Expert Advice Community

Guest

Documenting context of the organization and interested parties

  Quote
Guest
Guest user Created:   Jun 26, 2018 Last commented:   Jun 26, 2018

Documenting context of the organization and interested parties

Where would I record Context of the organisation and Interested parties? Should I put that in the Information Security Policy - we have a separate document that lists legal and contractual requirements.
0 0

Assign topic to the user

ISO 27001 PROCEDURE FOR IDENTIFICATION OF REQUIREMENTS

Basics of identification of interested parties and their requirements.

ISO 27001 PROCEDURE FOR IDENTIFICATION OF REQUIREMENTS

Basics of identification of interested parties and their requirements.

Expert
Dejan Kosutic Jun 26, 2018

Answer: ISO 27001 does not require documenting context of the organization, and this is especially not recommended for smaller organizations - you only need to take into context of the organization when defining the scope and doing the risk assessment. You can read more here: Explanation of ISO 27001:2013 clause 4.1 (Understanding the organization) https://advisera.com/27001academy/knowledgebase/how-to-define-context-of-the-organization-according-to-iso-27001/

You should document interested parties in List of legal, regulatory and contractual requirements, in folder 02 of the ISO 27001 Toolkit.

I would recommend that you keep this information separate from the Information Security Policy because otherwise you might need to update the Policy too often.

See also: What should you write in your Information Security Policy according to ISO 27001? https://advisera.com/27001academy/blog/2016/05/30/what-should-you-write-in-your-information-security-policy-according-to-iso-27001/

Quote
0 0

Comment as guest or Sign in

HTML tags are not allowed

Jun 26, 2018

Jun 26, 2018