ISO 27001 & 22301 - Expert Advice Community

Home / ISO 27001 & 22301

Discussions

Top Contributors

Expert

Rhand Leal

4151
Discussions
Expert

Carlos Pereira da Cruz

1915
Discussions
Expert

Dejan Kosutic

365
Discussions

Most Popular Tags

Product: Conformio Product: ISO 27001 Documentation Toolkit Product: ISO 13485 & MDR Integrated Documentation Toolkit ISO 27001 Risk Assessment Product: ISO 27001 & ISO 22301 Premium Documentation Toolkit ISO 9001 Product: ISO 13485 Documentation Toolkit ISMS Internal Audit register of requirements Product: ISO 27001 & ISO 27017 & ISO 27018 Cloud Documentation Toolkit ISO27001 Product: ISO 27001/Risk Assessment Table Product: ISO 27001 Internal Auditor Course
Select
CREATE NEW TOPIC +
Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Becoming an ISO 27001 auditor

    It's not an actual license to be an ISO 27001 Lead Auditor? So if I have the certificate of this course can I, what certificate do I need, what license do I need to be able to do an audit in a company and get them ISO 27001 audited? This license will be able to do it or not?

  • ISMS and SaaS solutions

    1. How shall I deal with SaaS solutions such as Office365 and Gitlab.com when it comes to controls related to backups and business continuity. I don't think it is feasible to build an on-premise DR site for such a solution.
    2. Also, do we have to keep a backup of our emails or does it depend on the risk assessment and whether we accept such risk?

  • Template content - DRP

    Could you please elaborate more or put examples to this column under the Disaster Recovery Plan.

    https://www.screencast.com/t/nUHexNyo

  • ISO 27001 documentation

    Hi, I have a question regarding ISO 27001 documentation. Can I combine control docs together where it makes sense to do so or should they always be separate? For instance, I wish to put the individual user agreement, wireless user addendum, and mobile phone addendum under the same agreement? Is that allowed or perhaps bad practice? Thank you

  • ISMS audit results for ISAE 3402 Type II Audit/Report

    Do you think it is possible to use the output of ISO27001 controls/monitoring/records in an appropriate ISAE3402 Type II Audit/Report?

    In ISAE3402, the auditor checks results/KPIs of a predefined set of controls against control objectives for a given time period of the past and produces an „Assurance Report“.

    It sounds to me as if ISAE3402 is just only the „Check“ Part of the PDCA cycle of the ISMS?

    It would be great to combine the 2 Standards (provided the ISA3402 scope is Information Security related, of course) and simply use the controls which have been documented by the ISMS, and using the monitor output and internal audit output for the auditor.

    Is that common practice?

  • ISMS operation before certification

    I just have one big question. How much time ISMS has to operate (month, days, years) in order to get certification?

  • Risk Assessment

    I have two questions regarding the Risk Assessment Table.

    1.  We are preparing this table for the first time. When listing an asset, is it ok to use a generic category for the asset so that it includes multiple real assets, or must each real asset be listed individually? For example, if I have 10 desktop computers, must each be listed separately or can I make one entry for "desktop computer" assuming the risks are the same for all 10?
    2. My second question is about the existing control column. Is it ok to list a preventative measure that has not been documented in a policy, or must it be an explicit control that is documented? For example, if I have a server that is vulnerable to power failure, can I list the existing control simply as "the server is plugged into a UPS" or must I site a policy document that indicates all servers must be plugged into a UPS? Again, this is the first time this document is being written, and we understand that we will need documented controls for the Risk Treatment Table.

  • ISO 27001 2019 review

    Is the information on the following link still relevant?

    (https://advisera.com/27001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-27001-2013-revision)

  • Assignment of documents

    Hello,
    we use XYZ as our document management system. I have mapped the structure of the ISO 27001 Standard in XYZ. 
    This means that I store all documents of the nom chapter 4.1 in XYZ. I now have the problem that I did not know where to file documents for Annex A. So the password policy concerns the sections A.9.2.1, A.9.2.2, A.9.2.4, A.9.3.1, A.9.4.3. But how and where do I store them in XYZ? Does this belong in separate subchapters of chapters 8.1 or how do I do it best?


    I would be pleased about quick feedback

  • BCM framework and policy

    Currently, I am drafting BCM framework for my small organization which is on SAAS platform. We have multiple sites as well with in XYZ and XYZ as well.

    May you please give me some inputs/ guidance, how to draft the framework and policy and what points to consider keeping in mind SAAS.
Page 194 of 544 pages