Main control activity
Assign topic to the user
So, my question was- in each procedure documentation, is it an ISO27001 requirement to identify the key control activity along with the key records?
Answer: ISO 27001 does not require the identification in procedure documentation of such thing as main or key control activity as you described it. As a good practice, you may consider to include in policies and procedures references to the controls these documents are fulfilling. For example, in a access control policy you may include reference to control A..9.1.1 - Access control policy.
Comment as guest or Sign in
Mar 02, 2018