ISO 27001 & 22301 - Expert Advice Community

Supporting documentation for training

We are looking to train our employees on ISO 27001 and wondered if there is any supporting documentation that we can provide and upload on our company intranet and HRIS system?

Scope. ISO 27001

Good afternoon. Our holding consists of several companies, there are production companies, management companies, mining companies. Our management company has an ISO 27001 certificate. The information security policy applies to all companies of the Holding. How do we format the scope correctly so that it includes all of our companies?

Processo de adequação à ISO 27001

Como iniciamos o processo de forma a não gerar retrabalho no futuro e para que consigamos implementar o ISMS de forma útil para a empresa?

ISO 27001 compliance process

How do we start the process so as not to generate rework in the future and so that we can implement the ISMS in a useful way for the company?

Questions

1. We are a rather small start-up company with about 50 employees, manufacturing a product with both hardware and software.

We do not have a CISO or an IT manager, just myself as the ICT lead to do all IT and Security related tasks.

What should we put in the documentation instead of CISO?
Or should we write somewhere that wherever it says CISO that would be the ICT lead acting as the CISO?
Or alternatively should we only include job titles that we actually have in the company?
I am not sure how to present this in the documentation and audit.

2. One of our team members looking at the risk part of our ISO 27001 plan suggested we combine 06.1_Appendix_1_Risk_Assessment & 06.2_Appendix_2_Risk_Treatment because:
1) they include a lot of the same columns.
2) you can use filter instead of copy pasting those risks that need treatment. Copy pasting between tables is error prone.

Does the standard require these tables to be seperate?
Can you explain why these are separate in the toolkit?
Any other comments will be very welcome.

Non-Conformity in RR

Dear Team - this is quite urgent - we have got a non-conformity because the auditor didn't accept the risk register as produced by Conformio - we are not sure how to mitigate this, any guidance would be hugely appreciated. Here is the non-conformity. (27001) Finding: The organisation did not fully meet the requirements for clause 6.1.2 c)1) - apply the information security risk assessment process to identify risks associated with the loss of confidentiality, integrity and availability for information within the scope of the information security management system. Evidence: missing from Risk register within Conformio platform.

Additional information: The auditor requests that we add a column showing the impact on each of the CIA - Confidentiality, Integrity, and Availability components, (e.g. Letters to show letters representing the affected components of CIA).

Support re. internal audit section of ISO 27001 2022

The policy templates we received as part of our toolkit refer to ISO27001. Should this be changed to ISO27002?

ISO 27001:2022 implementation issue

I want to ask about establishing risk acceptance criteria in clause 6 - 6.1.2 and if there is any sample can i view in order to complete creating my system, which is related to a cloud-based software solutions company

Privacy Policy Template

So I have a request – would you have a privacy policy template from iso27002 I believe a6.1.2 I can purchase?

We recently upgraded with you the ISO27001 workbook templates and I’m going through a client audit and they are asking for a specific privacy policy and so far what I have provided from either the older 2013 ISO27001 and the GDPR is not passing with them

Register of Requirements

Underneath the register of requirements where I am asked if I am compliant with the Computer Misuse Act am I expected to have a policy or do I read and agree to the terms?