti di esecuzione
✅ Allegato I Settori ad alta criticità
✅ Allegato II Altri settori critici

⚙️ Come applicare la NIS2? Un approccio GRC basato sui principali standard ISO (servizit IT ISO 20000-1, sicurezza informazioni ISO 27001, business continuity ISO 22301, risk management ISO 31000, incident management ISO 27035) può essere di aiuto.

📝GRC Infographics
🔒 💻 Information Security
📘 NIS2 Directive and e main ISO standards

📘 DIRECTIVE (EU) 2022/2555 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)

⚖️The NIS2 applies to sectors defined as critical such as: energy, public services, financial services, health services, telecommunications, space, public administration, etc.

📘 The NIS2 Directive is divided in following chapters:
✅ -.Whereas (144)
✅ Chapter I general provisions
✅ Chapter II coordinated cybersecurity frameworks
✅ Chapter III cooperation at union and international level
✅ Chapter IV cybersecurity risk-management measures and reporting obligations
✅Chapter V jurisdiction and registration
✅ Chapter VI information sharing
✅ Chapter VII supervision and enforcement
✅ Chapter VIII delegated and implementing acts
✅ Annex I sectors of high criticality
✅ Annex II other critical sectors

⚙️ How to apply NIS2? A GRC approach based on the main ISO standards (IT services ISO 20000-1, information security ISO 27001, business continuity ISO 22301, risk management ISO 31000, incident management ISO 27035) can help.

📰 GRC Infographic
🧠💻 Artificial Intelligence
📘 AI termini e definizioni (ISO 22989)

🧠Lo standard ISO/IEC 22989:2022 “Information technology — Artificial intelligence — Artificial intelligence concepts and terminology” fornisce concetti e terminologia per migliorare la comprensione dell’AI.

🧠💻 Lo standard ISO 22989 è direttamente correlato allo standard ISO/IEC 42001:2023 “Information technology Artificial intelligence Management system”.

📘 🧠💻 Lo standard ISO 22898 si articola nelle seguenti clusole:
✅ 3. Terms and definition
✅ 4. Abbreviated terms
✅ 5. AI Concepts
✅ 6. AI systems life cycle
✅ 7. AI system functional overview
✅ 8. AI Ecosystem
✅ 9. Fields od AI
✅ 10. Application od AI Systems
✅ Annex A: Mapping of the AI systems life cycle with the OECD’s definition of an AI system life cycle

📰 GRC Infographic
🧠💻 Artificial Intelligence
📘 AI Terms and Definition (ISO 22989)

🧠The ISO/IEC 22989:2022 standard “Information technology — Artificial intelligence — Artificial intelligence concepts and terminology” provides concepts and terminology to improve the understanding of AI.

🧠💻 The ISO 22989 standard is directly related to the ISO/IEC 42001:2023 “Information technology Artificial intelligence Management system” standard.

📘 🧠💻 The ISO 22898 standard is divided into the following clauses:
✅ 3. Terms and definitions
✅ 4. Abbreviated terms
✅ 5. AI Concepts
✅ 6. AI systems life cycle
✅ 7. AI system functional overview
✅ 8. AI Ecosystem
✅ 9. Fields or AI
✅ 10. Application or AI Systems
✅ Annex A: Mapping of the AI ​​systems life cycle with the OECD's definition of an AI system life cycle

📰 GRC Infographic
🧠💻 Artificial Intelligence
📘 Intelligenza Artificiale e Risk Management (ISO 23894)

🎲🧠Lo standard “ISO/IEC 23894:2023 “Information technology — Artificial intelligence — Guidance on risk management” fornisce indicazioni su come le organizzazioni che sviluppano, producono, distribuiscono o utilizzano prodotti, sistemi e servizi che utilizzano l'intelligenza artificiale (AI) possono gestire i rischi specificamente correlati all'IA.

🧠💻 Lo standard ISO 23894 è direttamente correlato allo standard ISO/IEC 42001:2023 “Information technology Artificial intelligence Management system” il quale al requisito 8. Operatività richiama la gestione dei rischi.

📘🎲 In particolare l’approccio alla gestione dei rischi dello standard ISO 23894 è allineato all’appoccio del noto standard ISO 31000:2018 Risk management — Guidelines

📰 GRC Infographic
🧠💻 Artificial Intelligence
📘 Artificial Intelligence and Risk Management (ISO 23894)

🎲🧠The “ISO/IEC 23894:2023 “Information technology — Artificial intelligence — Guidance on risk management” standard provides guidance on how organizations that develop, produce, deploy or use products, systems and services that utilize artificial intelligence (AI) can manage risk specifically related to AI.

🧠💻 The ISO 23894 standard is directly related to the ISO/IEC 42001:2023 standard "Information technology Artificial intelligence Management system" which in the requirement 8. Operation refers to risk management.

📘🎲 In particular, the approach to risk management of the ISO 23894 standard is aligned with the approach of the well-known ISO 31000:2018 Risk management — Guidelines standard