Take the ISO 27001 course exam and get the EU GDPR course exam for free
Limited time offer – valid until September 30, 2020
Give input to the Business continuity objectives for the ISO year 2021 for an organisation
Could you possibly point me in the right direction in ISO 27001 where I can find information about License management Auditing?
We have already implemented ISMS in our organization and work on BCMS implementation. Is it a good idea to add selected BCM contents to existing ISMS policies? I mean to update create one main policy with general contents dedicated to IS and BCM (inc. context ect.) to have Information security and Business Continuity Policy - main document. Then one detailed policy for BCM and IS events, which clearly describes who and how manage such incidents. Our priority is to have one integrated system covering ISM and BCM, not two separated management systems. Thanks for your advice
Our company got ISO 27001 certified this year - and will go through surveillance visits next year.
I wonder if there are any focus areas during a surveillance visit and if you could provide any guidance and support on what to focus on during the surveillance visit?
The toolkit may not be the best thing for me, I normally implement a BCMS alongside a SME carrying out an ISMS but I feel I need to know more about the 27001 processes especially as they are so complimentary! I can see a time when I may be asked to look at both. Both in consultancy and looking at jobs I feel I need to improve my knowledge of 27001!
Any advice would be helpful!
1. What happens if all controls (Existing and additional control(based on Annex A) are implemented? Does it mean we entirely remove the risk from the register - yet based on the activities there are chances of the risk taking place?
2. How often should an organization undertake risk assessment and risk treatment
3. When should one calculate the residual risk? Should it determine the risk assessment process of the subsequent year?
4. Is there any template that you can share for risk assessment and treatment, with criteria and like hood, etc.
Hi, In this list https://advisera.com/27001academy/knowledgebase/laws-regulations-information-security-business-continuity/
for France and the European Union, there are mainly regulations regarding personal data protection. In my understanding, ISO27001 requires to list all the regulations that apply to the business of the company seeking the ISO certification, which would be much wider.
For example, our company provides a billing software. I would have listed all french regulations related to billing and not only data protection. Is my interpretation of the norm too wide ?
I have started reading your book and it looks great. Kindly help me with the following,
I want to find out if Audit checklist is a requirement or a choice to the auditor whether to use a checklist or not.
Also do you have any idea on how to effectively manage corrective actions.
What is the difference between Nonconformity/Conformity and Noncompliance/Compliance.
Please, your response is much appreciated.
I am browsing through your website for the ISO 27001 controls and was wondering if you could explain to me how ISO 27001 differentiates and classsifies between security functional and non-functional requirements?
I have a question that I cannot get a clear answer to. I hope that you can help.
My customer develops a software product for its customers. They do not however carry out any software development for themselves. All of the systems that they use in-house are commercial-off-the-shelf packages like Office365, Slack, PeopleHR, and Xero (all of which are SAAS applications). They do not customise the code at all.
We are trying to establish whether or not they need to apply the Annex A.14.2 controls as these are aimed at "developments within the organisation".
Do you have any thoughts on this?
